Diagnosing ERM Problems

As we emerge from the financial crisis and global economic downturn, many companies are beginning to realize the need for a comprehensive review of their Enterprise Risk Management (“ERM”) programs.  While some executives may think that their program is sufficient, they simply may have a false sense of security because they have just survived the recent crisis.

In reality, most organizations have been focused purely on survival and have allowed their more forward-looking risk management practices to take a back seat.  In addition, in order to weather the financial storm, some companies looked to risk management organizations for cost savings and scaled back their infrastructure and resources.  Ironically, it is the companies that have survived the crisis relatively unscathed that may be the least prepared and the most at risk for a future loss event.

So, how do you know how healthy your ERM program is today?  The best and most reliable way is to conduct an independent, diagnostic review of the program.  A diagnostic review should focus on two main components of the ERM program – the level of desired maturity and the core foundational elements.  First, a company needs to determine what level of maturity they are seeking to achieve.  This is based on a number of factors including the size of the company, the nature and complexity of the business, and the external environment in which the business operates.

After determining the desired maturity, the company should examine the core foundational elements that form the ERM program itself.  A comprehensive review of these elements will help the company understand both the progress toward the desired maturity level as well as the major gaps that may exist in the foundational elements.

Much like an annual physical check-up exam, it is a good idea to perform a diagnostic review of your ERM program on a periodic basis to ensure that it is providing the expected level of risk management discipline within your organization.  Wheelhouse Advisors has designed a quick and effective review to provide companies an independent view at a reasonable cost.  For more information, feel free to email us at navigatesuccessfully@wheelhouseadvisors.com.

How Mature is Your Risk & Control Program?

During the past decade, many significant events occurred that placed greater demands on how companies manage their risks.  At the beginning of the decade, we experienced the financial downturn associated with the bursting of the high tech/internet bubble.  Then, we had the after effects of the September 11th terrorist attacks.  Corporate accounting scandals at Enron and WorldCom created new financial reporting challenges in the form of the Sarbanes-Oxley Act of 2002.  Now, we are finally beginning to emerge from one of the greatest financial meltdowns in American history.  All the while, companies have been trying to keep pace with ever increasing levels of risk and regulation.

Much of the fallout from the financial crisis of 2008 can be attributed to the lack of coordination and integration of risk management practices at individual firms as well as across entire industries.  To be successful at managing risk going forward, companies must begin to examine how they are currently focusing their efforts and how they need to evolve their overall risk and control program.

The evolution path for most risk and control programs can be broken into four distinct stages – Developing, Implementing, Improving and Integrating (see figure below).   As companies begin to take a more focused approach to managing risk, they usually begin by simply reacting to regulatory demands or recent negative events that have occurred.   In this initial “Developing” stage, companies may create ad hoc task forces or assign individual teams to address the risks.

However, most companies begin to see the need for a more formal, enterprise-wide approach and enter the “Implementing” stage.  Here, a risk champion is typically named, standards are created and the various teams begin to align and share information.  Once the sharing of information begins, both horizontally and vertically through the company, inefficiencies and gaps become apparent.

Companies then move to the “Improving” stage in order to streamline processes and adopt best practices.  Finally, once the program has matured into an efficient mechanism on its own, it should be fully integrated into the business itself – at all levels.  It is this “Integrating” stage of evolution that is the holy grail of Enterprise Risk Management.

Where is your company on the evolution path?  What obstacles are you facing as you look to progress from one stage to another? Wheelhouse Advisors can provide both unique insight and practical solutions to help you reach the desired level of maturity.  To learn more, visit www.WheelhouseAdvisors.com.

Mind the Knowledge Gap

Former SEC Chairman Arthur Levitt delivered some very interesting remarks in a recent speech at the Annual Audit Committee Conference sponsored by the National Association of Corporate Directors ("NACD").  Mr. Levitt challenged companies to improve the knowledge base of its board members to allow for more fulsome discussions on risk.  He also provided some recommendations for better governmental oversight and regulatory reform.  Here are a few of his thoughts.

Let’s talk about steps that need to be taken by corporate boards on their own. In general, I favor elements that improve transparency and accountability. Basic improvements, like giving investors access to the proxy, would push boards to be more proactive, and more sensitive to investor concerns.

But being more accountable is a lot easier when you have the right expertise. Right now, independent board members often don’t have the base of knowledge they need. When someone working every day inside a corporation is presenting information and analysis to the board, there will always be a gap between what they know and what the board knows. This gap is inevitable, but it need not be permanent. That is why I would strongly favor that boards of directors include individuals with financial market experience, and especially expertise in understanding, pricing, and managing risk. With even one  member regularly raising challenging questions and issues, boards would be able to press management to think far more creatively about issues such as counter-party risk, operational risk, and so on.

Mr. Levitt is right in his view that the knowledge gap must be bridged to ensure board members are truly effective in their roles.  It will take renewed efforts on both sides - management and board - to accomplish this feat. However, not only will they benefit, their shareholders will as well.

Too Much Risk

Yesterday, the Financial Crisis Inquiry Commission conducted a hearing to examine the failure of Bear Stearns in 2008.  The theme of the testimony by Bear Stearns was that there was too much risk in the broker-dealer's capital structure. Here is what the Wall Street Journal reported.

Former Bear Stearns Chief Executive Officer James Cayne said Wednesday that his firm's risk level was too high in the year before it collapsed. "That was the business," Mr. Cayne told a hearing held by the Financial Crisis Inquiry Commission, a congressional panel scrutinizing the financial crisis. "That was really industry practice. In retrospect, in hindsight, I would say leverage was too high." Commission Chairman Phil Angelides said Bear Stearns was leveraged at a ratio of 38 to 1, sometimes as high as 42 to 1, and held $46 billion in exposure to mortgages. "How is that model sustainable in the event of any market disruption of significance?" he asked.

The simple answer to Chairman Angelides' question is that the model is not sustainable at that level of leverage. The problem is that in 2004 the SEC allowed firms like Bear Stearns to increase leverage from a prior limit of 12 to 1 to much higher levels.  So, the government can also look to itself when seeking to place blame for the market collapse.

Investors Seeking More ERM Disclosure

On a morning where the Dow Jones Industrial is down over 2%, many investors may be wondering how to get a better understanding of the companies in which they are looking to invest.  These investors might be well served to research the effort that a company is devoting to manage their risk effectively.  A recent article by Lawrence Richter Quinn provides interesting perspective for those looking to learn more about how to evaluate a company's enterprise risk management program.  Here's some of what he has to say.

It is a difficult task for investors to discover which companies are working to manage risk from an enterprise-wide perspective - and an even more difficult job discovering who is doing so effectively. Many board members don't understand ERM, believing it to be simply another potentially costly, hard-to-measure regulatory fiat from Washington. Many others believe that effective ERM can be achieved simply by expanding their SOX-related reporting and controls efforts, which is not the case.

Because it's a new management discipline, what constitutes "best practices" in ERM has yet to be defined; currently it's being defined industry by industry, but few if any companies promote themselves as being "best of the best" in ERM or risk management.

So, how do you know who's working hard at effective ERM? A growing number of companies, particularly outside the U.S., devote a significant portion of their annual reports discussing risk management, regardless of whether they specifically call it ERM. Generally, investors interested in discovering who's doing a comprehensive job at risk management - and reporting it publicly in their annuals - need to look abroad. Just north of the border, Canadian-based companies discuss risk extensively in their annuals and they are a good place to start looking into this area further.

One way to quickly see if the company you are researching does have ERM is to check for a Chief Risk Officer (CRO). While CROs are most often found in the energy, banking and insurance industries, more aggressive manufacturing companies are moving in that direction as well. Another clue is found in a tiny nut of companies that have managers specifically in charge of coordinating their ERM efforts. These managers will have the words "enterprise risk" in their titles.

While the U.S. is still playing catch-up on effective risk management disclosures (even though the SEC is beginning to crack-down with new proxy rules this year), U.S. companies are beginning to strengthen their enterprise risk management capabilities.  Those companies that are not working to strengthen their capabilities will certainly suffer a competitive disadvantage as a result.

A Week to Remember

This week has been full of activity that will shape the nature of enterprise risk management ("ERM") programs in the months and years to come.  First, the logjam in the U.S. Senate finally broke with the start of floor debate on financial regulatory reform.  At the same time, hearings into the dealings at investment banks during the height of the financial crisis surfaced some interesting points on the need for more integrated risk management across financial institutions.

There were also several risk management industry conferences with significant keynote addresses.  A great summary of these events can be found on the OpenPages blog.  OpenPages is a strategic partner with Wheelhouse Advisors and provides a technology platform that enables the integration of risk management practices within companies.  As companies look to ready themselves for regulatory reform and strengthen their ERM programs, they will certainly need solutions like OpenPages to become more resilient to the rapidly changing risk and regulatory landscape.

No doubt that this will certainly be a week to remember for the evolving state of ERM and regulatory reform.

Lack of Resources Hinders Risk Management Improvements

A survey listing the top challenges for improving risk management practices was released today at the Risk and Insurance Management Society Annual Conference in Boston.  Not surprisingly, the number one challenge for most companies is the availability of qualified resources.  With limited budgets and smaller talent pools coming out of the economic recession, these companies are struggling to elevate the effectiveness of their risk management programs. Here is what Business Insurance magazine reported today.

The lack of staff dedicated to risk management ranked highest on a respondents' list of challenges to improving the practice of risk management in their organizations, with 44% citing that lack as a challenge, according to “Excellence in Risk Management VII: Elevating the Practice of Strategic Risk Management.” Having other areas with greater priority than risk management was cited as a challenge by 43% of the respondents. Demonstrating the value of risk management ranked third, at 34%. Lack of financial resources dedicated to risk management, and senior management commitment rounded out the Top 5, cited by 33% and 32% respectively.

Companies will need to be creative in finding solutions to these challenges.  Wheelhouse Advisors can help.  With deep expertise at a reasonable cost, Wheelhouse Advisors provides a compelling alternative to engaging larger consulting firms or hiring full-time staff.  Email us at NavigateSuccessfully@WheelhouseAdvisors.com to learn more.