Engaging the Board in Risk-Adjusted Decision Making
Wittenberg, Alex, McDowell, Tom, Ivey Business Journal Online
Numerous companies' attempts to engage directors in risk management have failed either because those attempts themselves were not properly conceived or directors - and the companies - lacked specific tools to meaningfully involve directors. These authors advance three highly practical and effective tools that will enable boards to make that meaningful contribution to the risk management discussion.
The uncertainty around the reporting of significant risks, including just what represents a "significant" risk, challenges many organizations today. Management and boards are facing questions regarding how strategy affects risk, and vice versa, and are challenged by how to best approach risk and discuss risk management in a meaningful, productive way. How can board directors and senior management be certain that they are making and approving the best possible decisions in the immediate and long term, and that the relevant risks have been appropriately taken into account? Was the right information given, received, and understood? What risk information is essential for accurately and efficiently evaluating decisions? This article will suggest appropriate responses to these important questions.
Three criteria for integrating risk information into decision making
There are three fundamental areas that must be addressed when developing an approach to risk-adjusted decision-making at the senior management level, and for helping the board understand risk-adjusted decisions to support corporate strategy. The first consideration is the quantification of the organization's acceptable level of risk, or "risk appetite". A second consideration is the involvement of various internal stakeholders into risk-adjusted decision-making to develop and debate strategic options. The final issue involves the composition, education and evaluation of board members that can evaluate strategic decisions on a risk-adjusted basis. All three areas are required for the most effective integration of risk information into decision-making and strategy evaluation.
Risk Appetite: Deciding what is too much (or too little) risk
Boards of directors and senior management have formally been discussing risk and risk management for some time, particularly as regulators have intensified requirements for public companies to evaluate their internal control processes and effectiveness. Both private and public entities have now begun to adopt practices to understand risk comprehensively beyond compliance, and to leverage that knowledge into better decision-making. These efforts have been met with mixed results, leaving risk covered only topically rather than examined thoroughly, especially how it is or is not embedded in the organization. In part, the mediocre results are due to a lack of shared understanding about risk and its effects on the organization, along both qualitative and quantitative dimensions.
The view that risk is a source of both downside loss potential and upside opportunity is also lost without a consistent approach to risk-adjusted decision-making, even though companies acknowledge that accepting risk is integral to executing strategy and growing a business. Traditional, qualitative approaches to risk management can produce risk- evaluation results that minimize the potential for risk to create value if they are not partnered with quantitative evaluation. Inconsistent levels of understanding about the key risks to the organization among senior management and the board frequently force the organization's strategy to be either risk averse or work too quickly to minimize risk. Those parts of the organization that depend on accepting certain levels of exposure or risk in order to generate their returns can suffer. Other opportunities can be missed or avoided because the case cannot be sufficiently and unambiguously made that the risk justifies the return. The view that risks are individual and separate problems to be "solved" by executives as they implement strategic choices also prevents a comprehensive evaluation of the range of risks pertaining to the decision. …