Board Oversight of Management’s Risk Appetite and Tolerance: Regulators Claim they Expect it but Change will Not Come Easy

Abstract

In the aftermath of the 2008 global financial crisis post-mortems were convened in countries around the world to identify what went wrong. A unanimous conclusion was that boards of directors of public companies in general, and financial institutions in particular, need to do more to oversee “management’s risk appetite and tolerance” if future crisis are to be avoided. This finding represents a significant paradigm shift in role expectations while introducing a new concept the Financial Stability Board (FSB) has coined effective “Risk Appetite Frameworks” (RAFs).ⁱ Regulators around the world are now moving at varying speeds to implement these conclusions by enacting new laws and regulations. What regulators appear to be seriously underestimating is the amount of change necessary to make this laudable goal a reality.

Notes

i. See Principles for an Effective Risk Appetite Framework November 2013, Financial Stability Board.

ii. U.S. Securities and Exchange Commission, “Final Rule on Proxy Disclosure Enhancements,” Release Nos. 33-9089 and 34-61175, effective February 28, 2010, p. 44 (www.sec.gov/rules/final/2009/33-9089.pdf). Last accessed September 5, 2013.

iii. See Tim Leech and Lauren Leech, “Preventing the Next Wave of Unreliable Financial Information: Why U.S. Congress Should Amend Section 404 of the Sarbanes Oxley Act.” International Journal of Disclosure and Governance advance online publication, 8 September 2011; doi: 10.1057/jdg.2011.18 http://riskoversightsolutions.com/wp-content/uploads/2011/10/PreventingTheNextWaveofUnreliableFinancialReportingWhyUSCongressShouldAmendSOX404LeechandLeech.pdf

iv. See COSO press release at http://www.coso.org/ermupdate.html

v. The two primary recognized risk frameworks are the 2009 ISO 31000 Risk Management standard and the 2004 COSO ERM framework.

vi. The most accepted risk management taxonomy is ISO Guide 73 Risk Management Vocabulary 2009.

vii. Per ISO 3100 Risk treatment can involve: avoiding the risk by deciding not to start or continue with the activity that gives rise to the risk; taking or increasing risk in order to pursue an opportunity; removing the risk source; changing the likelihood; changing the consequences; sharing the risk with another party or parties (including contracts and risk financing); and retaining the risk by informed decision.

viii. See Leech, “The High Cost of ERM Herd Mentality,” unpublished white paper, for more details on deficiencies of traditional ERM. http://riskoversightsolutions.com/wp-content/uploads/2011/03/Risk_Oversight-The_High_Cost_of_ERM_Herd_Mentality_March_2012_Final.pdf

Additional information

Notes on contributors

Tim Leech

Tim J. Leech, FCPA, CIA, CFE, CRMA is Managing Director Global Services at Risk Oversight Solutions Inc. He has over 25 years of experience in the board risk oversight, ERM, internal audit, and forensic accounting fields, including expert witness testimony in civil and criminal proceedings and global experience helping public and private sector organizations with ERM and internal audit transformation initiatives and the design, implementation and maintenance of integrated GRC/ERM frameworks. Leech has provided training for tens of thousands of public and private sector board members, senior executives, professional accountants, auditors and risk management specialists in Canada, the U.S., the EU, Australia, South America, Africa and the Middle and Far East. He has received worldwide recognition as a pioneer, thought leader and trainer. His newest innovation, “Board & C-Suite Driven/Objective Centric ERM and Internal Audit”, a new approach to ERM and internal audit, has been licensed by the IIA for global deployment in 2015.

Parveen Gupta

Parveen Gupta is the chair and professor of accounting at the College of Business and Economics at Lehigh University in Bethlehem, Pennsylvania. He is a recognized expert in Sarbanes-Oxley, internal control, risk management, financial reporting quality, and corporate governance. He has published numerous research papers and monographs in these areas. He is the recipient of many awards in teaching and research. During 2006–2007, he served as an academic accounting fellow in the SEC Division of Corporation Finance, where he worked closely with the division’s chief accountant and participated actively on Sarbanes-Oxley-related projects. He is a frequent speaker at academic and professional conferences both at a national and international level. He is often quoted in the media.