When calamity struck in the shape of the financial crisis, financial institutions and then companies in the wider corporate sector were forced into a moment of reflection.

Few had developed a process for evaluating risk across the areas of strategy that they were operating in and were found lacking. Since then, a growing realisation has entered company boardrooms that a process addressing the potential downside of every major strategic decision has to be put in place.

But there are concerns that board directors may not be best placed to evaluate the risk attached to their strategic decisions.

The onset of the global financial crisis was the catalyst for strategic risk becoming one of the most important concerns for boards of both public and private companies, says Professor John Buley, consulting professor of finance and executive director of the Center for Financial Excellence at Duke University’s Fuqua School of Business in the US.

“This was because of the failure of several banks, hedge funds and companies that did not have strong risk management cultures,” he adds.

Firms that gave “adequate” attention to strategic risk now find themselves at the bottom of the pack, since those boards that had little or no regard to risk management are out of business, says Buley.

“Even firms with strong risk cultures are expanding their consideration of risk given the fiscal cliff, the euro crisis and high volatility in commodity markets. The level of market uncertainty has risen and boards are rightly holding management more accountable for risk and risk governance.”

Armoghan Mohammed, a partner in PwC’s risk leadership team in the UK, says that despite its infancy strategic risk is identified as one of the key areas for a board to be focused on.

“In a survey we conducted last year in the US and UK (“Key issues in the relationship between internal audit and risk management, May 2011”) we asked boards what factor could produce the biggest decrease in shareholder value. Of the four areas of hazard, financial, operational and strategic, the latter came out on top with 39 per cent.”

The effects of the financial crisis have ensured that the issue is high profile, says Amanda Morrison, UK-based lead partner of enterprise risk management services at KPMG.

“In the aftermath of the financial crisis the expectation on boards that they manage risk robustly (both in the financial and non-financial sectors) has never been higher. Shareholders, investors and regulators alike increasingly expect corporates to have sound risk management practices and to be much more transparent about their effectiveness. This necessitates much more focus around risk at board level than would historically have been the case.”

Part of the challenge for corporates coming to terms with a more volatile world is the ever-increasing rate of response of world markets to events.

As markets move faster, boards need to be more agile and respond to strategic risks, says Morrison.

“The world is changing at a phenomenal speed – innovation, changes in regulation, demographics, politics, technology and globalisation all combine to make the business environment that organisations operate within, and therefore the risks that their boards manage, more complex than ever.”

To be successful in this environment boards need to ensure that their company’s approach to risk management is dynamic, to enable it to identify emerging and new risks on a real-time basis, says Morrison.

“It also needs to be fully integrated into the business to facilitate the right people in getting the right risk information to be able to report to the board on a real-time basis to enable it to make the right decisions at the right time.”

Board directors are unable to look closely at strategic risk management, says Professor Lutgart Van Den Berghe of the Vlerick Leuven Gent Management School in Belgium.

“It is a false assumption that they can take on this responsibility when they are non-executives. But they are able to undertake oversight,” she says.

KPMG’s Morrison says that at the turn of the millennium, many boards’ oversight of risk typically entailed them receiving an annual presentation on the company risk register, whereas today their oversight has changed significantly.

“This is most obviously evidenced by the fact that boards are increasingly formally recognising risk as an area of significant focus in their board committee structure.”

She says that while it is still common to see responsibility for risk devolved to the audit committee, things are changing. “If you look at the FTSE 100, for example, an increasing number of boards have now either established a dedicated risk committee or are formally recognising the importance of risk in the audit committees’ remit by renaming it an ‘audit and risk committee’.

“Unsurprisingly, the focus of these committees is much deeper than an annual review of the risk register. In a recent KPMG survey into this area we found that the majority of respondents now formally revisited their risk profiles once a quarter. Increasingly, what we are seeing in practice is that when the risk profile is reviewed, these committees are asking much more probing questions.

“As an example, they want to understand the process for ensuring that new and emerging risks are identified promptly, that there is clear accountability and responsibility for monitoring individual risks on an ongoing basis.

“Furthermore, what evidence is there that the individual controls over the risks identified on the profile are properly embedded across the whole group (including in overseas subsidiaries) and are operating effectively? Occasionally, these committees may even wish to meet with individual risk owners to try to get greater comfort on any specific risks where they have particular concerns.”

Boards now meet with greater frequency as a result of the crisis, says Duke University’s Buley.

“The issues they deal with are more urgent and the level of knowledge they are expected to have about the activities of their firms is increasing. At the same time, the rate of change is increasing and the time demands on board members and their advisors are therefore increasing. I don’t see this changing for many years.

“As boards of financial companies and any company with exposure to commodities or the eurozone are seeing, there is no such thing as a ‘too quick’ response. There is a danger of a ‘too quick’, but ill-informed decision. In this market, decisions must be made both quickly and correctly.”

Board composition has shifted so that there is a greater level of industry knowledge, strategic expertise and independence from management, says Matt Fullbrook, manager of the Clarkson Centre for Business Ethics and Board Effectiveness at the Rotman School of Management at the University of Toronto.

“In addition, board meeting time allocation has shifted so that less time is spent looking at past performance and more time is spent on forward-looking strategic issues and risk oversight.”

Boards’ information expectations from management have also changed, says Fullbrook. “I am working with more and more boards that explicitly set aside board meeting time for discussions about positive and negative outcomes, as well as crisis scenarios.”

It’s not just the financial crisis that has focused boards on risk. The recent upheavals in the eurozone have ensured that economic risk has added to the mix of challenges impacting on boardrooms.

“This has increased the pressures on boards to evaluate political and economic risk stemming from the continuing efforts of the ECB and individual countries to stabilise the fiscal and monetary policies of each country, and the eurozone as a whole,” says Duke University’s Buley.

“What was considered a remote possibility only last year is now a reality for companies operating in the eurozone.”

Another challenge for boards seeking to address risk has come in the complexity thrown up by operating in emerging markets. Global companies are inevitably seeking to enter new markets, sometimes as a response to the weakened opportunities in the eurozone countries.

But alongside political and security risks, changing local laws and regulations can have an adverse effect on unwary companies. So how can companies prepare for, and mitigate, these risks?

“Board management of risk and uncertainty is part of both a process and a culture,” says Buley.

“Boards of directors have to ask the proper questions of management and quickly assess whether management has the right strategy. It is impossible for the boards to have all the answers. But they should know the right questions. If boards don’t find these answers to be satisfactory, they should continually press management and obtain outside advice from accountants, law firms and other subject matter experts.”

But are board decisions, particularly on cost savings, creating new organisational risks or unintended consequences?

“Knowing where costs can be contained without creating additional risk is crucial,” says Buley.

“For example, it is easy to posit that only sales and revenue-accretive staff should be immune from cost-cutting. Boards now have to look at the effect years or even months from now from the perspective of unintended consequences. For example, risk management, compliance and audit are not revenue accretive at first glance. But before any responsible board would consider cutting costs in these areas, consideration must be given to the medium- and longer-term consequences of such a decision.”

Professor Michael Keehner, a former Wall Street banker now teaching at Columbia University in New York, says that concerns around cost-cutting are not unfounded. He says that the greatest threat to an organisation is often far from the centre.

“Threats are most likely to come from the fringes, either geographically, such as the Singapore office of Barings that brought down the UK merchant bank in the early 1990s, or in a new area of innovation. Most recently, we saw in the JP Morgan’s $6bn trading loss from the ‘whale’ investor earlier this year an instance of inadequate controls and procedures.”

Illustration: Eve Lloyd Knight