Identifying, Monitoring, and Avoiding the Risks that Matter the Most

Plenary Session

Monday, October 20, 3:00 PM

Moderator:
Dennis R. Beresford Director, Fannie Mae and Kimberly-Clark Corporation
Panelists:
The Honorable Barbara Hackman Franklin Director, Aetna Inc. and The Dow Chemical Company; Former U.S. Secretary of Commerce
Larry A. Leva Vice Chairman Professional Practice & Global Head of Risk Management, KPMG

Digested from the plenary session:

Dennis Beresford:
To help us put things in perspective as we talk about identifying risks: A magazine ran a "Dilbert-type" contest looking for quotes, and the one that stood out to me was this one: "What I need is an exact list of specific unknown problems we might encounter." Maybe that list would have helped us avoid the current crisis.

The Honorable Barbara Hackman Franklin

The Honorable Barbara Hackman Franklin

Barbara Franklin:
In general, I think a number of us here are on a couple of different company boards. I think companies are battening down and cutting costs-which means cutting jobs. You have people who are not only stretched, but they are stressed-looking at their 401(k)s and mortgages. I think the basics of internal controls are even more important now than they were before.

We're in a period of great uncertainty. Last night, a majority of people here said they thought the downturn would last two years or more. We don't know where it will end, and it will stretch all of us. It'll stretch the guy on the plant floor-and the rest of us need to be very vigilant-the audit committee, the auditors, all of us.

Larry Leva:
Companies need to think about how they plan to communicate. The risk factor section of 10-Ks will need a substantial re-write. And I think companies need to start thinking about that now.

Board members also need to ask:

If you look at the collapse of commodity prices-I know companies that have locked in oil prices at $150 a barrel, when they thought it would go up to $200. Now that it's $75, they have a real problem. That's something that needs to be disclosed.

Given the dramatic decline in the stock market, companies also need to look to see if there's a triggering event with regard to good will. Companies need to think not only about how they'll deal with it, but about how they'll communicate about it.

Barbara Franklin:
Looking at the top priorities and concerns of directors with regard to risk management, I would emphasize the internal control structure as a top concern.

I also think this is a world-changing time. Things will happen-things that our government or other governments will do-that will impact us. These are things that we may not know about. We all have to be really vigilant, watching what happens and what's going on.

Larry A. Leva

Larry A. Leva and The Honorable Barbara Hackman Franklin

Larry Leva:
Companies and boards can't just look at a list and think that it's a complete list. This is no time to be shell-shocked. Companies need a robust risk management program.

For accounting judgments and estimates-this is an extremely challenging period. Given the current economic environment, looking at past history may not always be a good guide. And if access to capital or finance is not available, you may have companies which looked good before but are now going concern issues.

I'd also ask: Where does reliance end? How much reliance should the board have on the information coming from management? This is not because you don't trust management-but because you can help management by asking questions and identifying issues they may not have thought of.


How satisfied are you that your company has an effective process to identify potentially significant business risks facing the company-both financial and non-financial?
 
Very satisfied 14%
Somewhat satisfied 45%
Needs improvement 39%
Not sure 2%

Total Responses: 323

Barbara Franklin:
When looking at how to make sure your company is inventorying risk, I'd like to use the example of Dow Chemical-which uses an enterprise risk management matrix, identifying risks according to how probable they are, and how high impact the risks are. Management provides a delineation of each risk, the mitigating actions, and the status. Another sheet shows the ownership of the risk-who in management is responsible for this risk and which board committee is responsible for overseeing the risk. The committees can then set their own agenda, based on the importance of the key risks.

Most importantly, this inventory of risks is a dynamic document that needs to be updated.

Larry Leva:
In smaller companies, they may not have the manpower to do everything Barbara was referring to. But at the end of the day, they have the need for a process to identify the key risks. One thing that fits all size companies is the idea that not only do you need to identify the risk, but you need to identify who owns the risk: It should be a fairly high senior-level manager. This person needs a plan to deal with the risk. And they must be reporting back to the full board on the risk.

Barbara Franklin:
I think it's helpful for us as board members to be able to sit back and bring a different view than what management has. The process of thinking about risks-even if you can't quite quantify them-can help to align risk management with strategy.


How satisfied are you that your company has a process to manage the risks associated with the use of models-including forecasting, risk management, decision support, and financial models?
 
Very satisfied 7%
Somewhat satisfied 19%
Needs improvement 38%
Not sure 36%

Total Responses: 303

Larry Leva:
Models in financial institutions are used as risk management tools. Clearly there were failures in the models. One lesson: You shouldn't only look at net risks-you should also look at gross risks. Because there is always the possibility that the hedging or offsetting will not work as intended.

I put together a few questions boards should be asking regarding key models:


How meaningful/useful are the risk reports that management provides you?
 
Very meaningful/useful 13%
Somewhat meaningful/useful 60%
Not meaningful/useful 27%

Total Responses: 281

Barbara Franklin:
If there are really key risks that are life-threatening, or that could affect how business is done, you really want that addressed at every meeting.

The really key risks need to be monitored at a high level, all the time. Deciding on what the key risks are comes from the enterprise risk management matrix-the risks with the most impact and the highest probability.

Dennis Beresford:
How can we determine what are the "predictable surprises" versus the things nobody could predict? Was the subprime crisis a predictable surprise?

Barbara Franklin:
It should have been-but I supposed it wasn't. If you look around, not all financial institutions were hurt equally. Why was that? Were they lucky? Were they smarter? Psychology gets in the way for a lot of us-we don't like to think that things will fall apart. Somewhere, we should have caught it.

Larry Leva:
First, I think the herd mentality-"Everyone else is doing it"-was a huge factor. In the last 10 or 15 years, we've seen the collapse of credit underwriting standards, and we've seen the tech bubble collapse. I think we've all learned that if something appears to be too good to be true-it really is.

One of the benefits of independent directors is to bring an outsiders perspective-and you can avoid the internal herd mentality. Some additional questions that it may be beneficial for independent directors to ask:

Barbara Franklin:
With respect to the Capital "R" Risk of tone at the top, here's the bottom line: In a case where there is a clear ethical breach, management, the board, and the CEO have to act quickly and decisively. You have to have a tone at the top which is unassailable.

Larry Leva:
At my company, the biggest risk management decision we make is when we decide to take on a client. We look at management and decide, "Are these people we are comfortable doing business with?" If you combine an imperial CEO and a weak CFO-that is a company we don't want any part of. If people are afraid to stand up for what's right, we don't want to have any part of that accident waiting to happen.

Audience Question: In spite of financial risk management activities, something went wrong. How do avoid being a part of that in the future? Any words of advice?

Barbara Franklin:
We really need to understand the businesses as best we can. I think, as directors, we have to make our best efforts to understand the dynamics-the success factors and the risk factors-and to not get into situations where we don't understand. If we get into these situations, we need to keep asking questions until we do understand.

Larry Leva:
Also, directors should request the business unit managers present at meetings. Do not simply hear from the CEO and CFO describing opportunities and risks at a high level. Get a sense of the management that is actually responsible for running the business.

Audience Question: Is there anything we can do to explain to the public what we've done to address the concerns, and to avoid more regulation?

Barbara Franklin:
I think what we're going to try to do at NACD is to help educate policy makers about what directors do, what we think, what we care about. Business organizations can be doing the same thing-and they can be transparent with they constituencies and shareholders in their reports.

For More Information: