I recently spoke to directors and officers about oversight of risk management by boards of directors. I prepared a list of 25 reasons that risk management failure happens, based on my experience assisting boards, including boards that have failed and boards that cannot afford to fail. Almost all of what follows below is based on real examples. I have never encountered a risk management failure where the board was not at fault, based on what the board said or did, or failed to say or do.
Here are 25 reasons for risk management failure:
1. Lack of enterprise risk management expertise on the board.
2. Governance gaps over a material risk(s) within the board or across committees.
3. Directors incapable of identifying and fully understanding the risks, or worse yet, don’t want to understand. Committees show no interest when they should be shocked.
4. Internal oversight functions reporting to management instead of the board. A complacent board does not correct.
5. Directors do not insist on a real-time line of sight over material risks and their mitigation/treatment.
6. Not upgrading information systems to track, monitor, integrate risks.
7. Lack of oversight of the process by which management identifies, assesses and actions the risks.
8. Lack of conversations, common vocabulary and prioritization of the risks.
9. Lack of internal audit, or not listening to internal audit.
10. Internal controls that are weak, even non-existent, or capable of management override.
11. Not addressing interaction of risks, their speed, and exogenous shocks in modeling and scenario planning.
12. Not considering impact on reputation, which can be greater than the primary impact considered.
13. Immature controls over non-financial material risks, especially safety, operations, reputation, terrorism, bribery, technology.
14. Risk appetite frameworks do not result in known thresholds, beyond which senior management and when necessary the board is notified.
15. Lack of independent, coordinated assurance of internal controls provided directly to the board.
16. Risk culture defective (toxicity, bullying, risk-taking behaviors) and not remedied.
17. Whistle-blowing defective (not anonymous, no independent channel, no proper investigation).
18. Risk not based on the strategy, business model and key performance indicators.
19. Key performance indicators, and pay incentives and vesting of equity, not risk-adjusted.
20. Board or committee cannot direct a third party review of risk governance, a specific risk, or a set of controls.
21. Failure to anticipate and integrate risks. Pockets of acute, unknown catastrophic risk. (This item equals 13 + 6.)
22. Enterprise risk management not really implemented but everyone thinks it is. False sense of reality.
23. Tone at the top tolerates exceptions, complacency, and unequal treatment. Limited downside for excessive or imprudent risk taking. Encouragement, enabling or dependence upon high performing risk-takers.
24. No sense of urgency to remedy the foregoing.
25. The board does not know how bad it is.
The author thanks an anonymous senior risk executive for review of the foregoing items.
