Thursday, January 21, 2016, New York – EisnerAmper LLP today released the results from its sixth “Concerns About Risks Confronting Boards” survey. The consistent trend, over all the surveys, is that reputational risk ranks as the top concern. Seventy-five percent of Board members consider it of “Most Concern” – its highest percentage ranking in three years.
However, as Charly Weinstein, EisnerAmper Chief Executive Officer noted, “Because social media and cybersecurity are intrinsically linked to a company’s reputation and image, organizations and Boards should consider both as among the most important risks to manage and monitor. With today’s media capable of capturing every crisis occurring within organizations, it is becoming increasingly evident how connected reputation, cybersecurity and social media are in relation to risk.”
Weinstein goes on to state, “The findings strongly reflect the accelerating pace of change facing directors. To fulfill their commitments to their stakeholders, Board members need to ensure that their organizations are informed, educated and forward-focused.”
Read the full report here.
The survey results showed a broad trend of Boards that identify risk – but take no action to manage that risk. While action may very well fall to those in the day-to-day operational roles, there seems to be little happening at the Board level to encourage addressing the risks in a more comprehensive fashion. “Reputational risk is a severe threat to all companies, yet responses from Board members indicate that reputational risk is so broad in scope – highly impacted by other risks like financial, product, cyber and more – that it is difficult to sufficiently address and prepare for the many types of reputational threats,” said Steven Kreit, an audit partner at EisnerAmper who has led the survey project since its inception.
Sample Survey Results
Social media is the current “wild west” of risks for Boards. Shockingly, only 6 percent of Boards feel as though they are well-versed in social media risk, and 67 percent of organizations are not engaging external consultants to monitor social media. The results indicate that Boards may not fully understand the potential impact and harm social media can have on a company’s reputation.
Cybersecurity is the most recognized specific risk, emerging as a concern for 70 percent of respondents on public company Boards. More than 95 percent of public companies either use internal audit or external auditors/consultants to monitor cyber risk. However, only 24 percent feel their Boards are well-versed in understanding cybersecurity risk and another 10 percent feel that they are falling short of fully understanding the risk.
What issues cause the most concern today?
The top four:
- Reputational Risk – 75 percent
- Cybersecurity/IT Risk – 61 percent
- Regulatory Compliance Risk – 53 percent
- Senior Management Succession Planning – 51 percent
These rankings have remained generally constant over the past three years across public, private and not-for-profit Boards.
Who Manages Risk in Corporate America
The survey addressed how well companies identify and address risk. Seventy-eight percent of public company directors said their firms employ personnel in an active internal audit function and 71 percent say that their internal audit teams have been helpful or very helpful in identifying risk. Further, 92 percent of Board members say that regular Board meetings address risk well or very well, 84 percent say that external auditors address risk well or very well and 86 percent say that the legal and compliance group address risk well or very well.
While Boards govern an organization and set strategy, management executes the strategy. The survey asked directors if they feel their CEOs have a strong understanding of topics related to risk. For the past three years, cyber and social have been the two areas where Boards feel that CEOs are not managing as well as others. The trend continues this year with at least 25 percent of Board members feeling that the CEO is not managing these issues well. Yet, they are also the two areas where Boards feel CEOs should have more responsibility.
The survey concludes by noting that while companies are beginning to take the proper steps to prepare for a reputational crisis by having plans in place, providing training and employing an internal audit function, fewer than 50 percent of respondents feel they are “well-versed” in the issues.
Methodology
The survey measures the opinions of directors serving on the Boards of more than 300 publicly traded, private, not-for-profit and private equity-owned companies across a variety of industries. Evaluations of the responses were also based on the organization’s revenue as well as a comparison of past years’ data. Directors were polled via a web-based survey, sent to select EisnerAmper contacts and members of the NACD Directorship database.
About EisnerAmper
EisnerAmper LLP is a full-service audit, tax, and advisory firm and among the largest in the United States. In addition to audit, accounting and tax services, EisnerAmper provides corporate finance, internal audit and risk management, litigation consulting, forensic accounting and other professional services to a broad range of clients. We work with businesses ranging from startups to Fortune 500s, including providing services to more than 150 public companies. With offices in New York, New Jersey, Pennsylvania, California, Florida and the Cayman Islands; and as an independent member of Allinial Global and EisnerAmper Global, EisnerAmper serves clients worldwide.
Visit us at www.eisneramper.com.
