Where did that come from? How well do we understand our risks?

I expect we’ve all heard enough of the corporate horror stories. One big failure has barely dropped off the front page when another hits. Some, like General Motors and Chrysler, resembled train wrecks in slow motion that we couldn’t stop watching, over months or years, even though we sensed how they were going to end. Others, like Bernie Madoff’s vanished billions and Bank of America’s boss Ken Lewis after the Merrill Lynch acquisition (hero to zero in six months), seem to have hit from nowhere.

So what have all these cases in common? One question being asked with increasing frequency is ‘Where was the Board of Directors?’ This leads to another thought, which is that in each of these cases the Board, generally a group of very smart and experienced individuals, must have made some (conscious or subconscious) assumptions that turned out to be flawed.

At GM maybe the underlying assumption was ‘we’ve been in this situation before and the great American public will see us right,’ or perhaps ‘we’re a national icon and a huge employer... we’re too big to fail’ (and how often have we heard that epithet in the last 12 months?). Around Bernie’s Board table, perhaps the mistake was something more fundamental, maybe ‘what a great investor he is’ - overlooking the now-obvious question of where (and whether indeed) he was investing, or just moving the money around.

In today’s climate especially, one of the biggest challenges for a Board of Directors is identifying the real risks that can derail the company. But how many Boards ask the simple question, ‘what are the things that could put us out of business... however unlikely they may seem today?’ And why don't they ask? Because the CEO might be offended?

I’m not talking about Boards becoming entirely risk averse: that’s not how you make your shareholders rich. However, I am talking about a Board’s real understanding of the risk profile, and making some conscious decisions about the corporate appetite for various risks. I’d expect that in at least the majority of these cases the camel's-back-breaking-straw risk that finally brought the company down was one that the Board hadn’t fully seen coming. I’d also guess, without knowing the answer, that most if not all these companies had formal committees set up to identify and monitor risk.

Knowing that the quality of your Board’s decisions depends on understanding your opportunities and your risks, how do you know that the risks you’re hearing about are those that require the greatest focus? How do you ensure that the decisions you’re making will address these risks? How can your Board ensure that they have asked the right questions of the management team?

Well (for once here’s a direct pitch), we’ve brought to New Zealand what is possibly the first - and almost certainly the most thorough - method for assessing the effectiveness of your risk committee(s). We look at ten different aspects, from your risk culture to your management processes, and we ask you to assess two factors: how important each is to you, and how well you think you deal with it.

Sounds simple, even simplistic? Well, one large international client, which has put all its risk committees through this (board, management, operating units, subsidiary companies), and then saw the 'gap analysis' that emerged, has told us that if they’d done it four years ago they would have identified holes in their systems and culture, which would almost certainly have prevented some huge, very public, problems they faced.

If you’d like to know more, please contact me. Meantime, if you’d like me to send you a copy of some analysis we’ve done (as part of a larger survey among over a hundred Boards), on how effectively Boards generally oversee their risk, let me know and I’ll forward that to you too.

No obligation, no pressure, but can you afford not to be interested?