USING AN EFFECTIVE POLICY STRUCTURE TO ESTABLISH RISK ACCOUNTABILITY
Once management and the Board understand the enterprise’s most significant strategic, operational, financial and compliance risk exposures embedded in the business and have a process in place for refreshing this assessment as markets and operating conditions change, management must address – with the Board’s input – which of those risks should be rejected or retained.
STEPS TO AVOID THE RISK
These decisions have risk policy implications. If the decision is to reject a risk exposure because it’s off-strategy, it offers unattractive rewards, it’s simply the right thing to do (and threats to public safety, for example) or it’s too risky and the organization doesn’t have the capability to manage it, then management must take the appropriate steps to avoid the risk:
If an entity retains a large risk exposure – that is, it chooses not to avoid it – several risk responses are available. The enterprise can:
Whether a decision is made to reject or retain a risk, it is important to designate someone, or a group, function or unit, with the responsibility, authority and accountability to “own” the risk response. Top-down reject/retain decisions drive the need for formulating focused risk responses that are integrated within the enterprise’s strategy and business plan. This integration process drives transparency across the organization as to the risk exposure, how it is managed and who is accountable.
To that end, the lines-of-defense model stipulates that each operating unit owns the risks and risk responses integral to its respective business activities. To be effective as “risk owners,” the accountable parties, at a minimum, must be responsible for (1) deciding on the tactics around executing the selected risk response, (2) designing (or being responsible for the design of) the capabilities for managing the risk in accordance with the risk response and (3) monitoring these capabilities over time to ensure they perform as intended.
AN EFFECTIVE POLICY STRUCTURE
Risk ownership is clarified when a policy is written to articulate what people must and cannot do. The actual format and details of the risk policy will vary from one company to the next and depend on the nature of the underlying risks. That said, an effective policy structure often addresses the following:
The policy structure is more effective if it addresses the largest risk exposures that must be managed on a day-to-day basis and defines explicitly the primary risk responses that management has chosen to address those exposures. For example, it might address strategies for managing different exposures, including acceptable or preferred risk management techniques and prescribed tools and practices. If necessary, it might also point out risk response strategies, tools, products and practices that are specifically disallowed.
While the specificity of the enterprise’s policy enables effective accountability, it is only a start. After approving a policy statement, management must ensure, with Board oversight, that established policies are addressed through effectively designed procedures and that implementation of the procedures is monitored and enforced. From an accountability standpoint, the best control procedures and risk information will be worthless if traders, managers, operators and others think they can be ignored. Management must make it clear to everyone that violation of established policies and limits will be subject to disciplinary action and, depending on severity, possible termination. When violations occur, they must not be tolerated. Lessons learned must be shared.
When policy structures dictate behavioral and performance expectations, it is important that the reward system be aligned with those expectations. For instance, compensation for so-called “star performers” should be evaluated carefully to determine whether they incentivize risk taking that is not in the best interests of the organization. Neither senior management nor the Board should want a cavalier and confrontational management style or a “warrior culture” in which operating unit managers or individual employees tend to focus on short-term compensation and, thus, do not think enough – or at all – about the risks their activities may create for the enterprise.
Therefore, executive management must ensure the appropriate incentives and controls are in place to focus responsible individuals on the critical enterprise risks and acceptable – and unacceptable – business behavior. To that end, managers and Boards of Directors should recognize the consequences of too much emphasis on short-term incentives and the benefits of risk-adjusted compensation structures.
When the organization’s policy structure sets clear accountabilities for risk and the compensation system reinforces those accountabilities, there is a positive impact on the organization’s risk awareness and culture. Effectively articulated risk accountabilities lay the groundwork for balancing the entrepreneurial, revenue-generation side of the business and the control, risk oversight side of the business, so that neither one is too disproportionately strong relative to the other. This balance is elusive, which is why a strong foundation of clear accountabilities is vital to any organization.
MORE BY JIM DELOACH
Jim DeLoach has more than 35 years of experience and is a member of the Protiviti Solutions Leadership Team. His market focus is on helping organizations succeed in responding to government mandates, shareholder demands and a changing business environment in a cost-effective and sustainable manner that reduces risk to an acceptable level. He also assists companies with integrating risk management with strategy setting and performance management. Jim also serves as a member of Protiviti’s Executive Council to