As a CFO, you share responsibility with the board of directors for assessing and mitigating risk and aligning it with the company’s strategy. But how confident are you that the board is holding up its end of the charter?
According to a new report from Ernst & Young, “many boards still struggle to see and understand emerging risk signals that may ultimately impact strategy.” Indeed, as most companies’ risk profiles are growing more complex, boards’ approach to risk oversight is evolving.
Most prominently, 60% of board members surveyed by board leadership publication Corporate Board Member, which partnered with EY on the research, said their full board has devoted more time to risk oversight over the past two years. It’s a notable shift, as boards traditionally have delegated risk oversight to their risk or audit committees, with the full board having annual or periodic risk discussions, EY noted.
Boards are also revising other aspects of risk mitigation, including improved reporting on emerging risks and increased engagement with management levels below the C-suite.
However, the report said, “more time does not necessarily mean greater impact.” Asked where they see the greatest need to strengthen their risk oversight capacity, 44% of the 157 survey participants pointed to scenario and stress testing, 38% said understanding interconnected/systemic risks and 38% cited integration of risk and strategy.
“These capabilities are becoming more important as risks increasingly cut across company silos and span multiple functions,” EY wrote.
The firm said it was surprised that only 43% of those surveyed said their company’s risk appetite was formally articulated and documented. The percentage fell to 30% when excluding financial services companies, for which regulations require strict procedures around risk appetite.
About a third (29%) of the directors said their company’s risk appetite is articulated but not documented, while 25% said it is “understood broadly” but not documented. That was the case even though 58% of those surveyed said their board continuously reviews the company’s risk appetite as conditions change.
EY advised boards to document risk appetite without allowing the process to become a “check-the-box” exercise. “Instead, it should be a proving ground for decisions about how to best approach risk and its impacts,” prompting deeper conversations that yield critical levels of clarity and consistency.
The report listed several actions boards can take to formally define risk appetite:
- “Prioritize articulating and documenting risk appetite as part of annual strategy-setting discussions”
- “Incorporate risk appetite into board discussions on strategy, growth and major investments”
- “Have risk leaders present not just to the audit or risk committees but also to the full board on key risks that may threaten strategy or growth”
