1. Risk Issues for the Board Presented By: Dr. Cesar G. Saldaña, Ph. D. Founding Fellow, ICD

2. Rising Risks: New Challenges and Trends Turbulence is certainly not unique to corporations, it increases the need for risk management and the board’s risk oversight. The board to oversee the impact of change on the company arising from such sources as :   Technology, including the Internet and mass media   Globalization   The threat of terrorism

3. The Importance of Oversight by the Board Risk oversight – “the systematic process of managing an organization’s risk exposures to achieve its objectives in a manner consistent with public interest, human safety, environmental factors and the laws” To ensure adequate risk oversight by the board, directors must: understand the specific risks facing the company ensure that there is a process in place to alert them to the occurrence of those risks

4. Legal and Regulatory Incentives for Oversight Directors should require assurance of reasonably designed corporate information and reporting systems for monitoring risks. New U.S. SEC regulations (as a reference point of “international best practice”):   Increase the responsibilities of the audit committee   Require closer management review of internal controls   Mandate an enhanced board review of financial disclosures

5. Legal and Regulatory Incentives for Oversight A new SEC rule implemented beginning in 2003 required CEOs of listed companies with sales of $1.2 billion or more to certify the accuracy of their companies’ financial statements. The New York Stock Exchange (NYSE) and Nasdaq issued new requirements:   Audit committee members should discuss policies with respect to risk assessment and risk management   The board should hold meetings without management present.

6. Identifying Specific Uncertainties and Risks Directors need to ensure that management has identified the specific material risks the company faces. Material risk – “risks of a magnitude that a reasonably prudent person would consider important in the context of the company’s business”. Risk may be immediate or long-term: Short-term – includes financial market fluctuations, sudden emergence of a brand-new technology, changes in suppliers’ price structures, etc. Long-term – based on gradual trends such as demographic shifts or the gradual loss of an innovative culture within company

7. Identifying Specific Uncertainties and Risks Furthermore, short- and long-term risks may either be internal or external: Internal risk – stems from events occurring inside the company including employee crimes, accidents within the company and unexpected turnover External risk – stems from events occurring outside the company such as act of war or terrorism and natural events

8. Long-term Internal (e.g., gradual loss of innovative culture, increasing cost of labor) Long-term Extrinsic (e.g., a demographic shift, increasing dominance of China) Short-term Internal (e.g., loss of a key executive, labor strike) Short-term Extrinsic (e.g., a terrorist act, natural disaster) A Risk Grid Long- term Internal Short- term External

9. “Code Red”: Risks that Can Lead to a Crisis In monitoring risks, directors need to anticipate material risks that can lead to a crisis Crisis – the occurrence of a surprising and calamitous event. These are “Code Red” risks that can lead to: Loss of control by management. Lack of real-time information available to decision makers. A siege by persons harmed by the event and the media covering the event.

10. The “Spiral Factor” Directors and management should discuss plans for addressing Code Red risks and how to mitigate their impact. The board should have a plan for minimizing the “spiral factor” of crisis. The board should help identify the links in the crisis chain and sever them before they cause or deepen a crisis Ensure that management creates policies and procedures to deal with trouble as it evolves.

11. The Value of Board Oversight   The board can help curb the impact of the crisis at each step.   The board can prevent management from taking the risks (e.g., in the case of Bankers Trust, what would have happened if the board knew the risks the bank was taking, questioned management, and pushed management to disclose those risks to public?).   In some cases, management hides the risk from higher management and the board -- the “rouge trader” in Barings. They show the importance of internal information and control systems.   Some risks are outside the control of management. The board should take control.

12. Reference: Director’s Handbook, Sections 1-5, National Association of Company Directors (NACD), U.S.A. Dr. James Darazdi and Prof. Robert Stobaugh, Director’s Handbook Series, 2003.