Outline seven structural components of an ERM framework
- corporate governance – to establish organisational processes and controls
- line management – to integrate risk management into business processes
- portfolio management – to aggregate risk exposures and identify diversification effects and concentrations of risk
- risk transfer – to mitigate excessive risk exposures cost-effectively
- risk analytics – to measure, analyse and report on risk
- data and technology resources – to support the analytics and reporting
- stakeholder management – to communicate and report on risk
The ERM framework’s success will be dependent on there being a positive risk culture.
Define corporate governance (CG)
CG is the system whereby boards of directors, or governing bodies, are responsible for the governance of their organizations upon appointment by shareholders.
So, CG is the way the Board controls the organization and the processes it establishes so that it is run by the management in the best interests of the shareholders.
Outline the responsibilities of the Board (9)
- set the risk appetite
- approve the risk strategy and/or risk policy of the organisation
- monitor key risks by ensuring the implementation of a suitable RM framework and/or internal controls framework
- ensure compliance with supervisory requirements
- support a good risk culture
- establish the organisational structure for ERM / define roles and responsibilities
- ensure that risk personnel are fit and proper
- review the outcomes of / lessons learnt from the RM process
- ensure alignment of the interests of management with investors through appropriate remuneration packages
Outline line management’s responsibilities within an ERM framework (4)
Line management’s responsibilities within an ERM framework:
- day-to-day management of, and the reporting on all risks within the organisation
- implement the ERM policies approved by the Board through setting up RM processes and integrating the risk information collected into business decisions
- understand the risks being taken
- understand the extent of own risk-taking powers
State observable features of good corporate governance (7)
- vigorous leadership is provided by the Board
- employees have codes of honesty and fair dealing – managers leading by example
- responsibilities and accountabilities for identification and management of risks are clear
- every employee has a responsibility for identification of new and increased risks
- managers are responsible for the identification and management of risks within their areas of responsibility
- the Board has responsibility of a shortlist of the most serious strategic risks (identified from the central collation of all risks)
- the Board self-assesses progress towards full ERM on an annual basis
List the areas covered by the key principles of excellent corporate governance (7)
- communication with stakeholders
- Board independence
- assessment of Board performance
- Board remuneration
- Board appointments
- fairness
- social responsibility
Describe arrangements to ensure the independence of the Board
The Board should be at arms length from day-to-day management of the organization. Independence may be facilitated by the:
1. majority of the Board being independent Non-Executive Directors (NEDs)
- key subcommittees comprising exclusively
independent) :
- eg audit, remuneration, appointments - Chief Executive Officer (CEO) not being chair:
- or publish why and appoint lead director (to chair regular Board meetings where the CEO isn’t present) - Board meeting regularly without the CEO
- NEDs meeting separately from Executives at least annually.
Distinguish between an independent director and a Non-Executive Director (NED)
Independent = no interest (financial or otherwise) in the company.
NED = not employed in the day-to-day running of the company (but not necessarily independent, eg may have stock options).
State the circumstances that may impair the independence of a Non-Executive Director (NED), according to the UK Corporate Governance Code (7)
- is or has been an employee of the company within the last five years
- has, or has had within the last three years, a material business relationship with the company, eg directly, partner, shareholder
- has received or receives additional remuneration from the company apart from a director’s fee, participates in the company’s share option or a performance-related pay scheme, or is a member of the company’s pension scheme
- has close family ties with any of the company’s advisers, directors or senior employees
- holds cross-directorships or has significant links with other directors
- represents a significant shareholder
- has served on the board for more than nine years
List the characteristics of a good Board-performance assessment process (6)
- regular, eg annual
- formal
- at individual, subcommittee and full Board level
- involves external / independent consultants (eg to avoid bias)
- feedback of results fed into training
- regular, independent development reviews and training for new Board appointees
List the desirable characteristics of Board remuneration (4)
- Directors should not be overly compensated, however, the remuneration should be enough to attract, retain and motivate, as well as reflecting the responsibility and risk of being a director.
- Directors should be remunerated by reference to the organization’s performance against medium-to long-term (risk-management) objectives.
- A reasonable proportion of each director’s remuneration should be in shares (exposing them to upside and downside risks and so aligning their interests with those of the shareholders).
- Board remuneration (including share options and pension benefits) should be fully disclosed.
List the key areas that should be covered by a risk subcommittee’s charter (6)
- purpose – to oversee RM and provide challenge
- responsibilities – eg to ensure a RM framework is in place, to ensure compliance with established RM policies
- membership requirements – eg minimum proportion of NEDs, appropriate mix of knowledgeable Executives
- meeting frequency
- performance assessment criteria
- resources available – eg which departments can/should be utilized, use of external consultants
State the role of the audit subcommittee (3)
- monitor the integrity of financial statements
- monitor and review internal assurance functions such as financial control, risk management and internal audit
- recommend, monitor and review the external auditor.
Outline key recommendations of The Walker Review covering all financial institutions in the UK (5)
- ‘comply or explain’ remains the best route to better CG practice
- more ‘challenge’ in Board discussions is required – from improved mix of capabilities and experience on the Board, and greater time commitment from NEDs
- the set up of a separate Board risk committee (CRO supported and with clear enterprise-wide authority and independence) to increase Board-level engagement with risk oversight
- better engagement between fund managers (acting for their clients as beneficial owners) and the Boards of investee companies
- Board remuneration committee’s remit should be extended to cover other senior influential employees, and this remuneration should be aligned with the medium-and longer-term risk appetite and strategy of the entity. The remuneration of these employees should be made publicly available on a ‘banded’ basis.
Define risk culture
There is no single definition!
However possible descriptions include:
- the company’s shared values, beliefs and behaviors (with regard to risk)
- the attitude of ‘agents’ (eg employees) to business activities, especially risk management activities
- ‘the way we do things around here’, including, the way judgments are exercised.
Risk culture may be used as a measure of whether ERM has been successfully integrated into the organisation.
List what should be encouraged by an appropriate risk culture (7)
- consultative leadership
- participation in decision-making on risks
- openness
- accountability rather than blame
- organisational learning
- knowledge sharing
- good internal communication
Describe a supportive risk culture (10)
- all staff involved in risk management
- focus on positive employee behaviours with regard to risk, training
- inclusion of risk and RM risk in job descriptions and performance management, link to remuneration
- clearly defined responsibilities and accountabilities
- good communication, including reporting to a central point
- processes to escalate risks to the appropriate level of seniority
- culture of openness and no-blame
- the Board lead from the top by displaying appropriate risk behaviours
- praise for good risk behaviours, eg report on success
- evaluation and review of the risk culture, eg through surveys
Outline how an organisation might change its risk culture (3)
- from the top of the organisation (ie led by the Board and senior management)
- on an incremental basis (eg through changes to performance management processes and remuneration)
- as the profile of new recruits changes the views of the staff
