How boards can effectively oversee enterprise-wide risk management

How boards can effectively oversee enterprise-wide risk management

HomeInside Today's BoardroomsHow boards can effectively oversee enterprise-wide risk management
How boards can effectively oversee enterprise-wide risk management
ChannelPublish DateThumbnail & View CountDownload Video
Channel AvatarPublish Date not found Thumbnail
0 Views
Host: TK Kerstetter
Guest: Michael Montelongo, Board Member, Herbalife, Ltd.

Overseeing risk is one of the board's fundamental responsibilities. However, experts doubt that this task has become so complex – especially with the introduction of cyber risks – that it is almost impossible for boards to handle the task of overseeing enterprise risk management (ERM).

In this episode, Herbalife board member Michael Montelongo outlines a risk oversight plan for corporate boards. Recognizing that every company has a different risk profile, Montelongo explains how an effective ERM process acts as both an internal safeguard and a shareholder engagement tool. An ERM framework (such as COSO's) is not only a great starting point for board discussions, but also provides investors with assurance that the company's risk appetite is systematically analyzed and tightly managed.

Which board committee (if any) should be responsible for corporate risk management?

Although the audit committee is functionally equipped to assess risk, Montelongo warns of the dangers of siloing enterprise-wide risk management—a responsibility that should be the responsibility of the entire board. Kerstetter and Montelongo outline key considerations for delegating ERM. Ultimately, the company's risk profile must determine how this responsibility should be assigned, whether as a separate committee, within an existing committee, or as a function of the entire board.

How can boards begin creating the framework for an ERM program?

According to Montelongo, directors must first talk to management about the current ERM process. He asks several questions, including:

— Does the company have a vision and objectives and targets for risk management?

— Is a GAAP analysis performed with current and desired risk management functions?

— Is there an ongoing and structured process for updating a company’s risk profile/risk appetite/tolerance as new changes come to the market?

—How effectively are these changes communicated to internal and external stakeholders?

Please take the opportunity to connect with your friends and family and share this video with them if you find it useful.