To understand more clearly how risk management came out of the corporate governance debate, it is necessary to look back into the development of ‘corporate governance’.

The corporate governance debate in the UK focused most of the twentieth century on the relationship between management and shareholders and the shareholder’s profit and wealth maximisation. Adam Smith who studied at length human motives once observed that the directors who are the fiduciary of other people’s money cannot be expected to be as vigilant and careful with other people’s money as they would with their own.

The nature of the debate on corporate governance changed radically in the late 1980s in the US and then in the UK. The 1970s and 1980s were marked by numerous financial failures, fraud and questionable business practices (the gin and tonic era). People started questioning the reasons for this happening, as these failures could not only be explained by senior management mistakes or misjudgements. This led to a number of initiatives in the US and Canada.

In 1985, the Tradeway Commission (formerlly the US National Commission on Fraudulent Reporting) investigated a number of large business failures and concluded that in more than 50% of the cases reviewed, failures were explained by breakdown in internal control. From that period the corporate governance debate broadened its scope, which became two-fold: still concerned with board management issues but also highly interested in the prevention of major business failures by implementing effective systems of internal control.

In the UK several committees were set up which issued recommendations (Cadbury 1992, Greenbury 1992, Rutterman 1994, Hampel 1995). In 1995, these were embodied in a code know as the Combined Code.

The code was not initially compulsory; however, every company listed on the London Stock Exchange has the obligation to report whether it complied with the code or not, and if not what were the provisions of the Combined Code which were not applied. In practice, as the Combined Code was viewed as a code of best practice, few companies departed from its guidance. It should be noted that health and safety, though not a central aspect of corporate governance, is nevertheless an issue on which directors are also asked to give some account. This relates to their own employees as well as suppliers and contractors working on their premises.

The provisions of the Combined Code relating to risk management are detailed in principle D2 and provisions D2.1 and D2.2 as follows:

The first major appearance of the concept of risk management in corporate governance is quite ambiguous. It is mentioned as something that is distinct from the control review process. It is not clear whether risk management is actually another set of controls that should be reviewed. There is no definition of the concept of risk management within the Combined Code.

For this reason and because no practical guidelines were available, a new working party (Turnbull Committee) was set up to provide an explanation on the Combined Code. Guidance was issued which is now appended to the Combined Code, named the Turnbull guidance. Companies largely endorsed the Turnbull report recommendations even if they represented at the time both a real challenge for most companies and significant additional work to implement them. The Institute of Internal Auditors’ guidance on Turnbull (2000) stated that three quarters of companies were still thinking in July 2000 that they would still require further work to comply with Turnbull guidance. The Financial Reporting Council (2005) undertook a review of the Turnbull report and stated ‘the review found that the (Turnbull) Guidance had contributed to improvements in internal control in UK listed companies. It strongly endorses the principles-based approach of the Guidance, which allows companies to focus on the most significant risks facing them. It recommends only limited changes to the Guidance to bring it up to date.’ However, the Institute of Internal Auditors issued a more reserved statement of effectiveness of Turnbull guidance.

The 47 notes of the Turnbull guidance brought some clarity about provision D2. However, with regards to the concept of risk management, the guidance still remained quite confusing by referring to the concept either in terms of governance structure or management objectives. For example, in article 10, risk management is defined as part of the system of internal control. However, in article 16, the system of internal control is said to be aiming at managing risk. Sarah Blackburn (1999) mentions the lack of ‘clear concept of the relationship between internal controls and risk management’. She adds that the term of internal control when used in the Turnbull guidance is probably too narrow to pretend to embrace the concept of internal control. What is obvious at this stage is that neither the Combined Code provisions nor the Turnbull guidance and further professional guidance manuals from different institutions really approach the concept of risk management in a very easy to understand way.

In summary the Turnbull report is about managing the risks that are ‘significant to the fulfilment of a company’s business objectives’. Companies should not only create and maintain truly risk-facing internal control systems, but also ensure that the systems are embedded deep within the corporate anatomy. Ultimate responsibility for implementation falls on the board of directors and no distinction is made between executive and non-executive directors. Directors are required to review and report to shareholders, at least annually, on the effectiveness of all internal controls including financial, operational and compliance controls and risk management. This approach to risk management has been welcomed by a number of organisations as a means of enhancing performance and gaining competitive advantage. Investors (both lenders and shareholders) will regard the implementation of Turnbull not only as a safeguard against damaging mistakes but also as a measure of business success. With the scope of risk management now extending beyond financial, audiences with concerns about company values (product quality, health and safety, employee and customer loyalty etc.) or wider issues (environmental, ethical, social etc.) will be interested in disclosures made in these areas. Industry regulators and courts will regard the extent to which Turnbull has been implemented as a compliance indicator and pick up on deviations from its best practice standards when investigating companies.

Disasters catch out even the most vigilant organisations. When they occur, they can result in litigation against the company, criminal and civil actions against directors personally, negative publicity, damage to corporate reputation. The list goes on.

The companies which are likely to survive the consequences of a disaster will be those which:

For all its upbeat and incentivising qualities, Turnbull should not be misunderstood. While proper implementation will bring benefits from business gains to a happier workforce, the critical test of benefit will come when the unavoidable disaster occurs. There is no doubt that in such situations, the extent of a company’s compliance with Turnbull will be scrutinised. Proper risk management systems will prove to be the company’s lifeline in such situations. They can be used to dissuade a regulator from prosecuting, or operate as powerful mitigation should the matter go to court. The implementation of a system of internal risk control requires an honest appraisal of the company’s capabilities. What can it do in-house and what should be outsourced?

In fairness, despite the omission of risk management references, the Turnbull guidance still brings the following key clear directions with regards to the general concept of risks:

The Deloitte and Touch (2001) progress report on corporate governance lists key considerations on risk management:

Felton and Watson (2002) listed some general principles for effective risk management as part of a set of rules for strengthening corporate governance. These are summarised as:

Barjon (2006) notes that the financial investment profession has also embraced the concept of risk management with title of chief risk officer first developed in financial institutions. In finance, risk is very much linked to reward. Risk is the concept used to appraise the profitability of the different investments depending on their risk profile, which is conceptualised into mathematical models, especially for quoted investments.

Barjon (2006) also states that risk management has been developed by different professions with relatively different perspectives and objectives:

DiPiazza also stated that risk management activities help organisations ‘to achieve their objectives, reduce volatility of outcomes, and ensure effective reporting and compliance’. DiPiazzo also introduces the term enterprise risk management which is a term more frequently used in the US to talk about the global corporate perspective of risk management to avoid mixing it with insurance matters and sets very clearly the dilemmas of risk management. Firstly, ‘reducing uncertainty about downside loss . . . and upside gain entail a real cost’. In other words, risk management activities do represent a significant cost to companies. Preventing future unexpected losses comes at a premium cost. Secondly, ‘reducing downside loss can reduce opportunities’. Companies need to find the right trade-off between risk and opportunities of rewards, and suggests risk management should not be treated as the ‘be all and end all’. Companies should always be prepared ‘to expect the unexpected and to act when the unexpected occurs, as it inevitably will’.

In the Anglo-Saxon world, risk management has become a high profile business management topic and it is almost anchored as an official management standard for managing large businesses.

It is interesting to note that the trend is, however, changing due to international influences. More French companies are now quoted in London and New York and have to comply with the British or American regulations. The French society adapts slowly to the new world business environment. Disclosure of directors’ remuneration in annual reports is now less a taboo, for example.

The main initiatives on corporate governance in France have been:

Another report from the MEDEF, the Report Bouton (2002), only makes comments about risks which need to be better managed as a principle. The latest guidance issued by the French Asset Management Association only relates to the general principles of corporate governance.

It should be stressed that the main difference with the UK situation is that most of these recommendations have not been embedded in the law and are not enforceable. That kind of process takes years in France where the civil law type of system is very complex. There is an exception which relates to the compulsory information relating to internal control. The new law, Loi de Sécurité Financière, LSF (2003), imposes quoted companies to report on internal control in the annual report without saying what internal control is or without mentioning whether the report should be descriptive or should express an opinion on how controls are managed within the companies. In the absence of further guidance, companies have adopted a very low profile on these topics in the annual reports.

Overall, there is no official corporate governance guidance, in France, which in particular relates to risk management theories and recommended practices, which are equivalent to the Turnbull guidance that companies need to comply with.

The position of the European Commission is well summarised by the European Commission (2003). ‘The Commission does not believe that a Corporate Governance Code would offer significant added value but would simply add an additional layer between international principles and national codes.’ The Commission suggests that ‘The European Union should adopt a common approach covering a few essential rules.’ The most urgent initiatives considered by the Commission being:

The first known model was the US model ‘COSO’ which inherited its name from the name of the organisation which developed it, known as the Commission of Sponsoring Organisation (COSO) of the Tradeway Commission. The Canadian Institute of Chartered Accountants developed their own model two years later in 1994 called ‘Coco’ (Canadian Criteria of Control). Private consulting companies also developed in the 1990s other internal control models such as the Cardmap system.

More recently the initial US model COSO was revisited and updated as COSO II. The model promotes the establishment of meaningful objectives for all activities of an organisation and the implementation of eight control elements supporting each objective. These elements relate to the following topics:

Finally corporate development in the US needs to be discussed. This incorporates powerful implied risk management strategic ideas and new guidance about internal control frameworks. It is known as the Sarbanes-Oxley Act of 2002 (SOX) or the Public Company Accounting Reform and Investor Protection Act of 2002. This US Act can be defined as ‘wide ranging and establishes new or enhanced standards for all U.S. public company Boards, Management, and public accounting firms. The Act contains 11 titles, or sections, ranging from additional Corporate Board responsibilities to criminal penalties, and requires the Securities and Exchange Commission (SEC) to implement rulings on requirements to comply with the new law.’ This Act was voted by the US Parliament following a deterioration of public confidence in company official information including financial results from the scandals relating to Enron, Tyco International and Worldcom. SOX goes much deeper than the accuracy of financial projections, it touches many areas affecting the management of every project within an organisation. Quoted companies in the US and their international subsidiaries must also comply with provisions of the Act.

Pavyer (2005) states that companies surveyed by AMR indicated that they expected to see business benefits from the work undertaken to comply with the above regulations, the business benefits being ranked as follows.

It should be noted that the Sarbanes-Oxley Act’s risk and the risk response (control) covers only the financial reporting process. Moxley (2003) points out that ‘the rules drafted by the US regulator the Security and Exchange Commission (SEC) to implement the legislation talks only about a very narrow form of internal control . . . in relation to financial reporting and controls over information filed with the SEC’.

More globally the Act has re-established a more generic principle that management is ultimately responsible for anything that concerns the company they manage and thus that they should be aware of any risk that threatens their business and not only the risk of inaccurate financial reporting.

Major challenges to the Sarbanes-Oxley Act relate to the added cost burden that compliance has forced on to firms especially in increased auditor fees and additional human, time and financial resources that firms spend to comply. It is almost like mini external audits on top of the statutory yearly audits. Pavyer (2005) states that in a recent survey conducted by Fortune 1000, companies were spending, on average, US$4 million to comply with SOX and according to a Financial Times report, such companies will pay another US$2.9 million to ensure ongoing compliance. This covers spending across a range of business processes – financial, IT, operational – with an increasing amount expended on technology components.

Complying with SOX is an enormous challenge. With senior executives’ personal liberty on the line it is inevitable that US companies will extend the spirit of the act beyond its graphic boundaries. It is, however, essential that with the returns from an investment of this magnitude, procedures go beyond tick-box compliance, particularly in terms of the risk management processes.

Corporate governance in itself is not new. The corporate governance frameworks in place now allow organisations to address the requirements to manage risk in a structured way.

Auditing and monitoring are inherent to corporate governance frameworks and these systems can be developed to aid in the management of risk.