INTRODUCTION

The purpose of this chapter is to discuss enterprise risk management (ERM) in the context of corporate governance in emerging market corporations. There is a growing interest in improving corporate governance practices in emerging markets following the 1997–1998 financial crises in the Far East and Russia. With the contagion effects of the crisis in many other emerging markets, there was a realization that corporate governance practices had to be improved along with the financial sector infrastructure. This was the genesis for establishing a globally appealing set of principles or rules of good corporate governance.

Upon the initiation of international donors and G7 countries, the Financial Stability Forum was convened. The Principles of Corporate Governance were developed by the Organization for Economic Cooperation and Development (OECD) in 1999¹ and were later revised in 2004. During this period, other standards of business conduct were also introduced to provide guidance in a number of critical areas of global cooperation for business and finance among nations. Many emerging countries have since adopted the OECD principles and developed their own corporate governance codes.

Improving corporate governance is understood to improve the chances of accessing the various sources of finance. In most emerging market countries, the crucial pillars of transparency and disclosure are still considered off-limits due to concerns about business confidentiality. Effective regulatory enforcement has finally forced many exchange-listed firms to become more transparent thanks to improved disclosure requirements. Disclosure has helped make material and timely corporate information available to the investors. While this availability has helped to provide greater information about the firms’ business prospects, it has also educated boards to help them improve their supervision of management actions.

Since the early 2000s, most listed companies in emerging countries have become more aware of the need to improve corporate governance practices, thereby helping to resolve the perceived risks related to firms. Improving corporate governance across the board in an emerging country setting will translate into improving shareholder value, by providing more assurance to investors of a better rate of return on their investment. This is especially true of the privately held small- and medium-sized enterprise companies, as it helps them gain better access to the sources of financing.

In the following sections, we offer a discussion of enterprise risk management by emerging market firms. We take a holistic approach to enterprise risk management as prescribed in the COSO definition.² Refer to the Appendix for a summary of the COSO approach to ERM.

ENTERPRISE RISK MANAGEMENT AND ITS BENEFITS IN EMERGING MARKETS

Enterprise risk management can be defined as the intelligent use of risk to promote business opportunities and gain competitive advantages for the firm. In this context, ERM encompasses a holistic culture, processes, and tools used throughout the firm to identify strategic opportunities and reduce uncertainty for a firm. ERM allows the comprehensive view of risk from both operational and strategic perspectives. It is a process that supports the reduction of uncertainty and promotes the exploitation of opportunities.

ERM is important for all successful companies managing the random and often interrelated types of risks that a business encounters during its existence. ERM offers companies strategically more effective risk management at “potentially lower” costs. From time to time, there are major events in finance that affect many stockholders and related stakeholders in many parts of the world. A well-known example is the demise of the Barings Group in the 1990s, a large British investment management company that lost many billions due to unscrupulous futures trading by a trader named Nick Leeson, who took unhedged positions without proper risk oversight. There are many other examples. Currently, the financial sector troubles and the economic meltdown have magnified the effects of excessive leverage that firms had accumulated in anticipation of high returns in a growth environment. Unfortunately, many firms grossly neglected the downside of the risks they had exposed themselves to, without much protection.

For example, many Asian exporting corporations have borrowed heavily from their domestic or international banks in anticipation that their foreign exchange earnings will continue for a foreseeable period of time. Unfortunately, the global economic meltdown has negatively affected their revenues, and therefore their ability to service their debts. The final outcome is still uncertain at this time. The current period is that of a crisis management mode and involves crisis risk management.

There are many benefits to ERM if applied properly. The key is that the firm must adopt ERM as a holistic process, and the firm should be involved in ERM at all levels from the board all the way down to the business units. ERM requires that management be responsible for the implementation of the policies, while the board monitors and provides guidance to the CEO. In the ongoing globalization process, and with the pressures to become more transparent, the financial services industry, along with utility companies and the airline industry, have increasingly adopted these practices.

Let’s consider the airline industry in emerging markets: IATA, the International Air Travel Association, reports that civil aviation markets in Poland, China, Czech Republic, Qatar, and Turkey, will have a steady growth rate of 5 percent to 8 percent per year in terms of passenger and cargo volume through the first decade of this century. Given this expected growth in the aviation sector, a recent survey conducted among the 14 Turkish Airline companies reports that survey respondents generally agree that by developing an ERM policy, the airlines could implement a structured and disciplined approach in risk management. Respondents further understand that ERM aligns the organization’s strategies, processes, technology, and knowledge with the purpose of improving its ability to develop a strategy and manage more effectively.³

The survey results, however, do not support the hypothesis that Turkish airline managements are interested in risk management as a holistic concept and want to implement ERM in their organizations. The findings suggest that while there is an increasing awareness of nonoperational risks (e.g., security, safety, and financial risk management), companies are just beginning to move toward an enterprise-wide view of risk. At the present time, the study finds that the airline managements still see risk management very narrowly, which is quite different from what ERM concepts require. The airlines perceive risk and ERM within the narrow framework of their corporate culture and management style and there is no uniformity in these risk perceptions. Airline executives care most about the security, safety and financial risks that they face, which may vary according to each company’s market niche. We think that even this much awareness is a major step forward in an emerging country. However, more needs to be done to establish ERM techniques among the Turkish Airline companies. The very recent crash of a Turkish Airlines passenger jet in Amsterdam, the Netherlands, ought to be a wake-up call.⁴

In a recent study conducted by Ernst and Young to explore risk management in emerging markets, about 900 companies were surveyed regarding the leading risk management practices in Brazil, Russia, India, China, and Turkey as well as in 12 developed market countries.⁵ The main finding of the study is that establishing a risk culture, improving communications, and aligning organizational structure and risk management processes can ultimately set a strong foundation for better risk management. See Box 27.1 for key findings.

ERM also involves understanding the risk in dealing with companies that are not transparent. A recent example from India may be cited here: In early January 2009, Satyam Computer Services, one of India’s biggest software and services companies, revealed some alarming truths. The company’s founder and chairman, B. Ramalinga Raju, confessed to a $1.47 billion fraud on its balance sheet, which he and his brother, Satyam’s managing director, had disguised from the company’s board, senior managers, and auditors for several years. As the business opportunities for Satyam grew, this fraud went mostly unnoticed by the shareholders of the company. As the markets began to contract, the deficit had to be covered, and thus, the scandal broke. This is a problem of abuse of shareholder trust.

The risks in Satyam case are due to bad management decisions, and fraudulent action on the part of the chairman. Good corporate governance practices strongly discourage the chairman from also holding the role of the CEO. This is a common practice in all emerging market countries. Due to the power these two roles provide, management responsibility and accountability suffer along with transparency, oftentimes leading to potentially disastrous results. The risk to the investors is large in a thinly capitalized emerging market.⁷ See Box 27.2.

The Responsibility of the Board in Risk Management and Extensions to Emerging Markets

Boards of directors strengthen the corporate governance of a company when they first set a risk management policy that will address the risks that the company may face; second, understand and execute their oversight role, including understanding the company’s risk profile and determine a risk/return profile for the firm; and last, approve the business strategy of the company, including approval of the overall risk tolerances and risk management procedures.

The duty of the board is to act on behalf of the shareholders by devising strategies in order to protect shareholders’ investment in the firm from the overall risk exposures faced by the firm. Even if management may sometimes act on its own behalf, effective ERM should help protect the interests of the shareholders by aligning the interests of management with those of the shareholders. Box 27.7 provides a set of questions from a board perspective regarding the risks a company faces and its risk management processes.

The crucial issue has to do with the strategic management of a company. When the firm is first established and subsequently at various intervals, it determines a vision, a mission statement, and a set of objectives and targets to achieve the mission objectives. Targeted activities must pay attention to the overall risks faced by the firm.

Whether the firm is generating sufficient value for the given level of risks it has taken is a difficult question. Academic studies have shown that risk management can increase the market value of the firm, lower the cost of equity, and lower the volatility of earnings.

In their recent study, Smithson and Simkins conclude that interest rate, exchange rate, and commodity price risks are reflected in stock price movements. They find that the stock returns of financial firms are clearly sensitive to interest rate changes. In addition, they note that the corporate use of derivatives to hedge interest rate and currency exposures appears to be associated with lower sensitivity of stock returns to interest rate and FX changes.¹² The findings of this study reinforce the preceding arguments of how the U.S. financial firms have both benefited during the growth periods, then encountered extreme consequences during market downturns.

In terms of risk management, the board must follow a structural approach in bringing its policies down to the level of business units.¹³ The important thing for the board is that it ought to have a firm philosophy toward all types of risks the firm may face in its sector. The board members must understand the financial instruments the company uses or owns, especially the derivatives that the firm may use to hedge some risks, like currency, interest rates, and so on.

One important building block of an effective ERM program is to identify who formulates the firm’s guidelines and policies on the use of financial instruments. Another question is whether or not the board has approved these policies. The board must determine the best way to foster a risk management culture throughout the firm. Once determined, the board must ensure the integrity of the risk management system.

Another important question is whether there is separation of duties between those who generate financial risks and those who manage and control these financial risks. The types of instruments to be used must be evaluated, their risks must be calculable, a value assessment approach must be in place, and policies on how these are entered into company records and monitored must be determined. Last, shareholders must be kept abreast of the risks that they could reasonably expect from their investment in the firm. This is a process that is holistic, because it affects all units and all levels of the firm.

Boards are increasingly more active in risk management. In general, emerging market corporate boards have increased their attention to risk matters especially since the financial crises have eroded much of the shareholders’ capital and the firms had to take quite some time to readjust their capital base to regain the values lost. Although the interest in risk management is genuine, and most boards in emerging countries are paying more attention to risk than the other areas, there still is a lack of adequate understanding of how to best manage the risks. For instance, most companies in India and China manage risk in silos, and at department levels, rather than at the holistic level.

Boards in emerging markets are slowly realizing that it is within their duties to discuss market potential and expanding the firm. In addition, boards may need to consider forming risk advisory committees, or getting more directly involved in assessing market risks.¹⁴

Once the board has defined the level of loss it is prepared to tolerate across its businesses, in addition to the policy level deliberations, it must define the “risk appetite” of the firm. Other countries’ regulatory agencies provide guidance to companies that wish to incorporate ERM into their Board practices.¹⁵

Regulatory pressures from such international bodies as the Basel Committee on Banking Supervision and a greater focus on corporate governance have been a stimulus for many changes in the financial industry—one of these has been the recognition of the need to articulate risk appetite more clearly. These factors have led the firms to determine a proactive risk culture for the firms. Box 27.8 summarizes the risk appetite determination approach used in Egypt, Jordan, Ukraine, and Russia. On the face of it, this may seem easy to do. After all, is it not simply a combination of an institution’s desired credit rating, regulatory capital structure, and the relevant solvency needs that set the ability of the institution to withstand shocks and therefore represent its risk appetite?

For some smaller firms this approach may well be enough, but for others risk appetite is a more complicated affair at the heart of risk management strategy and indeed the business strategy.

OBSERVATIONS OF ERM PRACTICES IN EMERGING COUNTRIES

In Exhibit 27.2, we summarize our comparative observations of the ERM practices in Egypt, Jordan, Mongolia, Serbia, Turkey, and Ukraine based on the COSO outline. These summary points represent our years of observation made relative to the development of effective corporate governance practices in a larger population of 30 countries since 1995. Our overall conclusion on this issue is that ERM is still considered a new phenomenon in the format provided by COSO and applied by the regulatory bodies in these respective countries.

Although everyone agrees that it is time to improve on risk management, it is difficult to launch an effective ERM practice without the guidance and support of boards of directors in emerging markets. This is mainly due to the lack of technical knowledge at the top levels, even though there are capacity and skills deficiencies at all levels to establish an ERM program. We think that there will eventually be an improved capacity developed to fully practice ERM programs; however, emerging market regulatory bodies need to issue guidance and direction in order for this to be effective.

Regulators must play a guidance role if the overall corporate governance effectiveness is to be enhanced. Full compliance with all corporate governance regulations will certainly help many companies to gain better access to finance, to improve internal management capabilities, improve board effectiveness, and make the firms more competitive in the global arena.

CONCLUSION

New corporate governance codes have become the driving force for organizations to implement enterprise risk management. An ERM framework has been provided through COSO in 2004. ERM is a process that begins with the definition of a risk appetite for the firm. Firms must manage risks in order to ensure shareholders a return on their investment leading to value creation.

Risk management is a continuous process, involving the board, management, and all individual employees at all business unit levels. ERM must achieve a broad “buy-in” at all levels in the firm to succeed. The benefits of ERM are yet to be proven, however, evidence suggests that ERM is closely correlated with increased shareholder value in many cases. The needs and focus of ERM varies between sectors. Not all risks should or can be intensively quantified and overly sophisticated solutions should be avoided.

In the select emerging countries that were observed for this purpose, ERM is still an evolving topic of concern. In all of the emerging countries in our sample, we looked at the leading listed companies’ ERM applications. These countries include Egypt, Jordan, Mongolia, Serbia, Turkey, and Ukraine. In most countries, none of the objectives of enterprise risk management are fully practiced.

In terms of the strategic objectives, where the firm’s high-level goals are aligned with and support the mission of an enterprise, few organizations have accomplished this objective in full. Second, in terms of the operational objective of ERM, where the firm utilizes its resources efficiently and effectively, our observations in the six countries have found that the lack of resources has been a major obstacle in most cases. Third, for the reporting objective, where the firm’s reporting practices are reliable, relevant, timely, and replicable, the inadequacy of the accounting practices has been a major cause for concern in developing a fully effective ERM. Finally, in terms of the compliance objective, where the enterprise risk management framework is in compliance with applicable laws and regulations, despite the proliferation of legal and regulatory frameworks to enhance corporate governance through a number of ways including the risk management, we observe major weaknesses in full compliance.

At this time, corporate governance codes and regulations, and banking sector regulations have not been fully implemented in most banks or in listed corporations to the fullest degree to reach the desired objectives. It is most likely that in time many of these weaknesses and obstacles will be overcome and ERM will be fully practiced.

Our final observation is that the ERM concept is still a new concept and is likely to take a while to get the emerging country firms to reach the desirable level of risk management practices for sound business reasons rather than as a new responsibility that needs to be practiced because of the law.

APPENDIX: COSO APPROACH TO ENTERPRISE RISK MANAGEMENT

In the current global financial and product market environment, emerging country companies must generally undertake greater risks than companies from better established economies in order to gain market share. We argue that these firms are generally more risk prone in many aspects. We discuss these in the order defined by the COSO approach to risk management.

The goal of enterprise development projects undertaken by international financial institutions is to improve the business environment for increased investment and access to finance, thus focused on the creation of safety, stability and transparency. Safety and stability in the financial markets are of paramount importance for the foundation of any viable financial system, so that trust and confidence of market participants can be built in the system. In developing the system, appropriate institutions and legal and regulatory frameworks are built to ensure the integrity and sustainability of the financial system with the global markets.

ERM entails the efforts of risk management at the corporate level in a holistic manner. The COSO approach looks at enterprise risk management at four levels:

1. Strategic—whereby the firm’s high level goals are aligned with and support the mission of an enterprise.
2. Operations—whereby the firm utilizes its resources efficiently and effectively.
3. Reporting—whereby the firm’s reporting practices are reliable, relevant, timely, and replicable.
4. Compliance—whereby the enterprise risk management framework helps ensure compliance with applicable laws and regulations.

We think it is important to briefly review the COSO’s approach to enterprise risk management, which encompasses the following:¹⁷

• Aligning risk appetite and strategy—The firm’s risk appetite is determined in assessing strategic investments, then objectives are set and methodologies to manage those perceived risks are developed.
• Enhancing risk response decisions—Managing risk allows the firm to determine and develop alternatives in responding to the risks, such as avoiding, reducing, sharing, or accepting the perceived risks.
• Reducing operational surprises and losses—By reducing operational surprises and potential for losses, firms gain enhanced capability to identify potential events. The firm determines its responses to risks that help reduce the surprises to be encountered in time, and help determine approaches in dealing with the associated costs of these surprises that may lead to unexpected losses.
• Identifying and managing multiple and cross-enterprise risks—Every company will one way or another face risks that affect different parts of the organization. Risk management thus will facilitate the effective responses to these unexpected events and reduce the interrelated impact of unexpected, multiple risks on the firm.
• Seizing opportunities—Management is proactive in taking advantage of opportunities that may present themselves as a result of considering the possibilities.
• Improving deployment of capital—By collecting reliable risk information the firm is enabled to make effective use of the investment opportunities that are available in the financial markets, and make optimal allocation of capital that it is able to obtain.

The above COSO framework will provide guidance in reviewing the practices employed by emerging markets companies in this chapter.

REFERENCES

Cassidy, John. 2008. Anatomy of a meltdown: Ben Bernanke and the financial crisis. New Yorker. December 1.

Claessens, Stijn, Daniela Klingebiel, and Luc Leaven. 2001. Financial restructuring in banking and corporate sector crises: What policies to pursue? NBER Working Paper W8386. www.nber.org./papers/w8386.

COSO, Enterprise risk management—Integrated framework. 2004. COSO (Committee of Sponsoring Organizations of the Treadway Commission), September. www.coso.org/.

Ernst & Young. 2007. Risk management in emerging markets: A survey. www.Ey.com.

Financial Stability Forum, www.fsforum.org/.

Hexter, Ellen, Matteo Tonello, and Sumon Bhaumik. 2008. Assessing the climate for enterprise risk management in India. Research Report. E-0016–08-RR.

Kaen, Fred R. 2004. Risk management, corporate governance and the public corporation. Unpublished note. University of New Hampshire, International Private Enterprise Center.

Kucukyilmaz, Aysegul, and Guven Sevil. 2006. Enterprise risk management perceptions in airlines of Turkey. Anatolia University, Faculty of Civil Aviation. Eskisehir, Turkey.

Meulbroek, Lisa K. 2002. Integrated risk management for the firm: A senior manager’s guide. Working Paper. Harvard Business School, Boston, MA.

Moeller, Robert R. 2007. COSO enterprise risk management: Understanding the new integrated ERM framework. Hoboken, NJ: John Wiley & Sons.

The G-20 summit proceedings on the financial markets. 2008. New York Times. November 16.

Nocco, Brian W., and Stulz, Rene M. 2006. Enterprise risk management: Theory and practice. Available at SSRN: http://ssrn.com/abstract=921402.

OECD. 2004. OECD Principles of Corporate Governance.

Smithson, Charles, and Betty J. Simkins. 2005. Does risk management add value? A survey of the evidence. Lead article, Journal of Applied Corporate Finance vol. 17, no. 3, 8–17.

ABOUT THE AUTHOR

Demir Yener, PhD is a financial economist and has held various responsibilities as a professor of finance, educator, trainer, and senior financial and private sector consultant on international economic development projects, including capital markets development, corporate governance, entrepreneurship, and executive development in over 30 emerging market countries, such as Russia, Ukraine, Central Asian Republics, Caucasus, Poland, Hungary, former Yugoslavia, Western Africa, the Middle East, South Korea, Thailand, Mongolia, and other East Asian nations on behalf of the World Bank and USAID. He currently works as senior corporate governance and finance advisor at Deloitte Consulting. He has designed, developed and managed technical assistance projects in private sector development, enterprise restructuring, financial sector reform, capital markets, nonbank financial institutions development, and corporate governance with a strong emphasis on executive training and development, and has worked with policy makers, high-level government officials, academics, and business leaders. He also held the academic position of professor of finance at Babson College, and taught as visiting professor at various institutions, including Harvard University, Bocconi University (Italy), Maastricht School of Management and Utrecht Business School (Netherlands), the American University (France), Sabanci University (Turkey), and Cairo University, Faculty of Commerce (Egypt).