INTRODUCTION

Risk management needs to occur at all levels of an organization because organizational risk is everywhere and it defines what might prevent an organization from achieving its objectives. Because of this, the board of directors, which exists at the very top of an organization, is expected to both exercise diligent oversight regarding an organization's principal risks and concentrate on those risk processes that, in turn, cascade throughout the organization, thereby managing and mitigating risk at the organization's lowest, operational levels. Accordingly, we have undertaken this study to survey the directors of several organizations about their organizational risk oversight practices to get a “view from the top.”

One of the ways in which directors can fulfill their duties with respect to risk oversight is to adopt a risk management/oversight framework. Frameworks supply directors with prescribed methods to use in exercising their duties as reasonable and prudent supervisors of the organization. The application of a framework not only gives directors reasonable assurance that they are meeting their required compliance guidelines in fulfilling their legal duties (i.e., duty of care and duty of loyalty), but also enhances their risk management practices for the betterment of the organization.

We begin this chapter by outlining the responsibilities of the board of directors. In particular, we review the legal duties imposed in the United States, Great Britain, and Canada to demonstrate the consistency and pervasiveness in Western capitalist society of these duties and to set the context of why risk management is important to boards, not just as good business practice but as a matter of legal responsibility. We then briefly describe our general thoughts on the development of risk management best practices and the use of frameworks in encouraging responsible risk management, with a specific focus on selected Canadian frameworks. Following this discussion are an outline of the survey we conducted and its results. We conclude with a discussion and interpretation of the results, with suggestions for pursuing additional avenues of research.

ROLE OF THE BOARD OF DIRECTORS AND DIRECTORS IN GENERAL

Directors are legally responsible for monitoring the operations of organizations. Part of this monitoring obligation necessarily requires directors to appreciate both the nature of the risks the organization faces and the organization's response to these risks. With monitoring risk being such an important aspect of directors' duties there is a need to better understand the role of the board of directors in relation to the risk and the compliance activities of the board (Nicholson and Newton 2010).

The general role of the board is to provide strategic input, identify performance objectives, make key appointments, and, finally, provide management oversight (Brown, Steen, and Foreman 2009). Part of its strategic input and management monitoring responsibilities is risk management oversight for the organization (Kiel and Nicholson 2002). “The board of directors has the ultimate responsibility for the enterprise risk of the company, being accountable to shareholders and other stakeholders” (Dickinson 2001, 365). The oversight of the risk profile and processes of the organization is becoming an increasingly more important duty of the board (De Lacy 2005). Corporate risk taking and performance are ultimately dependent on the quality, monitoring, and decision making of the board of directors (Ferrero-Ferrero, Fernandez-Izquierdo, and Munoz-Torres 2012). This monitoring requirement of the board requires directors to make sure they ask questions, demand answers, and identify, quantify, and manage all potential risks (Kleffner and Lee 2003). Practically, the board, management, and external and internal auditors must all work together to properly monitor and address risk in the modern corporation (Sobel and Reding 2004). From a corporate governance perspective the directors of an organization have a clear and leading role in understanding, defining, and managing the organization's risk.

To understand what is expected of directors when engaging in their risk management role, one can look to the directors' legal “duty of care” and the standard to which they must exercise this duty. This duty of care and its related standard are in many cases outlined by various statutes and court decisions promulgated by the various jurisdictions around the world as well as by corporate documents.

In the United States the role of the board of Delaware corporations (a favorite incorporating state) is stated thus: “[a] cardinal precept of the General Corporation Law of the State of Delaware is that directors, rather than shareholders, manage the business and affairs of the corporation” (Aronson v. Lewis 1984, 811). As a consequence, there is a “presumption that in making a business decision the directors of a corporation acted on an informed basis, in good faith and in the honest belief that the action taken was in the best interests of the company.... Absent an abuse of discretion, that judgment will be respected by the courts” (Aronson v. Lewis 1984, 812). Directors of a Delaware corporation must “use that amount of care which ordinarily careful and prudent men would use in similar circumstances,” and “consider all material information reasonably available in making business decisions” (In Re: Walt Disney 2005).

In Great Britain, directors' responsibilities are outlined in the UK Companies Act (Companies Act 2006). The director must “act in good faith…to promote the success of the company for its members as a whole…” (Section 172(1)) and they must “exercise reasonable care, skill and diligence…as that which would be exercised by a reasonably diligent person…” (Section 174(1)).

In Canada the general statutory duty placed upon a director is to “act honestly and in good faith with a view to the best interests of the corporation” (Canada Business Corporations Act 1985, s. 122(1)(a)). The general statutory standard of care expected of directors is to “exercise the care, diligence and skill that a reasonably prudent person would exercise in comparable circumstances” (Canada Business Corporations Act 1985, s. 122(1)(b)). This is an objective standard whereby a director's standard of care is measured against what others in the industry are doing; this makes the utilization of a framework very important in determining if directors are adequately discharging their legal obligations. Canadian courts have effectively (if somewhat obliquely) affirmed the business judgment rule (Vanderpol and Waitzer 2012). The general duty of a director is to act as an overseer to the business operations and not as a day-to-day manager. Specifically, a board should supervise management by making sure there are policies and procedures in place ensuring that management is overseeing the business adequately, being involved in strategy at the earliest phases, and ensuring that the corporation has adequate internal controls (Torys 2009). Directors must satisfy themselves that management has implemented appropriate systems and policies to ensure that management and the board have all the information they need to manage the corporation and make informed judgments, as well as to ensure that any material positive or negative developments are immediately brought to their attention (Torys 2009).

In Canadian nonprofits, the board of directors' role is similar to their counterparts in for-profit corporations—to represent stakeholder interests when dealing with the organization's management and performing their other ascribed duties. Primer for Directors of Not-for-Profit Corporations (Broder 2002) indicates that even when the subjective standard of care applies, this does not mean that a director with few skills or little experience will escape liability.

The conventional wisdom is that such a director is required to act in accordance with conduct expected of a reasonably prudent person. This means that a director without the skills required to meet that standard is obliged to acquire at least some of them. A director who is not already knowledgeable must become informed (Burke-Robertson 2013).

In all three jurisdictions, the United States, Great Britain, and Canada directors are legally responsible for overseeing and monitoring the organization and must do so in a manner consistent with that which would be exercised by a reasonable and prudent person. One of the ways to demonstrate that they are acting reasonably is for a board to adopt and follow a recognized risk framework.

RISK MANAGEMENT

Every company and organization faces certain risks in the conduct of their affairs. Over time various methodologies for handling these risks have been developed to more effectively and efficiently minimize them so as to maximize the output of the organization.

Adopting a framework is an important function, especially when it comes to developing and implementing a process to be the most effective and efficient in the industry. There are several advantages to the use of a framework (Dervitsiotis 2000). These advantages include some assurance that the desired process has been tested or vetted by knowledgeable parties to carry with it a seal of approval as to how an organization may approach a particular function. The adherence to a framework would be evidence of discharging the legal duties that directors are under, and if for no other reason, should be utilized to the greatest extent possible.

Accordingly, in Canada, board directors are becoming more interested in and concerned about risk and how they should give diligent risk oversight in discharging their legal and corporate governance duties (Leblanc 2008). While risk management is complex, there are several sources for frameworks from which directors can draw direction on how to proceed, including Emerging Governance Practices in Enterprise Risk Management, (Tonello 2007) and, more directed to Canadian boards and directors, The Canadian Institute of Chartered Accountants' A Framework for Board Oversight of Enterprise Risk (Caldwell 2012) and The Canadian Institute of Chartered Accountants' 20 Questions Directors Should Ask About Risk (Lindsay 2006).

A Framework for Board Oversight of Enterprise Risk (Caldwell 2012, 1) is a detailed 80-page guide for directors on how to “better identify and address critical risks, understand how risks are interconnected and recognize the potential compounding of risks should unfavourable events occur at the same time.” This document aims to put in place a framework for boards to implement in order to achieve the goals as stated earlier.

20 Questions Directors Should Ask About Risk (Lindsay 2006, 1) alternatively is “designed to be a concise, easy to read introduction to [risk management]…The question format reflects the oversight role of directors…is not intended to be a precise checklist, but rather a way to provide insight and stimulate discussion on [risk].” Each question contains commentary as to why the question is important and what directors may expect in the way of answers from members of the organization or its retainers. An auditor could use these questions to ferret out how well an organization is meeting best-in-class practices with regard to risk management.

METHODOLOGY

In order to better understand how boards of directors view and handle risk, we conducted a survey of directors of various organizations in Canada. One of the purposes of this survey was to see how closely actual risk management practice followed certain risk management frameworking standards in Canada and if the adoption of a framework coincided with better risk oversight behavior in these organizations. We studied primarily one framework, 20 Questions Directors Should Ask About Risk produced by the Canadian Institute of Chartered Accountants (“20 Questions”), with supplementary questions from a second framework, The Canadian Institute of Chartered Accountants' A Framework for Board Oversight of Enterprise Risk (Caldwell 2012). While there may be other frameworks available to organizations and directors in Canada, we believed that using the 20 Questions was a legitimate starting point in that the Canadian Institute of Chartered Accountants is made up of the 72,000 chartered accountants in Canada and has been embraced by a leading director education/certification program in Canada, The Directors College, in its flagship Chartered Director Program. This survey uses the 20 Questions framework to test the nature and degree of directors' oversight of risk.

The 20 Questions are broken down into the following four general areas.

RESULTS

We will report our results by first outlining some general demographics of the survey respondents then detailing how the respondents answered questions pertaining to the 20 Questions. The survey began with 31 personal and organizational demographic questions, followed by 57 questions related to risk frameworks, and ending with 28 questions on more personal and organizational risk attitudes and perceptions. In total there were 116 questions in the survey, which took about 40 minutes to administer, although the respondents were provided as much time as they required. There were a total of 63 respondents, of which 12 self-identified as being directors of organizations that followed the 20 Questions framework.

The directors were asked to pick only one organization they were currently a director of as the focal organization for answering the survey questions. This was to account for those directors who may sit on more than one board. The average board experience was 8.4 years and the average board experience of the directors for the focal organization was 4.5 years. Thirty-two percent of the respondents were female and 68 percent male. 15.3 percent of respondents were under the age of 40, 23.6 percent between 41 and 50, 40.3 percent between 51 and 60, and 20.8 percent between 61 and 70. 12.7 percent of responding directors had only a secondary school (high school) education, 33.8 percent a university undergraduate education, 45.1 percent a Master's degree, and 2.8 percent a PhD.

For these focal organizations the average number of directors was 10.5 and they had on average 7.1 board meetings a year. The average revenue for the focal organizations was $427 million and the median was $35 million (Canadian dollars). There were, on average, 2,100 employees at these organizations and the median was 150 employees. Average assets were $19 billion and the median was $26.5 million.

Directors rated their organization's performance versus those in their industry. Overall, 76.1 percent of directors rated their organization's performance above that of their industry and 25.4 percent of directors rated their organization's performance so much better than their industry that we found this difference to be statistically significant at the p < 0.05 level. The respondents also rated their satisfaction with their organization's performance at 9 percent extremely satisfied and in total 65.7 percent above average satisfaction. Finally, these directors described their organizations to be 11.9 percent international, 17.9 percent national, 44.8 percent regional, and 25.4 percent local.

The survey asked participants if they followed the 20 Questions framework advocated by the Canadian Institute of Chartered Accountants. The results were that 19 percent of participants followed this framework, 56 percent did not, and 24 percent did not know whether they did or did not. While we have collected and analyzed data from the 56 percent who specifically did not follow the 20 Questions separately from the 24 percent who did not know if they followed them, the results were in all cases consistent, so for this reporting we have combined these two results.

Interestingly, from a structural point of view, the 20 Question framework followers were more likely to have independent chairs of their boards, have lead directors, have orientation for board members, and have continuing education for board members compared to those boards that did not follow the framework.

The survey asked to what degree the directors understood their legal responsibilities related to opportunities and risks. We found that the directors who followed the 20 Questions framework had an average score of 5.6 on a 7-point Likert scale (1 = Not at All, 7 = Completely) and that those who did not follow the framework scored 4.4, which was statistically different at the p < 0.01 level. When the participants were asked if the assignment of risk oversight was clearly the responsibility of the board, those who followed the 20 Questions framework scored a 6.7 on a 7-point scale (1 = Not at all, 7 = Completely) while the nonframework followers scored a 4.7, which was a significant difference at the p < 0.01 level. Therefore, those who followed the 20 Questions were statistically more attuned to their legal responsibilities of overseeing the risks of the organization than those who did not follow the 20 Questions framework.

We produce our results in Exhibits 43.1–Exhibit 43.17. Each of the 20 questions is indicated in the title of the table. Below each of these 20 questions are the actual associated survey questions meant to determine if the respondents' organizations actually conducted activities that would correspond to the 20 Questions framework. These actual questions are numbered within each table. The columns related to framework followers and nonfollowers refers to whether respondents had self-identified as following the 20 Questions framework or not. The column marked “Significance” indicates the statistical significance of any difference in the means of the answers between the followers and the nonfollowers. The column marked “Difference” is the subtraction of the positive percentage responses from the framework nonfollowers from that of the framework followers. The range of responses for those questions that used a 7-point Likert scale is included in Appendix 43.A. It should also be noted that a particular survey question may correspond to multiple 20 Question questions and we have endeavored to indicate these as footnotes to the tables. Furthermore, in two instances we ran t-tests to determine the significance of the difference in answers to a series of questions; these results are also indicated as footnotes.

DISCUSSION

This research leads us to some observations about risk management in organizations and in particular at the top of organizations. These observations come from our analysis of responses to 57 questions on risk management practices in a survey administered to Canadian directors. These directors are legally obligated to take action that is in the best interests of the organization and to act in a prudent and reasonable fashion, including the overseeing of the organization's risk management practices.

One risk management practice we tried to test was whether the directors of organizations that have adopted a framework, in our case The Canadian Institute of Chartered Accountants' 20 Questions Directors Should Ask About Risk, actually implement the practices that are indicative of, or recommended by, the framework. We believe that the 20 Questions is a useful risk framework for organizations and that the survey questions are reflective of the practices recommended by this framework. We further believe that this survey is suggestive of good risk practices at the organizational and board level.

The survey analysis revealed in nearly all instances a significant positive difference in the good risk practices adoption rate between those organizations that adhered to 20 Questions and those that did not. This unsurprising result supports our contention that the adoption of a framework is indicative of preferred practices. It appears that the adoption of a framework is not just a hollow action. It is reflective either of a current practice in the organization or of newly adopted best practices, since the organizations that did not adopt the framework were less likely to utilize the best practices. This highlights the importance of the development and dissemination of frameworks or best practices in the risk arena. While there appears to be a correlation between the adoption of the framework and the use of its best practices, we feel there is room for further research to explore the causative relationship, if any, between these two activities. It is recommended that a framework related to risk be adopted by all organizations and, irrespective of the direction of causation, this adoption appears to correlate with best practices. We also suggest that an organization's adoption of a framework is evidence that directors are meeting their legal obligation to act in a reasonable and prudent manner in their oversight and monitoring role—this may be connected with the result that those directors whose organizations followed the 20 Questions framework were statistically more aware of their legal obligations and duties vis-à-vis risk.

Those directors whose organizations followed the framework were statistically more satisfied with their risk identification, assessment, and management, and were more aware of their legal obligations regarding organizational risk. These results suggest a close correlation between directors' knowledge of their duties and the discharge of a director's legal duties with respect to risk. Ignorance of the law is no excuse, and the adoption of frameworks appears to go hand in hand with at least knowing what the law is. We would be supportive of the development of direct, straightforward frameworks such as The Canadian Institute of Chartered Accountants' 20 Questions Directors Should Ask About Risk that are understood and actionable to leaders who have the authority and responsibility for overseeing the risk appetites and processes of the organization. We suggest that an easily digestible best practices guide for directors be utilized to correspond to the directors' responsibility to the organization and its shareholders. The adoption of a framework in and of itself may require at a minimum the attention of directors to this vital area of responsibility and assist in the discharge of their legal duties. While we were unable to determine which occurred first, directors' knowledge of the law or the adoption of a framework, it seems that to begin with, directors may need a refresher on their legal obligations, which arguably will lead to better risk management practices.

It should be noted that failure to adopt the framework is not associated with not performing some of the best practices enunciated in the framework. In fact, the non-framework followers did utilize many of the specific processes and actions in their organizations, although at a significantly lower uptake than those who followed the framework. One can surmise that many of the best practices enumerated in the framework are just good management practices and so are adopted by many directors in any event (although at a statistically lower rate than framework followers) and separate from the framework. To the extent this is true, it further supports the position that the risk practices set out in the framework are above and beyond standard good management practices and hence are of use to every organization in its management of risk. It is arguable that general management practices may not be enough in fulfilling a director's legal obligations where it can be shown there are readily available best practices in the form of accepted frameworks. The adoption of a framework and its attendant practices are further evidence of meeting the subjective standard that directors in Canada are to uphold.

While we believe our results are very suggestive of framework adoption being associated with the actual adoption of best practices, this survey also produced a very curious and unexpected result. Despite answering more than 50 questions that directly dealt with good organizational risk process and information practices, the directors who did not follow a framework, and who scored statistically below those who did follow good risk processes, were nonetheless far more satisfied with the risk their organizations were taking by a margin of 2:1. Conversely, the more robust the risk practices, the less comfortable directors were with the amount of risk taken by their organizations. It appears the more directors knew about the risk their organizations were taking, the more uneasy they were. Less knowledge appears to be correlated with much more satisfaction with the risk taken by the organization, and therefore, at least in this survey of organization directors respecting risk, ignorance is bliss. We believe there is room for further research to understand why this interesting, somewhat counterintuitive, result was achieved. The more questions directors ask about risk, the more uneasy they should be prepared to feel about the risks their organizations are taking. Educating directors (and others) about risk management best practices should include warnings about the sleepless nights that can result from their concern about the level of risks their organizations are taking. If organizations adopt risk frameworks they should be prepared to uncover aspects of risk in their organizations that were previously unknown, ignored, or forgotten. Once these risks become known they will have to be considered and dealt with as well.

CONCLUSION

In conclusion, we have studied and reported on risk management practices in organizations in the context based primarily upon a specific Canadian risk framework. We have results suggestive of adoption of a framework being associated with best practices. We also have results that there is a strong association between better risk practices and unease by directors in the amount of risk their organizations are taking. However, there exist nuances and unanswered questions regarding how those at the top of the organization view and manage risk. We hope that this research will help inform the discussion about leadership perceptions and management of risk.

APPENDIX 43.A

All these questions were on a 7-point Likert scale.

REFERENCES

ABOUT THE AUTHORS

David Kunsch, PhD, BSEE, LL.B., MSc, received his PhD from the Richard Ivey School of Business at Western University, where his thesis was based on corporate governance failures. His research centers on the cognitive biases, processes, and critical thinking of directors and executives and how this impacts decision making in the boardroom. Dr. Kunsch focuses on mistakes, misperceptions, omissions, deviance, and other suboptimal behaviors in the boardroom from both an individual and group decision-making perspective. His research has recently centered on how risk is perceived and acted upon in the boardroom. Dr. Kunsch is an Associate Professor of Management at St. John Fisher College in Rochester, New York, a Lead Facilitator at the Directors College at McMaster University, and has taught at the EMBA, MBA, and undergraduate levels in Strategy and Corporate Governance at the DeGroote School of Business at McMaster University, the Richard Ivey School of Business at Western University, Ryerson University, and St. John Fisher College. Before receiving his PhD he obtained his BSEE at GMI in Michigan, his LLB at Osgoode Hall in Toronto, and his MSc at Wayne State in Michigan, and has extensive legal and business experience in private practice and with large multinationals, including a Dow 30 firm.

Chris Bart, PhD, FCPA, is one of the world's leading experts on organizational mission statements and how companies can use them more effectively to become mission-driven organizations. He is currently the Co-Founder and Executive Chairman of the Caribbean Governance Training Institute and the Caribbean Institute of Directors. He is the also the Founder of The Directors College of Canada (2003 to 2013), where he served as its inaugural Principal and Lead Professor. Dr. Bart has authored the 10-year Canadian business best-seller A Tale of Two Employees and the Person Who Wanted to Lead Them as well as six other widely acclaimed publications. He has published over 190 strategy- and governance-related articles, cases, and reviews. Dr. Bart currently serves as Associate Editor of the International Journal of Business Governance & Ethics as well as a Research Fellow of the Asian Institute of Corporate Governance at Korea University. He is currently listed by the Social Sciences Research Network as being in the top 10 percent of author downloads. Dr. Bart has been invited to lecture at numerous institutions in the United States, South Africa, Egypt, Greece, the Caribbean, Switzerland, the United Kingdom, Australia, the Czech Republic, and China.