by Enrico Diecidue and Tim Rowley*
A crucial role of any board is risk management. This responsibility includes setting the appropriate risk level, monitoring management’s actions against that benchmark, scanning the horizon for potential problems and helping management deal with potentially value-destroying events when they occur.
Covid-19 makes this task much more difficult. Not only has the pandemic raised risk levels significantly, but it has also transformed the landscape, revealing entirely new categories of risk. For example, risks pertaining to cybersecurity must be revisited in light of the “new normal” of remote working. Regulatory risks will also require reassessment as governments mull increased intervention to help mitigate the crisis.
To get a sense of how boards were coping, the INSEAD Corporate Governance Centre teamed up with Board Agenda and audit firm Mazars on a survey about how corporate leaders were managing their risk environment. More than 300 participants across Europe answered the survey, including CEOs, CFOs, board chairs, executive and non-executive directors. It consisted of an initial round of general risk-related questions in January-March 2020. A follow-up in April-May focused on the impact of Covid-19.
Lots of confidence, some uncertainty
Responses to the January-March survey revealed a high degree of confidence in the board’s ability to manage risks. While 87 percent of respondents reported that risks had risen in the last five years, a clear majority (70 percent) considered their boards skilled enough to handle all the risks in their market sector. Further, 63 percent said they fully understood the risk profile of their organisation.
More good news: Nearly 80 percent of the executives felt that the board and management were aligned on key risks facing the organisation. Only around 62 percent of respondents reported a similar level of alignment among the board, management and shareholders, however.
At the same time, just over half of respondents said the board routinely received all the information necessary for decision making, which suggests many board members are ill-equipped to oversee risks. About one quarter reported they definitely did not always receive prompt and complete information; the remaining quarter was unsure.
The risk information available to board members varied by the topic, suggesting risks were unequally managed: While 91 and 88 percent of leaders reported their board had sufficient knowledge of finance and regulatory compliance, respectively, their confidence in the board’s ability to oversee geopolitical risks (51 percent), business disruption risks (47 percent), cyber risks (38 percent) and climate change risks (34 percent) was much lower.
Culture and diversity
Covid-19 pressures have increased the need for companies to revisit their culture and diversity practices. Remote working, for example, creates new dynamics and stresses. The survey indicates that 61 percent of respondents feel their corporate culture is well monitored, and 49 percent feel they have made efforts to increase diversity in board representation. Of course, that still leaves 51 percent that have not done so.
Moreover, only one third reported altering their compensation incentives for risk-management reasons. Considering that about one third of survey participants were drawn from the financial services sector, which has been especially implicated in this regard, we see room for improvement.
Risks of Covid-19
The follow-up survey was conducted during the crest of the first global Covid-19 wave. We wanted to know how boards were responding to the crisis, as well as how much damage they expected as a result of the pandemic.
Around half of the participants (47 percent) reported that their board had a crisis management committee. The others adopted a range of solutions, from distributing crisis management responsibilities across the entire board to handling it through the executive committee, business continuity team, or a newly formed “Cobra” emergency response team. While more than half said they were prepared to tackle the pandemic, 43 percent regarded Covid-19 as a fundamental threat to their organisation.
In written comments, participants shared a broader take on the crisis. For example, “the board relies on management to provide updates and offer solutions to challenges presented by Covid-19. The board and executive committee review management’s plans and responses and offer suggestions and advice”. Another wrote, “This is a very difficult time for our business. It doesn’t threaten our survival because we are very large and have a significant number of very large clients. But our revenues are falling considerably and there will be downward pressure on fees…”
Overall, respondents evinced a great deal of confidence in the state of their resilience so far. This was reflected in an overwhelming majority agreeing that procedures or controls were holding up well for all stakeholders (96 percent), controls and engagement across the organisation were satisfactory (86 percent) and oversight of external developments was sufficient (75 percent). Surprisingly, 72 percent of participants said that they still had bandwidth for other major organisational risks not directly related to Covid-19.
However, some were farther along than others when it came to framing a post-pandemic business strategy. While 57 percent said they had one, 30 percent could not say for sure and the remaining 13 percent had not developed such a strategy.
Climate risks
One of the red flags raised by the report is that climate risk came in dead last in the rankings of risk categories according to the level of concern for the organisation. Arguably, this is the risk area that should most concern business and society, as many stakeholder groups are taking action to change corporate practices in this regard. And without a clear plan, many companies could face government regulations, employee retention issues and customer defections, compounding the Covid-19 crisis with new value-destroying risks.
In the months and years to come, it will be essential to explore why climate change is not taken seriously enough at board level, and what can be done about it.
Another clear takeaway from the report is the paramount importance of systematic approaches to risk evaluation and integration in the face of rapid change and uncertainties in the business landscape – of which Covid-19 is only the latest and most pressing example.
*Professor of Decision Sciences at INSEAD, co-directs the International Directors Programme and Visiting Professor of Strategy, a Distinguished Fellow at the Corporate Governance Centre of INSEAD, co-directs the International Directors Programme
**first published in: knowledge.insead.edu
By: N. Peter Kramer
