What are the weaknesses in your board’s risk oversight practices, especially considering your ability to oversee the new emerging 2024 risks which could impact your organization? T.K. Kerstetter is an award-winning expert on board governance, author and pioneer in the field of board education who advises that boards must be constantly evaluating how they can improve, and make changes as needed. This paper reviews Kerstetter’s guidance on how board must improve. We also explore “what’s around the corner/what can be done better” in board risk oversight, per a recent 2024 survey conducted by the American CPA and NCU (North Carolina State University). In a nutshell, this paper explores risk processes which require improvement, highlighting how directors can better oversee the myriad of 2024 risks.
Introduction
The risks to be overseen by today’s boards are numerous, as are the opportunity costs of not acting on necessary risk mitigation strategies. A key risk is not focusing on priorities. Award winning governance expert Kerstetter’s view on the complexity faced by directors in 2024, not just risk related complexity, is summarized by Corporate Board Member magazine, as follows: 1.
• The role of committee chairs is now pivotal. “Board meetings are so full now that a lot of the work is done by the committees,” says Kerstetter. “The committee chairs have to do so much work between the meetings and be on top of the issues. So the process of recruiting and picking the right people to be the chairs is now one of the key success factors of a board.”
• Transparency demands go overboard. “In the beginning that was a good thing, but it has gotten to the point where people want you to share your strategic plan even though it doesn’t make sense to tell your competition exactly what you are going to be working on. The pendulum swung a bit too far.”
• Tech evolution presents steep learning curve. “I feel for board members who will be mandated to learn all they can about AI and quantum computing. We’ve already seen how tough it is to get your arms around cyber risk when you don’t know where it’s coming from or what it’s doing—and it’s only going to get harder with these [emerging] technologies.”
Ultimately, Kerstetter notes that boards must be constantly evaluating how they can improve to make changes as needed. “Never be satisfied with where you are, because you don’t know what’s around the corner.”
Applying Kerstetter’s guidance to risk oversight, several lessons can be learned. Most important, boards should be continually assessing the quality of their oversight practices, especially whether they are identifying and reviewing the critical processes employed by management to administer the risks of the organization. This might require an outside expert to conduct this assessment. An important step is that the chair must ensure that the right qualified risk director(s) with proven expertise to lead board risk oversight are on board. Such directors should have previous experience as a chief risk officer or at least having directly led implementation of a sophisticated ERM program. Further, proper Strat Planning protocols guide that the Strat Plan be stress tested with a risk assessment, especially focussed on the assumptions that drive the projected financial, operational or strategic objectives in the plan. Sharing a Strat Plan with stakeholders should be preceded with a risk assessment, anticipating needs and questions of constituents. As for technology and Cyber risks, progressive board skills matrices now provide for onboarding a tech savvy director who has the expertise to oversee managements approach to protecting mission critical systems, including overseeing AI strategy.
So how are boards doing in 2024 in the risk oversight area, and are boards prepared to provide the level of oversight of ERM practices and processes that shareholders, stakeholders and their corporations require? In their recently published 2024 annual survey of the “State of Risk Oversight”, partners AICPA (American Institute of Public Certified Accountants) and NCU (North Carolina State University, Enterprise Risk Management initiative) provide a report card on ERM Oversight practices by boards. AICPA/NCU interviewed 377 senior executive and director respondents, each answering 40 questions, representing a variety of sizes of organizations. 33% of organizations have revenues $100 million or lower while 39% have revenues over $1 billion providing a variation in organization size in the sample. Almost all (89%) of the organizations are based in the United States. Here are key findings from the study: 2
a) Pressure by Boards on CEOs to Step Up ERM practices: To what extent is the CEO (president) being asked to increase senior executive involvement in risk oversight? Per the AICPA/NCU study, “…Expectations, particularly from boards of directors and their audit committees, are increasing for more senior executive involvement in risk oversight for their organizations. Additionally, emerging best practices and corporate governance requirements are also incentivizing greater engagement of senior leaders in risk management activities. Part of that increased interest in more senior executive focus on risk management activities is triggered from unanticipated risk events that have impacted the organization.”2.
b) Business continuity and crisis management: Over one-third of respondents believe their organizations need to “mostly” or “extensively” enhance their approach to business continuity and crisis management.
c) Risks increasing in 2024: Executives perceive the overall volume of risks in the business environment to be complex and increasing from prior years.
d) Maturity of Risk Practices: While organizations have generally advanced the maturity of their risk management processes, that progress has been relatively slow, with most respondents indicating their risk management processes are not yet mature or robust.
Do Your Board’s Risk Practices need
an outside assessment?
Reach out to Directors Global
e) Connecting Strat Planning and ERM: Organizations continue to struggle to connect their risk management efforts with their strategic planning processes, with only a small percentage of respondents indicating their risk management processes provide significant strategic advantage.
f) Risk Identification: Most organizations engage in formal risk identification processes on an annual basis, focusing on operational, compliance and financial risk issues with emerging strategic market risks given the least attention. Numeric scales are generally provided to guide executives in their assessment of a risk’s likelihood and impact.
g) Key Risk Indicators: While management dashboards highlight key performance indicators, most dashboards do not have robust sets of key risk indicators to monitor changes in risk conditions.
h) Chief Risk Officers: Over the past 15 years, the percentages of organizations appointing an individual to serve as a chief risk officer or creating a management-level risk committee have steadily increased, with most risk committees meeting monthly or quarterly.
h) Audit Committees still house Risk Oversight. Most boards are delegating their risk oversight responsibilities to a subcommittee of the board, which is typically the audit committee except for financial services organizations that delegate to risk committees of the board.
So, does the board have qualified people to address some or all the issues listed in the AICPA/ NCU survey? Is the board prepared to look inwardly and make changes suggested by T.K. Kerstetter. An assessment of the board’s capabilities, targeting weaknesses in the risk oversight area will answer some or all these questions.
Footnotes
1. Corporate Board Member, TK Kerstetter Recognized With 2024 Lifetime Achievement Award https://boardmember.com/tk-kerstetter-recognized-with-2024-lifetime-achievement-award/
2. (AICPA) American Institute of Certified Public Accountants and (NCU) North Carolina State University, Poole School of Management, The State of Risk Oversight (2024): https://erm.ncsu.edu/wp-content/uploads/sites/41/2024/07/The-State-of-Risk-Oversight-An-Overview-of-ERM-Practices-15th-Edition-FINAL.pdf
