Aligning Corporate Governance with Enterprise Risk Management

Abstract

MELDING ENTERPRISE RISK MANAGEMENT WITH GOVERNANCE MEANS DIRECTORS, SENIOR MANAGEMENT, INTERNAL AND EXTERNAL AUDITORS, AND RISK OWNERS MUST WORK INTERDEPENDENTLY. Corporate scandals and diminished confidence in financial reporting among investors and creditors have renewed corporate governance as a top-of-mind priority for boards of directors, management, auditors, and stakeholders. At same time, number of companies trying to manage across entire enterprise is rising sharply. So, we ask, how can enterprise management (ERM) be integrated effectively with corporate governance? RISK, ERM, AND GOVERNANCE To begin, business risks, of course, are uncertainties that can impinge on a company's ability to achieve its objectives and can result in many interdependent outcomes-some negative, some positive. Moreover, risks are a function of severity and likelihood; they may or may not manifest themselves. If they do, a variety of exposures is possible. Business risks relate to business objectives because taking is a prerequisite to success-without risk, there is no reward. Accordingly, some risks must be exploited to take advantage of strategic opportunities. Conversely, risks that threaten success must be mitigated. These risks include threats of problems occurring, such as misappropriation of assets, or opportunities not occurring, such as a failure to achieve strategic goals. Meanwhile, ERM-a structured and disciplined approach to help management understand and manage uncertainties-encompasses all business risks using an integrated and holistic approach. A report from Institute of Internal Auditors (IIA) captures essence of ERM: goal of ERM is to create, protect, and enhance shareholder value by managing uncertainties surrounding achievement of organization's objectives.1 The professional literature indicates that ERM is relatively well understood, especially by companies striving to implement it. Finally, corporate governance is a process a board carries out to provide direction, authority, and oversight of management for company's stakeholders.2 Unfortunately, directors, management, internal and external auditors, and managers do not understand corporate governance well-especially from a day-today perspective. They sometimes consider it a nebulous topic: It means different things to different people.3 Moreover, while board of directors is owner of governance process, day-to-day guidance and oversight by board clearly is not feasible; board must rely on other parties-executives, managers, and auditors-to help it fulfill its governance responsibilities. But practical, how-to guidance for executives, managers, and auditors who are involved in corporate governance on a day-to-day basis is sparse. AN ERM AND GOVERNANCE FRAMEWORK Our ERM and governance framework, as illustrated in Figure 1, consists of four components: corporate stakeholders, governance umbrella provided by board of directors, management, and assurance. The arrows within and between four components represent various channels of ERM and corporate governance communications. Who Should Be Responsible for What? Boards of directors, senior management, internal auditors, and external auditors are the cornerstones of foundation on which effective corporate governance must be built, according to a position paper from IIA.4 Our conceptual framework also includes risk owners. These are people in a corporation who are responsible and accountable for managing specific risks, such as chief legal officer, who is responsible for a company's legal risk. Only senior management and owners should be directly responsible for management. In Table 1 we delineate primary management roles people in each group have as part of a company's governance. Board of Directors. …

Cite this work

No public copy is stored for this record, so only the metadata is cited.

Stored only when both papers are in the corpus — 112 citations exist upstream.