SEC proposes board risk management disclosures

Public companies may soon have to disclose more information about their board's risk management role and how compensation practices affect the company's overall risk profile, potentially broadening the role of risk managers.

Under a proposed Securities and Exchange Commission rule, in proxy statements and other communications to investors, corporations would have to disclose the board's role in overseeing measures to manage company risks that include operational, credit and liquidity exposures.

The SEC proposal would challenge risk managers to expand their skill set, said Pete Fahrenthold, managing director of risk management for Continental Airlines Inc. in Houston.

But risk managers also would gain an opportunity to learn more about a wide range of corporate operational and financial risks so they can help deliver consistent information to corporate directors, said Mr. Fahrenthold, who also is vice chair of the Risk & Insurance Management Society Inc.'s enterprise risk management committee.

“It essentially creates accountability at the board level for risk,” Mr. Fahrenthold said. “I think that is a good thing for risk management and the business community in general.”

The SEC's proposed rule, No. 33-9052, which can be found online at www.sec.gov/rules/ proposed/2009/33-9052.pdf, states that corporate “disclosure might address questions such as whether the people who oversee risk management report directly to the board as a whole, to a committee, such as the audit committee, or to one of the other standing committees of the board, and whether and how the board, or board committee, monitors risk.”

The SEC plan is among various regulatory and legislative mandates expected to emerge as governmental entities look to shape corporate governance and risk management practices in hopes of preventing recurrence of the credit problems and other issues that led to the financial crisis, several observers agree.

“I'm concerned there is going to be a lot of that, not just from the SEC,” said Mat Allen, senior vp and practice leader for enterprise risk services and solutions at Marsh Inc. in New York.

Other agencies, such as the Federal Trade Commission, also are likely to push for “some central government body mandate on boards interacting with risk management departments in a different way than they have in the past,” Mr. Allen said.

The SEC proposal, however, calls only for disclosing information about a board's role in managing risks, said Laura Taylor, managing director and national practice leader for enterprise risk management at Aon Global Risk Consulting in New York. It does not mandate specific actions, unlike the Shareholder Bill of Rights Act of 2009 that Sen. Charles Schumer, D-N.Y., introduced last spring. That legislation, now in a Senate committee, would require establishing a risk management committee comprised of independent directors, Ms. Taylor said.

The SEC will accept public comments until Sept. 15 on the proposal, which would be published in the Federal Register with projected implementation sometime in 2010.

The SEC and other regulatory bodies that are examining the board's role, such as the U.S. Treasury Department, will push companies that have not already done so to determine who will have responsibility for informing upper management and board members about their company's exposures, said Prakash Shimpi, a managing principal and leader of the enterprise risk management practice at Towers Perrin in New York.

Companies also will be pushed to determine how to convey that information.

“It's a move from (an existing) philosophical discussion on, "Should the board be involved in risk issues?' to a tangible, down-to-earth (discussion) about, "How do we actually ensure these issues are being viewed and addressed by the board?'” Mr. Prakash said.

Continental Airlines' Mr. Fahrenthold agreed.

He said he expects companies will set up new mechanisms to centralize and report data so board members and senior management receive consistent information about a corporation's entire array of risks.

“It's an important step forward that will change the way risk management is handled,” Mr. Fahrenthold said.

Boards will have to learn about addressing risk while risk managers will need to learn to convey information to directors more accustomed to “accounting-based” data than risk probability calculations, Mr. Fahrenthold said.

The SEC proposal also would require companies to “discuss and analyze” whether their compensation policies encourage employee risk-taking that could affect the entire company.

While compensation has traditionally fallen under human resource departments, the SEC's proposed rule could lead to greater risk manager engagement in that area, said Frank Strenk, a senior vp and enterprise risk management practice leader at Lockton Cos. L.L.C. in Chicago.

“I would suggest that if a risk manager is leading more of an enterprise risk approach, they certainly will be more involved, there is no question,” Mr. Strenk said.