The RMC Advisors

The Keys to Enterprise Risk Management

How does your organization's ERM program compare to best practices? What is the maturity level of your ERM program? What value are you receiving from the ERM program? Aon's , Global Enterprise Risk Management Survey '10 describes data collected regarding the extent of ERM implementation across organizations, the effect on organization needs, stakeholder requirements, and how ERM is used to balance risk, opportunity, and value.

Respondents benchmark their progress based on Aon's five-stage ERM maturity model.  The five phases in the maturity model are: 

1. Initial/lacking, 
2. Basic, 
3. Defined, 
4. Operational,
5. Advanced.  

Fifty-five percent of organizations surveyed classify the organization as defined or operational, which is an increase from Aon's prior survey in 2007.

Responses for primary drivers for ERM include; improving governance and transparency, adopting best practices, and improving performance and decision making.  Organizations with mature ERM programs noted value in areas including enhancing shareholder value, optimizing/reducing total cost of risk, strengthening business resiliency and increasing operational efficiency.  In addition, respondents noted the value of ERM increases greatly as the ERM program matures.

Strengthening ERM: A Wise Decision

What is the state of Enterprise Risk Management (ERM) in your organization? What are the components of ERM and what can they do for your organization? The Committee of Sponsoring Organizations of the Treadway Commission (COSO) issued the paper, Enterprise Risk Management for Strategic Advantage, to assist management in addressing improvements in risk oversight. It highlights four important areas of ERM for management and the board to review and consider. The following presents some important questions for you to chew on.

Organization Risk Appetite and Philosophy: Is your board, executive management, and middle management all on the same page when making decisions on the level of risk to take on behalf of your organization? Does the Board set the “Tone at the Top” and influence corporate culture regarding risk appetite and philosophy? Is there a shared understanding from the Board down through middle management regarding the amount of risk that is acceptable in the pursuit of meeting corporate objectives?

Risk Management Practices: Do you understand your organization’s approach to risk management? Does the board challenge management and determine if key risk exposures are within acceptable risk levels?  Is there a threat for your executive compensation package to encourage risk-taking beyond acceptable risk levels? Do you reward strong performance without considering the risks assumed by the organization to meet the performance targets? Case in point: the sub-prime mortgage crisis. 

Portfolio of Risks: Do you understand all of the significant risks facing your organization? Do you know how management is addressing these risks? How do you know they are addressing the right risks? Does the board packet contain relevant risk information? Is risk a board agenda item?

Key Risk Indicators (KRI): Do you have a set of key risk indicators for your organization? Does everyone understand the KRIs and the appropriate risk responses? What is your process to report on KRIs?

Is this case, what you do not know can hurt you. As Warren Buffett said, “It takes 20 years to build a reputation and five minutes to ruin it. If you think about that, you’ll do things differently.” A corporate risk assessment can start your organization on the way to answering these questions.

For more information, contact Elaine Nissley at ENissley@macpas.com.

 

Fraudulent Financial Reporting - Time to Learn from the Past

In the coming decade, will history repeat itself or will we learn from the past? This year the Committee of Sponsoring Organizations of the Treadway Commission (COSO) released their second report on fraudulent financial reporting. This report covers the years from 1998 – 2007.  Their previous 1999 report covered the years 1987 - 1997.

 What have we learned?

 The findings are not very encouraging. Fraud is even more prevalent in the past ten years than the prior 10 years. The 2010 report identified 347 cases of fraud compared to 294 cases of public companies reporting fraud in the 1999 report. In addition, the mean fraud rose from $4.1 million in the 1999 study to $12.05 million in the 2010 study. In the years 1998 through 2007, there was nearly $120 billion in known misstatements or misappropriations. Since the 2010 report only included a limited number of cases after the implementation of the Sarbanes-Oxley (SOX) legislation, it is too early to assess the effect of SOX on addressing fraud.

 What can we do?

 Pay Attention to the C-Suite: Accounting and Auditing Enforcement Releases (AAER) from the Securities and Exchange Commission (SEC) named the CEO and/or CFO as defendants in 90% of the cases in the years 1998-2007. Boards and auditors need to be ever vigilant to the red flags of fraud and should understand what drives the CEO or the CFO to commit financial statement fraud. It is important boards and auditors work to reduce incentives and pressures on management to commit financial statement fraud.

 Look for Revenue Fraud: Over 60 % of the fraud cases in the 2010 report involved revenue fraud. A look at the stock graphs for WorldCom and Enron provide a picture of a company in trouble and the ultimate results. Industry specific studies are important ways to identify overstatement of revenues. The Board and the auditors must find ways to identify and investigate potential overstatement of revenue before it becomes an SEC issue or a major fraud.

 Board Governance: The 2010 report does not identify differences in governance characteristics between companies with fraud and those without. According to COSO, this area requires additional research. Does your management and board have an attitude of transparency and the desire to have all information, good and bad, out in the open? If not, you may want to take steps to develop this attitude. In addition, check out the article on Strengthening Enterprise Risk Management within the context of the risk related to management compensation and the pressure to meet the financial expectations.

 Change of Auditors: COSO determined that there is a trend for companies to change auditors between clean and fraudulent financial statements. This puts an extra burden on the Financial Auditors to look into prior years to compare the financials to the year under review and note any unexplainable discrepancies.

 Consequences: The severe consequences of fraud are well publicized. These include sanctions against individuals and companies. This frequently includes jail time and restitution judgments against the perpetrators. There is significant negative impact to the shareholders including bankruptcy, abnormal stock declines and job losses.

 Though greed appears to have increased over the past two decades, the time is right for boards and auditors to take this trend seriously and recognize that everyone is a potential candidate to commit fraud. Learn the red flags of fraud and never be afraid to ask the hard questions and get the right answers. Dig deeper and do not accept a cursory response; the hard question may be the best question you ever asked.

 The entire 2010 report by COSO, Fraudulent Financial Reporting 1998 – 2007 is located at http://www.coso.org/documents/COSOFRAUDSTUDY2010.pdf

 For a copy of the fraud checklist, contact Elaine Nissley at ENissley@macpas.com.