Risk Management and Corporate Governance

1 Consult this publication on line at work is published on the OECD iLibrary, which gathers all OECD books, periodicals and statistical for more GovernanceRisk Management and Corporate GovernanceCorporate GovernanceRisk Management and Corporate GovernanceContentsExecutive summaryChapter 1. Risk Management Governance framework and practices in 27 jurisdictionsChapter 2. Norway: The Corporate Governance framework and practices relating to risk managementChapter 3. Singapore: The Corporate Governance framework and practices relating to risk managementChapter 4. Switzerland: The Corporate Governance framework and practices relating to risk managementAnnex A. Financial Stability Board: Sound risk Governance practicesisbn 978-92-64-20862-9 26 2014 01 1 PRisk Management and Corporate GovernanceCorporate Governance9 HSTCQE*caigcj+ Corporate GovernanceRisk Managementand Corporate GovernanceVolume 2011/Number of issue, Year of editionAuthor (affiliation or title), EditorTaglineGroupe de travail/Programme(ligne avec top 220 mm)This work is published on the responsibility of the Secretary-General of the OECD.

2 Theopinions expressed and arguments employed herein do not necessarily reflect the officialviews of the OECD or of the governments of its member document and any map included herein are without prejudice to the status of orsovereignty over any territory, to the delimitation of international frontiers and boundariesand to the name of any territory, city or 978-92-64-20862-9 (print)ISBN 978-92-64-20863-6 (PDF)ISBN (HTML)Series: Corporate GovernanceISSN2077-6527(print)ISSN 2077-6535 (online)The statistical data for Israel are supplied by and under the responsibility of the relevant Israeli authorities. The useof such data by the OECD is without prejudice to the status of the Golan Heights, East Jerusalem and Israelisettlements in the West Bank under the terms of international credits:Cover .Corrigenda to OECD publications may be found on line OECD 2014 You can copy, download or print OECD content for your own use, and you can include excerpts from OECD publications, databases andmultimedia products in your own documents, presentations, blogs, websites and teaching materials, provided that suitableacknowledgment of the source and copyright owner is given.

3 All requests for public or commercial use and translation rights should besubmitted Requests for permission to photocopy portions of this material for public or commercial use shall beaddressed directly to the Copyright Clearance Center (CCC) the Centre fran ais d'exploitation du droit de copie(CFC) cite this publication as:OECD (2014),Risk Management and Corporate Governance , Corporate Governance , OECD Management AND Corporate Governance OECD 20143 ForewordThis report presents the results of the OECD s sixth peer review based on theOECD Principles ofCorporate Governance . The report reviews the Corporate Governance framework and practicesrelating to Corporate risk Management . It covers 27 report is based in part on a questionnaire that was sent to all participating jurisdictions inDecember 2012. In a second stage, the Corporate Governance framework and practices relating tocorporate risk Management in three jurisdictions (Norway, Singapore and Switzerland) werereviewed in more detail based upon a more focused set of questions and visits by the OECDS ecretariat.

4 The purpose of these case studies is to highlight national practices that may be ofprincipal importance and particularly useful as a reference. The report was prepared by Winfrid Blaschke,Daniel Blume, Hans Christiansen and Akira Nozaki, and was conducted in co-operation with theOECD Working Party on State Ownership and Privatisation Practices (WP SOPP).The OECD Corporate Governance peer review process is designed to facilitate effective implementationof the OECD Principles and to assist market participants, regulators and policy makers. It is carriedout through an exchange of experiences and expertise that provides participants with an overview ofexisting practices and approaches and an opportunity to identify good practices that can stimulateand guide improvements. The reviews are also forward looking, so as to help identify key marketpractices and policy developments that may undermine the quality of Corporate Governance .

5 Thereview process is open to OECD and non-OECD jurisdictions OF CONTENTSRISK Management AND Corporate Governance OECD 20145 Table of contentsExecutive 7 Chapter Governance framework and practicesin Background to the Scope of the The perspective of the OECD Principles and Corporate Governance and the financial Risk Management practices in listed Risk Management practices in state-owned 27 Chapter : The Corporate Governance framework and practicesrelating to risk Risk Management standards and The role of Norwegian boards of directors and board-level Risk Management policies and structures in Norwegian External assessments of the risk Management 47 Chapter : The Corporate Governance framework and practicesrelating to risk Risk Management standards and The role of the board of Structure and organisation of the risk Management Risk Management Independent assessment of the risk Governance The role of 68 Chapter : The Corporate Governance framework and practicesrelating to risk 72 TABLE OF CONTENTSRISK Management AND Corporate Governance OECD 20146 Follow OECD Publications on: Risk Management standards and The role of Swiss boards of Risk Management policies and structures in Swiss External assessments of the risk Management stability Board.

6 Sound risk Governance Risk Governance requirements/recommendations for listed Risk Governance requirements/recommendations for non-listed Singapore Key measures of updating Corporate Governance Companies with a committee with explicit reference to risk (2010).. Singapore Market capitalisation (% of GDP).. Singapore Composition of the SGX listed companies (July 2013).. Singapore Overview of the regulatory framework for risk Singapore Key risk factors identified by listed companies and Composition of Swiss equity indices (mid-2013).. 73 Risk Management and Corporate Governance OECD 20147 Executive summaryThis report reviews the Corporate Governance framework and practices relating tocorporate risk Management in 27 of the jurisdictions that participate in the OECDC orporate Governance Committee. Against the background of theOECD Principles ofCorporate Governance , it describes how various jurisdictions have chosen to implement thePrinciples relating to risk report analyses the Corporate Governance framework and practices relating tocorporate risk Management , in the private sector and in state-owned enterprises (SOEs).

7 Itis based upon a general survey of participating jurisdictions, complemented by threecountry studies illustrative of different aspects of risk Management and corporategovernance (Norway, Singapore and Switzerland).The review finds that, while risk-taking is a fundamental driving force in business andentrepreneurship, the cost of risk Management failures is still often underestimated, bothexternally and internally, including the cost in terms of Management time needed torectify the situation. Corporate Governance should therefore ensure that risks areunderstood, managed, and, when appropriate, the financial crisis, many companies have started to pay more attention torisk Management . This is, however, seldom reflected in changes to formal procedures,except in the financial sector and in companies that have suffered serious riskmanagement failure in the recent past.

8 It appears that most companies consider that riskmanagement should remain the responsibility of line to public and/or shareholder pressures, some company boards, especiallyin widely-held companies, have started to review their incentive structures, includingthrough the reduction of potential incentives for excessive risk-taking, notably stockoptions for top executives. Listed company boards need to be provided with incentivestructures that appropriately reward business success, as well as awareness andmanagement of risk Governance standards for listed companies still focus largely on internalcontrol and audit functions, and primarily financial risk, rather than on (ex ante) identificationand comprehensive Management of risk. Corporate Governance standards should placesufficient emphasis onex anteidentification of risks . Attention should be paid to bothfinancial and non-financial risks , and risk Management should encompass both strategicand operational , risk Governance standards tend to be very high-level, limiting their practicalusefulness, and/or focus largely on financial institutions.

9 There is scope to make riskgovernance standards more operational, without narrowing their flexibility to apply themto different companies and situations. Experiences from the financial sector can beEXECUTIVE SUMMARYRISK Management AND Corporate Governance OECD 20148valuable, even if not necessarily transferable to the non-financial sector. Outsourcing- andsupplier-related risks , for example, deserve attention in both the financial and the non-financial is not always clear that boards place sufficient emphasis on potentially catastrophic risks , even if these do not appear very likely to materialise. More guidance may be providedon managing the risks that deserve particular attention, such as risks that will potentiallyhave large negative impacts on investors, stakeholders, taxpayers, or the should be aware of the shortcomings of risk Management models that rely onquestionable probability should follow similar risk Governance practices as listed enterprises, but this isoften not formalised in implementable regulation.

10 Deviations from listed companystandards should be duly motivated, and not just be the result of lack of applicability ofcorporate Governance codes. Sometimes, SOEs are subject to separate risk managementoversight through sectoral regulators, whole-of-government risk Management systems, orgovernment audit institutions. Risk oversight at sub-federal level SOEs tends to be lessdeveloped and more uneven than at the federal board practices differ, with some countries considering risk as an issue for thewhole board, others tasking the board audit committee with the work, and still othersestablishing risk committees. As in the private sector, these choices are often affected byfactors such as size and sectors the SOE is operating in. Whichever structure is selected,effective oversight needs to be assured. Some countries mandate external auditors toreview risk Governance in SOEs a crucial balance needs to be struck between controlling risk through directaction from the ownership function and through delegation to the board of directors.