Directors’ Duties and Risk Governance

In recent years, growing expectations from financial markets, increasing requirements by regulators and dedicated guidelines on risk governance have raised the bar for board involvement in the management of risks. Board risk oversight refers to the practices used by directors to define the appropriate level of risk for their companies to communicate appetite for risk and to oversee the institution and functioning of controls aimed at keeping the company operating within established boundaries. Managerial literature offers anecdotal evidence that board risk oversight is mainly driven by the search for compliance with regulatory requirements, thus turning a value creation mechanism into an ineffective bureaucratic exercise. The inadequate risk culture of most boards is often reported as the main determinant of the gap between the expected and the actual effectiveness of board risk oversight. We provide an additional explanation based on a review of the leading guidance on corporate governance. We contend that the image of board risk oversight marketed through most of the governance literature is a simplified, unrealistic representation of a complex set of activities whose effectiveness depends on the solution of theoretical as well as practical problems. In our view, leading risk management frameworks and guidance do not address most of those critical issues but merely provide one size fits all solutions that are frequently derived from concepts and practices developed in highly regulated industries and later transferred to different and distant industries without adequate contextualization. We argue that this practice has led to some significant biases that make the implementation of risk oversight in different contexts less effective than the original one. We also re-examine board risk oversight in the light of directors’ fiduciary duties. We contend that the well-established jurisprudential orientation of courts, inspired by the business judgment rule, may even encourage boards to be uninformed of aggressive risk-taking by officers and management. Nonetheless, recent jurisprudence seems to reconsider directors’ responsibility (and liability) for risk oversight, apparently recognising the conflict between the weak fiduciary standards set by previous jurisprudence and the increasing requests from investors for boards to play a more active role.