VISION AND LEADERSHIP This section analyses how information regarding principal risks, and risk identification and management processes are reported on by the company. The narrative should be clear and concise to allow the reader to gain an understanding of all factors facing the business and the internal processes in place. on those risks which could potentially impact all companies rather than those factors which are specific to the company or industry in question. The most common method of reporting remains a tabular format which displays the risk, potential impacts and, sometimes, mitigation activities in place. While this approach is by far the most accessible for the reader, it is important that companies do not become constrained by the format in an effort to ‘make the risks fit the table’. As indicated by the regulators in some of their recent consultations and policy documents, companies also need to pay greater attention to ensuring that the risk factors which they are reporting on are indeed those which are ‘principal’. With a handful of reports disclosing upwards of 20 risks, it is clear that some companies need to rethink their approach in this area; though the need to rationalise the demands of US and UK reporting requirements is perhaps an issue for some. There are also signs that the words of the Financial Reporting Review Panel have been heeded as we have seen a slight drop in the average number of risks being disclosed, though the figure is still between 12 and 13. GOVERNANCE Need to review risk management Not surprisingly, this is an area of risk reporting which has remained relatively static over the last few years in terms of the level and quality of disclosure. In many cases the risk management procedure is clearly not something which changes frequently and therefore the reporting reflects this situation. For others, it is possible that their minimalist approach to disclosure is indicative of a cautious mentality where there is reluctance to document specific processes and responsibilities for fear of reprisal if things go wrong. Indeed, the case of the UK banking sector is proof of this fact; pages of seemingly informative and well thought out disclosures about internal controls and risk reporting were apparent in the vast majority of the ‘pre-crisis’ Annual Reports. Yet in the wake of the storm that followed, such information seemed rather irrelevant given that the systems which were documented had failed to prevent vast losses and write downs. Clearly this scenario plays on the minds of some companies and therefore it is perhaps ambitious to think that risk management disclosure will ever go much beyond its current form. Figure 6.1 Figure 6.2 MARKET TRENDS AND OUTLOOK How are companies detailing their risk management information? 22% 26% 43% 25% 30% Very detailed explanation Detailed information BUSINESS DESCRIPTION 38% Basic information 9% ’09 7% ’10 No information STRATEGY What is nevertheless important for the Annual Report, is an indication that risks are being managed in the context of the strategy and that the Board has accounted for the ‘unknown unknowns’ as well as the ‘known unknowns’ when formulating its objectives. RISK Greater focus on risk factors All companies provide an explanation, to varying extents, which outlines the key risk factors impacting the business, though in some cases the focus is Figure 6.3 Figure 6.4 CORPORATE RESPONSIBILITY How many risks are identified? PERFORMANCE Is the process of risk identification clearly outlined? 14% 18% 41% 13% 17% 45% Very detailed information Detailed information Basic information How are companies providing details of their risk factors? 23% 49% 25% 58% Very detailed explanation APPROACH TO REPORTING Detailed information 27% 25% No information 28% 17% ’09 ’10 Basic explanation • • • • • 1 to 5 6 to 10 11 to 15 16 to 20 20+ 4% 36% 42% 9% 9% ’09 ’10 www.blacksunplc.com © Black Sun Plc 2011 23
