Top 10 Topics for Directors in 2015: Risk Management

Jan 5, 2015

Reading Time : 3 min

Proper oversight of risk management encompasses the full panoply of risks that a company may face, including operational, financial, strategic, compliance and reputational risks. Enterprise risk management not only focuses on reducing risk, but also assesses both upside and downside risks, and thus, helps inform the strategic planning process. Boards of directors of all companies should be evaluating the adequacy of their risk management oversight procedures. Among other things, directors should address —

  • Director education.All directors need to have a good understanding of their company’s business and the major risks it faces. Without a good grasp of both the upside and downside risks, directors cannot properly oversee the company’s strategic direction. Indeed, as part of its oversight function, a board needs to be satisfied that the company’s risk appetite, that is, the amount of risk the company is willing to accept in pursuit of stakeholder value, is appropriate for the company.i As discussed more fully in the topic on board composition, boards should ensure they have directors with sufficient experience and expertise to effectively oversee the risks the company faces, particularly with respect to data security and information technology.
  • Oversight structure. The board should evaluate the manner in which it oversees risk management. Depending on how large it is and how well it functions, a board may decide to retain overall authority for risk management oversight at the board level. Other boards may use board committees to carry out certain of their risk oversight duties.

At many companies, primary oversight responsibility for risk management is delegated to the audit committee. Of course, audit committees are already burdened with a host of other responsibilities that have increased substantially over the years. Consequently, although not widespread, the boards of some companies (primarily in the financial services and insurance industries) have set up separate risk management committees. And several hundred U.S. companies now employ a chief audit executive who reports directly to the full board, allowing the board to receive information that has not been filtered.ii

Even if primary oversight for monitoring risk management is delegated to a committee, the entire board needs to remain engaged in the risk management process and be informed of material risks that can affect the company’s strategic plans. Given the wide spectrum of risks that most companies face and the myriad board decisions that are permeated by risk considerations, many directors believe that risk management oversight should rest with the entire board. Also, if primary oversight responsibility for particular risks is assigned to different committees, collaboration among the committees is essential to ensure a complete and consistent approach to risk management oversight.

  • Reporting processes. Directors need to ensure that they are getting the information they need to understand the company’s risks, as well as management’s assessment of those risks. They also may want to meet privately with the company’s principal risk officer and the internal and outside auditors to discuss risk management issues. If risk management is delegated among several committees, their activities and the sharing of information needs to be coordinated. Also, the board should re-examine how often risk management matters are discussed at board meetings.
  • Risk management review. The board (or other responsible committee) should review with management the adequacy of the company’s risk management practices. In particular, the board needs to probe whether the company’s risk management processes appropriately identify, assess and manage the company’s risks to ensure that the risk exposures are consistent with the company’s appetite for risk.
  • Cyber risk. As part of a board’s risk management oversight function, directors should carefully assess the adequacy of their company’s data security measures. Cyber risk is not going away, so it is imperative that boards and management do what they can to manage and minimize cyber risk, as discussed more fully in the topic on cybersecurity. This includes identifying those areas where the company is most vulnerable and understanding how they may be at risk. Boards also need to have a response plan in place if and when a cyber attack occurs and ensure they have adequate insurance coverage for data breaches. Failure to adequately oversee this risk can cause dire consequences for the company and create additional issues for directors, including lawsuits and negative voting recommendations.

This post was excerpted from our annual Top 10 Topics for Directors in 2015 alert. To read the full alert, please click here.


i See COSO, “Enterprise Risk Management , Understanding and Communicating Risk Appetite” (January 2012).

ii Paul Ziobro and Joann S. Lublin, “Ouster of Target Directors is Urged,” The Wall Street Journal (May 29, 2014).

Share This Insight

Previous Entries

Deal Diary

June 27, 2024

On June 24, 2024, the U.S. Securities and Exchange Commission (SEC) published five new Form 8-K Compliance and Disclosure Interpretations (C&DIs) expanding the agency’s interpretations of cybersecurity incident disclosures pursuant to Item 1.05 of Form 8-K. In July 2023, the SEC adopted final rules with respect to cybersecurity incidents that generally require public companies to disclose (i) material cybersecurity incidents within four business days after determining the incident was material and (ii) material information regarding their cybersecurity risk management, strategy and governance on an annual basis. We wrote about the final cybersecurity disclosure rules here.

...

Read More

Deal Diary

February 12, 2024

The Securities and Exchange Commission (SEC) recently adopted final rules (available here; also see the fact sheet and press release) representing significant changes to  special purpose acquisition companies (SPACs), shell companies and the disclosure of projections. These rules aim to enhance disclosures, protect investors and align the regulatory framework for SPACs with traditional IPOs. The following summarizes the key aspects of these rules.

...

Read More

Deal Diary

October 4, 2023

On September 20, 2023, the U.S. Securities and Exchange Commission (SEC) issued a final rule amending the so-called “Names Rule” (found here) that is “designed to modernize and enhance” protections under Rule 35d-1 of the Investment Company Act of 1940. The final rule is part of the SEC’s holistic efforts to regulate environmental, social and governance (ESG) matters, and is the SEC’s latest attempt to curb greenwashing in U.S. capital markets. The amendments require registered investment funds that include ESG factors in their names to place 80% of their assets in investments corresponding to those factors, thereby extending to ESG funds the SEC’s long-standing approach of regulating the names of registered funds to ensure they are marketed to investors truthfully. Fund complexes with more than $1 billion in assets will have two years from the final rule’s effective date (60 days after publication in the Federal Register) to comply, while fund complexes with less than $1 billion in assets will be given a compliance period of 30 months.

Chair Gary Gensler said “[t]he Names Rule reflects a basic idea: A fund’s investment portfolio should match a fund’s advertised investment focus. In essence, if a fund’s name suggests an investment focus, the fund in turn needs to invest shareholders’ dollars in a manner consistent with that investment focus. Otherwise, a fund’s portfolio might be inconsistent with what fund investors desired when selecting a fund based upon its name.” The sole dissenting vote against the rule modification, Commissioner Mark Uyeda, said “[w]ith these amendments, the Commission overemphasizes the importance of a fund’s name, as if to suggest that investors and their financial professionals need not look at the prospectus disclosures.” Commissioner Uyeda also expressed concern that fund investors will bear the increased compliance costs associated with the rule change.

...

Read More

Deal Diary

May 31, 2023

As discussed in our prior publication (found here), the Securities and Exchange Commission (SEC) adopted amendments on December 14, 2022, regarding Rule 10b5-1 insider trading plans and related disclosures. On May 25, 2023, the SEC issued three new compliance and disclosure interpretations (C&DIs) relating to the Rule 10b5-1 amendments.

...

Read More

Deal Diary

May 24, 2023

On May 15, 2023, the Eastern District of California ruled that California Assembly Bill No. 979 (“AB 979”) violates the Equal Protection Clause of the U.S. Constitution’s Fourteenth Amendment and 42 U.S.C. § 1981. As enacted, California’s Board Diversity Statute, required public companies with headquarters in the state to include a minimum number of directors from “underrepresented communities” or be subject to fines for violating the statute. AB 979 defines a “director from an underrepresented community” as “an individual who self-identifies as Black, African American, Hispanic, Latino, Asian, Pacific Islander, Native American, Native Hawaiian, or Alaska Native, or who self-identifies as gay, lesbian, bisexual, or transgender.”

...

Read More

Deal Diary

May 9, 2023

Update: On October 31, 2023, the Fifth Circuit granted the US Chamber of Commerce's petition for review of the SEC's share repurchase disclosure rules, holding that the SEC acted arbitrarily and capriciously in violation of the Administrative Procedure Act. The court directed the SEC to correct the defects within 30 days of the opinion. On December 1, 2023, the SEC informed the Fifth Circuit that it was unable to correct the rule's defects within 30 days of the opinion. On December 19, 2023, the Fifth Circuit vacated the SEC’s share repurchase disclosure rules.

...

Read More

Deal Diary

April 12, 2023

We have released our 2023 ESG Survey which includes a collection of reports reflecting on significant ESG themes and trends from 2022, as well as what we believe to be key developments for 2023.

...

Read More

Deal Diary

February 6, 2023

As companies begin preparing for the 2023 proxy season, we note that Institutional Shareholder Services Inc. (ISS) and Glass Lewis, the leading providers of corporate governance solutions and proxy advisory services, issued updated benchmark policies (proxy voting guidelines), which can be found here and here, respectively. The updated proxy voting guidelines generally focus on board accountability and oversight considerations and address topics such as climate accountability, board diversity, shareholder rights, corporate governance standards, executive compensation and social issues. What follows is a summary of the proxy voting guidelines published by ISS and Glass Lewis for the 2023 proxy season.

...

Read More

© 2025 Akin Gump Strauss Hauer & Feld LLP. All rights reserved. Attorney advertising. This document is distributed for informational use only; it does not constitute legal advice and should not be used as such. Prior results do not guarantee a similar outcome. Akin is the practicing name of Akin Gump LLP, a New York limited liability partnership authorized and regulated by the Solicitors Regulation Authority under number 267321. A list of the partners is available for inspection at Eighth Floor, Ten Bishops Square, London E1 6EG. For more information about Akin Gump LLP, Akin Gump Strauss Hauer & Feld LLP and other associated entities under which the Akin Gump network operates worldwide, please see our Legal Notices page.