风险挑战文化（英文版）_28页

Summary of "A Risk Challenge Culture"

Core Content

This report explores the concept of a risk challenge culture and its importance in modern corporate governance. It is based on insights from the ACCA-IMA Accountants for Business Global Forum and roundtables held in Dubai, London, and New York in late 2013. The report highlights the need for boards and executives to cultivate a culture that encourages, requires, and rewards critical questioning and risk oversight to avoid the pitfalls that led to the 2008 financial crisis.

Main Views

1. Definition and Importance of a Risk Challenge Culture

• A risk challenge culture is one that promotes open inquiry, critical assessment, and debate about risks.
• It is essential for effective risk management and value creation.
• Boards and executives must lead by example and foster an environment where questioning is not seen as a threat but as a necessary part of governance.

2. Professional Scepticism and Board Oversight

• Professional scepticism is crucial for board members and the C-suite to effectively oversee risk.
• Boards should ask 'what if' questions rather than 'why' questions to encourage exploration of different scenarios.
• It is important to avoid group think and to ensure that board members challenge assumptions and provide meaningful dissent.
• The board must regularly interrogate the organisation’s risk management process and ensure that all perspectives are considered.

3. Board Diversity and Expertise Development in ERM

• A diverse board with varied skills and experiences is essential for a robust risk challenge culture.
• All board members should be knowledgeable in ERM, not just one designated 'risk expert'.
• Continuous training and education are necessary for board members to understand the complexities of risk management.
• Scenario planning and experiential learning are recommended methods for enhancing board understanding of risk.

4. Conversations and Roles in Risk Management

• The board and C-suite have shared responsibilities in risk management, including strategy setting, risk identification, assessment, and monitoring.
• The chief risk officer (CRO) and chief financial officer (CFO) play key roles in advising and challenging risk-taking behaviors.
• Internal audit is critical in ensuring transparency and accountability in risk reporting.
• There should be a clear ownership structure for risks, with the first line of defense being the risk owner, the second line being risk oversight functions, and the third line being internal audit.

5. Information Asymmetry and Risk Reporting

• Information asymmetry between executives and the board can lead to poor decision-making and increased risk exposure.
• Delays or filters in information sharing can be detrimental, especially when risks materialise quickly.
• Boards should ensure that risk information flows up the chain and is not restricted to top-down reporting.
• Establishing clear communication channels and expectations is vital to reducing information asymmetry.

Key Information

• ACCA (Association of Chartered Certified Accountants) and IMA® (Institute of Management Accountants) are global professional bodies that focus on accounting and financial management.
• The report draws on the experiences of three authors: Paul L. Walker, William G. Shenkir, and Thomas L. Barton, who are experts in ERM and corporate governance.
• The COSO ERM framework and other ERM standards are referenced as tools for developing a strong risk challenge culture.
• The risk appetite statement is a key element in setting the tone for risk management and is part of the shared responsibility between the board and executive management.
• Board training is ongoing and should not be seen as a one-time event.
• Scenario planning and experiential learning are suggested as methods to enhance board understanding of risk.
• The chairperson and CEO should be open to criticism and ensure that the board is not just passive but actively involved in risk discussions.

Conclusion

A risk challenge culture is vital for organisations to effectively manage risks and avoid the pitfalls that led to the 2008 financial crisis. It requires a balance of professional scepticism, board diversity, shared responsibility, and clear communication. The report emphasizes that risk management is not just about reporting but about active questioning, debate, and learning at all levels of the organisation. Continuous training, transparency, and the right governance structures are necessary to ensure that a risk challenge culture is not only developed but also sustained.