The rules are not there to be broken

T wo years into the hard bite of the financial crisis, European companies and regulators are still scratching their heads over the tooth marks, and wondering how to cleanse the risk management factors – financial, corporate governance and global – that triggered the downward spiral.

How far does the progress made to remedy risk assessment inspire confidence that there will be no repeat?

Brussels is not the most edifying place to start. The EU’s internal market commissioner, Michel Barnier, is still considering the whole area of corporate governance in the financial services sector. A consultation paper, issued last June, has yet to result in anything concrete.

Meanwhile, the most solid risk assessments introduced by the EU – stress tests in the banking sector – have turned into an ongoing farce. Two rounds of tests implemented last year were insufficiently stringent: just months after ‘passing’, Allied Irish Bank and Bank of Ireland suffered a liquidity crisis that brought on the EU-IMF bail-out of Ireland.

As the EU embarks on fresh stress tests, there is disagreement about whether these should investigate liquidity and sovereign debt exposure. Earlier this year Barnier said there was an overall need to make the tests “more robust and credible”, but would not reveal whether the parameters and results should be made public.

Learning lessons

Meanwhile in the private sector, Airmic chief executive John Hurrell says those dealing in operational risk are digesting the chief lessons emerging from the crisis.

But he adds that many companies tend to ring-fence the banking crisis, believing it to be “all about subprime” and irrelevant to their own risk exposure. As recent events affecting BP and Toyota have demonstrated, reputational risk spreads beyond the banks.

Moreover, Hurrell says that the crisis has forced companies to overhaul new technology, intellectual property, product and supply chains, all of which entail new risk. But he believes that there has not been a proportional injection of risk management restructuring to accompany these.

The holy grail for risk management – incorporating a strategy that will derive a competitive advantage from the downside risk – remains elusive, and can only really be attained by chief executives who deal directly with risk management, he says.

Ferma’s vice-president and group risk managing director at Pirelli in Milan, Jorge Daniel Luzzi, says that there have been some improvements. “The voices of warning relating to risk are now being heard within companies, and committees for internal risk control are being set up,” he says.

But just as unity over stress tests eludes Europe’s leaders, unity within companies is proving one of the most challenging issues.Luzzi says that one of the main challenges is for groups to assess risk across the whole of their structures.

“Avoiding silos is very important. The danger remains that different subsidiaries will be assessing risk according to separate criteria, without equalising risk across the corporate structure,” Luzzi says.

Nor will regulation from Europe or individual countries do much to assist. According to Luzzi, rules “simply promote a period of conformity followed by playing tricks to get around the rules”.

Greatest dangers

Hurrell agrees that companies can still use the rules as little more than a box-ticking exercise. But this means that they will have little impact unless backed by a genuine desire to integrate risk management.

But perhaps the greatest dangers for companies and regulators remain out of their control. At a recent UK corporate governance symposium, Anne Kvam, investment head of Norway’s $500bn (€362bn) sovereign wealth fund, had a question. She owns stakes in 1,100 Chinese companies and 400 in the UK, so why was she being asked to reform strategy for the UK, where corporate governance standards are already excellent, rather than China?

No true assessment of risk in the wake of the global crisis can avoid this poser. SR