Fundamentals of Risk Management for Accountants and Managers

Paul M. Collier

• Publisher: Routledge
• Year: 2009
• ISBN:
  9781136439865
• Edition: 1
• Topic: Business
• Subtopic: Business General
• Index: Business

Both financial and non-financial managers with accountability for performance at either a strategic level or for a business unit have responsibility for risk management, in terms of failing to achieve organisational objectives.
Fundamentals of Enterprise Risk management is structured around four parts and 26 self-contained chapters. Each chapter will have ample practical examples and illustrations/mini-case studies from retail, manufacturing and service industries and from the public and not-for-profit sectors to enable the reader to understand and apply the concepts in the book.

Part CRisk Applications in Organisations

In Part C, we consider many different aspects of enterprise risk management, from its concern with financial reporting, decision making and hedging (chapters 11, and 12) to information systems risk (Chapter 13), health and safety (Chapter 14), and credit risk (Chapter 15).We consider the broader aspects of strategy and business risk (Chapter 16) to the narrower examples of project risk (Chapter 17) and fraud and theft (Chapter 18). We look at risk in relation to the environmental and regulatory change (Chapter 19) and at business continuity (Chapter 20) and insurance (Chapter 21). We also give a summary of risk in the banking industry (Chapter 22).

Each of these risk applications is important in its own right, but for enterprise risk management, each is a piece of the jigsaw that at senior management and Board level needs to be fitted together and be evaluated in terms of the relative importance of each piece. Based on the organisation’s risk appetite and risk strategy, each application and its assembly into a coherent enterprise risk management framework will inform the development of appropriate risk treatment and reporting.

Risk and Financial Reporting

DOI: 10.4324/9780080942759-10

Financial reporting by companies has become increasingly prescriptive in terms of what has to be disclosed for the benefit of shareholders and other stakeholders in the company. This is so in the financial statements themselves and in the Operating and Financial Review, in which various risk disclosures need to be made for the benefit of investors.

Accounting Standards

Accounting standards reflect the basic accounting principles that are generally accepted by the accounting profession and which are a requirement under the UK Companies Act as essential for reporting financial information or under US Generally Accepted Accounting Principles (GAAP). Historically, each country has had its own set of accounting standards. The move towards the harmonization of accounting standards between countries through the work of the International Accounting Standards Board (IASB) has been a consequence of the globalization of capital markets, with the consequent need for accounting rules that can be understood by international investors. The dominance of multinational corporations and the desire of companies to be listed on several stock exchanges have led to the need to rationalize the different reporting practices in different countries.

International Financial Reporting Standards (IFRS) are published by the IASB. The predecessors of IFRS were called International Accounting Standards (IASs). The term International Financial Reporting Standards (IFRSs) includes both the newer IFRSs and the older IASs

The objectives of the IASB are to develop, in the public interest, a single set of understandable and enforceable global accounting standards that require high quality, transparent and comparable information in financial statements and other financial reporting to help participants in the various capital markets of the world and other users of the information to make economic decisions; to promote the use and rigorous application of those standards; and to work actively with national standard-setters to bring about convergence of national accounting standards in each country and IFRSs.

The Sarbanes-Oxley Act of 2002 is the main legislation affecting companies listed in the United States. The United States has a Financial Accounting Standards Board which has not yet adopted IFRSs. The United States equivalent of accounting standards is GAAP. However, the IASB and FASB have agreed in principle to develop a common conceptual framework to underlie published financial statements. At the time of writing, the Securities and Exchange Commission seems to be leaning toward giving US companies the option of switching to international financial reporting standards rather than mandating conversion as it prepares to release its road map for convergence late in 2008.

The main rules in relation to disclosure of information in financial reports of an entity (this is the term used for a listed organization) are contained within IAS1: Presentation of Financial Statements and IFRS7: Financial Instruments (IFRS7 is described later in this Chapter).

IAS1 prescribes the basis for presentation of general purpose financial statements to ensure comparability both with the entity’s financial statements of previous periods and with the financial statements of other entities. It sets out overall requirements for the presentation of financial statements, guidelines for their structure and minimum requirements for their content. An entity shall present a complete set of financial statements (including comparative information) at least annually. A complete set of financial statements comprises:

1. a statement of financial position as at the end of the period (a ‘Balance Sheet’);
2. a statement of comprehensive income for the period (an ‘Income Statement’, previously called a ‘Profit and Loss account’);
3. a statement of changes in equity for the period;
4. a statement of cash flows for the period;
5. notes, comprising a summary of significant accounting policies and other explanatory information; and
6. a statement of financial position as at the beginning of the earliest comparative period when an entity applies an accounting policy retrospectively or makes a retrospective restatement of items in its financial statements, or when it reclassifies items in its financial statements.

Behind accounting standards sits a Framework for the Preparation and Presentation of Financial Statements. The Framework defines the objective of financial statements to provide information about the financial position, performance and changes in financial position of an entity that is useful to a wide range of users in making economic decisions. Financial statements prepared for this purpose meet the common needs of most users. However, financial statements do not provide all the information that users may need to make economic decisions since they largely portray the financial effects of past events and do not necessarily provide non-financial information.

Operating and Financial Review

In the United Kingdom, the Accounting Standards Board published a Reporting Statement: Operating and Financial Review (OFR) in 2006. The reporting statement is a voluntary statement according with ‘best practice’ principles for listed companies. The OFR (although different companies may use a different terminology) is intended to complement and supplement financial statements by being forward-looking, providing details of strategy including key performance indicators.

The OFR should provide information to enable shareholders ‘to assess the strategies adopted by the entity and the potential for those strategies to succeed’ (Accounting Standards Board, 2006:13) including:

• The nature of the business, description of the market, the competitive and regulatory environment, and the organization’s objectives and strategies;
• The development and performance of the business in the last year and in the future;
• The resources, principal risks, uncertainties and relationships that may affect long-term value;
• Description of the capital structure, treasury policies and objectives and liquidity of the business in the last year and in the future.

The OFR should include the objectives of the business, the Board’s strategies for achieving those objectives, financial and non-financial performance measures used to monitor progress towards achieving objectives, the main trends that the Board considers as likely to affect future prospects, a description of the principal risks and uncertainties facing the business and the Board’s approach to managing those risks. As can be seen from this partial list, the OFR explicitly requires the directors to comment on objectives, risk and risk management in a way completely consistent with the enterprise risk management approach.

Risk Disclosure in the United Kingdom

Prior to the OFR guidelines, a study by Solomon et al. (2000) found that little guidance was available in the Combined Code as to what information about risks UK-listed companies should disclose in their annual reports. They suggested a framework for corporate risk disclosure comprising:

• The voluntary or mandatory nature of disclosure.
• Investors’ attitudes towards risk disclosure.
• Forms of risk disclosure, that is reported separately or grouped.
• Disclosure preference, that is whether all risks had equal importance.
• Location of disclosure, in the OFR, or elsewhere.
• Level of risk disclosure, whether current levels were adequate or whether increased disclosure would help decision-making.

Solomon et al. surveyed institutional investors during 1999. They found that almost a third of institutional investors agreed that increased risk disclosure would help their portfolio decision-making. They also found that institutional investors saw a strong link between corporate governance reform and risk disclosure. Solomon et al. recommended that the current voluntary (‘comply or explain’) framework be retained.

Linsley and Shrives (2006) studied risk disclosure in 79 UK company annual reports. They found a significant association between the number of risk disclosures and company size. However, they found no association between risk disclosures and measures of risk using financial ratios. There were few monetary assessments of risk but companies did disclose forward-looking risk information. Linsley and Shrives concluded that the dominance of general statements of risk management policy and a lack of coherence in risk narratives implied that stakeholders would be unable to adequately assess the risk profile of a company from its annual report.

Appendix A in this chapter contains extracts from HMV Group plc Annual Report and Accounts for 2007. HMV’s Annual Report reveals that, like most listed companies, increasing attention is now given by companies to risk disclosure. Risk disclosure takes place in the OFR (HMV calls this a ‘Business and financial review’ which describes the risks it faces), the corporate governance statement (explaining the role of the audit committee and the Board’s approach to internal control), and the Directors’ report (which discloses details of financial risks and hedging activity, described in Chapter 12). Risk is also mentioned in the external audit report and in the notes to the accounts.

Sarbanes-Oxley Act

For companies listed in the United States, the introduction of the Sarbanes-Oxley Act in 2002 was the legislative response to the financial and accounting scandals of Enron and WorldCom and the misconduct at the accounting firm Arthur Andersen. Its main aim was to deal with core issues of transparency, integrity and oversight of financial markets. Sarbanes-Oxley (or SOX) introduced the requirement to disclose all material off-balance sheet transactions. The Act requires the certification of annual and quarterly financial reports by the chief executive and chief financial officer of all companies with US securities registrations, with criminal penalties for knowingly making false certifications.

SOX, in particular sections 302 and 404, take an approach that is limited to internal control over financial reporting. SOX requires the CEO and CFO to give assurances regarding the effectiveness of internal controls. Section 404 of Sarbanes-Oxley requires companies to state that management has the responsibility for establishing and maintaining an adequate internal control structure and procedures for financial reporting; and to make an assessment of the effectiveness of the internal control structure and procedures for financial reporting.

SOX is reported to have increased both management compliance costs and audit costs in US-listed corporations. In 2006, COSO published Internal Control over Financial Reporting – Guidance for Smaller Public Companies (Committee of Sponsoring Organizations of the Treadway Commission (COSO), 2006),¹ which provided 20 basic principles that would help ensure compliance with the Sarbanes-Oxley requirements for internal control over financial reporting. Consistent with COSO’s internal control framework, the principles cover the control environment, risk assessment, control activities, information and communication, and monitoring.

The Sarbanes-Oxley legislation focuses more on the role of the audit committee than on the responsibilities of the Board. However, there are no provisions relating to the internal audit function or its role in risk and control. An independent Public Company Accounting Oversight Board has been established in the US with responsibility for setting standards for auditing, quality control and independence. Under SOX, external auditors are required to report on management’s assessment. By contrast, in the United Kingdom and most other countries, there is no requirement for audit...

Table of contents

• Cover Page
• Half Title Page
• Title Page
• Copyright Page
• Dedication
• Contents
• Introduction
• About the Author
• Part A Introducing Risk Management
• Part B The Structure of Enterprise Risk Management
• Part C Risk Applications in Organisations
• Part D Evaluating Risk Management
• Index