The Influence of Board of Directors’ Risk Oversight on Risk Management Maturity and Firm Risk-Taking

A variety of external events, including inquiries into the causes of the 2008 financial crisis and changes in regulations and listing rules have fostered rising expectations for boards of directors to exert greater oversight of their organizations’ risk management processes. The primary impetus behind these external pressures is the belief that stronger board oversight over risk management processes will lead to substantive improvements in risk management and more informed risk-taking. Many observers, however, argue that board members often lack the time, skills, and information necessary for effective risk oversight. They contend that the adoption of governance practices that are advocated or mandated by external parties is often window-dressing. This point of view suggests that board risk oversight will have little effect on companies’ risk management practices or risk-taking.

In our paper The Influence of Board of Directors’ Risk Oversight on Risk Management Maturity and Firm Risk-Taking, which was recently made publicly available on SSRN, we examine these conflicting predictions. To this purpose, we use detailed proprietary survey data on board risk oversight and organization-wide risk management practices. The sample includes 297 publicly traded firms headquartered in 28 countries. Knowing the identity of the companies participating in the survey enables us to add to the survey data publicly available information on accounting fundamentals, stock prices, and director characteristics.

We investigate the risk management and risk-taking implications of two board-level attributes that are prominently featured in board risk oversight codes, rules, and regulations. The first attribute captures (a) whether board risk oversight responsibilities are formally defined and (b) the location of such risk oversight responsibilities. Location reflects the choice to allocate oversight responsibilities to board committees, the board as a whole, or both. The second attribute of board risk oversight captures the extent to which the Board is actively involved in assessing, monitoring, and communicating the organization’s key risks and risk management strategies.

We first examine the influence of the definition and location of board risk oversight responsibilities on board risk oversight involvement. The issue has been a particularly contentious topic in the corporate governance literature: while some risk oversight advocates call for risk responsibilities to reside with the entire board, others demand board audit committee oversight of risk management processes, and yet another camp prefers firms to assign risk oversight responsibilities to a stand-alone board risk committee. Consistent with calls for formal assignment of oversight responsibilities, we find the lowest board involvement in risk oversight when firms have not formally defined board oversight responsibilities. Risk oversight involvement is significantly greater when responsibilities are defined in board committee charters than when no responsibilities are assigned. However, delegating all board oversight responsibilities to one or more committees is associated with lower board oversight involvement than assigning risk oversight responsibilities to the board as a whole. The highest level of board risk oversight involvement is observed when responsibilities are defined at both the board and committee levels. We find no evidence that the presence of a dedicated risk committee influences the extent of board involvement in risk oversight.

Consistent with board risk oversight playing a substantive role in the development of risk management processes, we find positive associations between the extent of board risk oversight involvement and the maturity of the firm’s risk management processes. Furthermore, we find firms that fail to formally assign responsibilities for board risk oversight have lower risk management maturity. However, conditional on formal assignment, the specific location of risk oversight responsibilities has no significant direct relation with the maturity of the risk management process. Instead, the influence of oversight location on risk maturity is indirect through its significant impact on board oversight involvement. We observe the strongest indirect effects when both the whole board and one or more of its committees are assigned oversight responsibilities. Neither the presence of a dedicated risk committee nor a New York Stock Exchange listing (which requires the board audit committee to review risk management activities) are significantly associated with risk management maturity.

Finally, we examine the effects of board risk oversight involvement and risk management maturity on firm risk. We find risk management maturity negatively related to stock return volatility and tail risk, but no evidence that board risk oversight has a direct effect on these risk measures. Rather, risk oversight involvement has a significant negative indirect effect on firm risk through its influence on risk management maturity. Lower firm risk does not come at the expense of firm performance: Board oversight involvement and risk management maturity are positively associated with future buy-and-hold trading returns.

Our results are consistent with board risk oversight, on average, having a substantive impact on the development of risk management practices and firm risk-taking. Moreover, the analyses suggest a process in which broader and higher-level definition and assignment of risk oversight responsibilities leads to greater board involvement in overseeing risk management activities. Greater board involvement in risk oversight, in turn, promotes the development of more mature risk management processes, leading to decisions that reduce firm risk and improve stock price performance in future periods.

The full paper is available for download here.