Boards and emerging risks (JOA Feb 1, 2020)

Assess emerging risks

"The board should carry out a robust assessment of the company's emerging and principal risks. The board should confirm in the annual report that it has completed this assessment, including a description of its principal risks, what procedures are in place to identify emerging risks, and an explanation of how these are being managed or mitigated. ... Principal risks should include, but are not necessarily limited to, those that could result in events or circumstances that might threaten the company's business model, future performance, solvency or liquidity and reputation. In deciding which risks are principal risks, companies should consider the potential impact and probability of the related events or circumstances, and the timescale over which they may occur" (UK Corporate Governance Code 2018).

ERM reaction: First, strengthen your emerging risks process. Second, include business model risk analysis in the process. This reaction captures the growing pressure on boards over emerging risks and business models. Recent work at the Center for Excellence in ERM at St. John's University's Tobin College of Business reveals that U.S. high-performing companies (as compared to those that are not high performers) are more likely to have an emerging risk process.

Board member reaction: There is no reason not to insist that companies push the dial higher than just doing risk identification, risk assessments, and risk ranking. Insist on an analysis of how the emerging and disruptive risks impact the business model. The future of the business could be at stake.