It’s difficult to pick up a newspaper or visit a business news Web site without encountering yet more information about the sub-prime mortgage mess—and “mess” is probably too kind a word. With the extraordinary losses and personal pain, terms like “debacle,” “fiasco,” or “disaster” are more accurate. With each new report we learn a bit more about what went wrong and the extent of the consequent suffering.

Before getting to what boards of directors should or shouldn’t have been doing during all this, let’s step back and look at what transpired.

What Was to be Gained

How did we get here? At the risk of oversimplifying the matter, financial institutions saw an opportunity to do some good things:

Write (or otherwise generate) mortgages to less than normally qualified home buyers, anticipating returns sufficient to cover the expected higher default rates;

Package the debt obligations in ways that spread the risk, thereby presumably lowering the risk, and then sell the paper to a range of investors;

Allow those who otherwise would not be able to achieve the American dream of home ownership to do so and to build equity for their families.

And, of course, make some good money in the process.

On the surface, this all sounds pretty good. One can readily see why so many of the country’s and the world’s financial institutions got into the act. Some were initiators, some jumped on the bandwagon as it was rolling along, and some eagerly invested on the other side of the equation.

Cutting to the Core

Now it appears that some regulators and other government officials following the happenings of recent years warned of a coming crisis, and astute investors did indeed see the true risks and stayed on the sidelines.

What did they see? That the players in this process were making several fundamentally flawed and related assumptions: that spreading the risk would lower the risk, the returns would be sufficient to cover the higher default rates, and (most significantly) the housing market would continue to rise in value, forever!

That last point is the key. As long as the price of houses continued to go up, the borrower-home owners could, when down the road the low teaser rates expired, refinance the mortgages, make the new mortgage payments, and maintain home ownership. If not, foreclosures would happen, but because of higher home values, the mortgagee, while inconvenienced, would nonetheless likely recover its investment.

Where We Went Wrong

One root cause of the sub-prime mess is that housing prices did not continue to rise. In many markets, values began to decline. Because some borrowers never had the wherewithal to continue making mortgage payments, the defaults started. And when other mortgagers saw the much higher interest rates on the horizon, they found (surprise!) that they were forbidden by the mortgage terms to refinance without a steep penalty. At any rate, the downward spiral began and has continued.

You know the rest of the story so far. With mounting defaults, and the threat of more, the value of the mortgage-backed paper dropped to the point where the markets for this paper largely dried up.

The pain has been widespread. Some of the most highly respected financial firms and their shareholders are paying a dear price, with the likes of Citigroup, Merrill Lynch, Bear Stearns, and Morgan Stanley all suffering tremendous losses. Some of these esteemed institutions have reported their first quarterly losses in their history, fired their CEOs, and found themselves selling off chunks of their firms to foreign investors. And the announced losses get bigger all the time.

Others suffering serious losses include state pension funds and other investors holding the debt obligation paper, employees who have lost their jobs, and of course, the families losing their homes who are suffering their own nightmares.

Let’s Point Some Fingers

It’s so tempting to point out who’s to blame for this horrible mess, so let’s go ahead and do just that. And there are plenty of fingers to go around.

Management. Managements of the loan generators and sellers should have known better. If these organizations had truly effective risk-management processes, they would have been apprised of the risks involved. (If they did know the risks and decided to roll the dice, then we’ll look below at where the boards were in all this.) I’m sufficiently aware that the kinds of institutions involved here probably have some of the most sophisticated risk-management systems in place. But there’s little doubt that something went terribly wrong.

Mortgage Generators. Those banks, mortgage companies, and others directly involved in making these loans should be ashamed and embarrassed. Making loans to potential home buyers hoping to get a piece of the American dream (let’s put the speculators aside) with terms that locked families into debt they had little chance of keeping current or didn’t understand, is at least unethical; we’ll find out over time whether it was illegal. It seems to be another case of, “I’ll make my money up front, and whatever happens to the other guy is just too bad.” Part of this is the result of institutional processes that reward employees for putting loans on the books with little concern about whether those loans will ever be repaid.

Borrowers. Borrowers must share some of the blame. Those people signing on the dotted line without fully knowing what they were signing can ask themselves why they didn’t take the time and effort to know. On the other hand, those speculating on new condos with ocean or desert views with the intent to flip them for a tidy profit can only, like the mortgage generators, take a long look in the mirror.

Rating Agencies. I’m not intimately familiar with the workings or legal responsibilities of the major rating agencies. But it seems to me that there’s something wrong with a system that gives and keeps an “A” rating on this stuff until the problem not only has surfaced, but the damage has already been done. Didn’t these organizations see what was happening? Should they have? Presumably the answers to these questions will be forthcoming over time.

Regulators. At least one Federal Reserve governor, a senior Treasury official, and other regulators reportedly warned years ago of forthcoming problems and lobbied for action. They were ignored. Now the Fed is putting in place rules to curb some of the most egregious lending practices, but it’s a bit like closing the proverbial barn door after the horse has left. Yes, this may help prevent such abuses from occurring in the future, but I’d rather the regulators look for seeds of where the next debacle might come from.

Insurance Companies. At least two insurance companies guaranteeing this kind of mortgage paper have been forced to raise new capital. One is looking to be bailed out by some of the same financial institutions mentioned above, who now fear the insurance company’s loss of its “A” rating could force the banks to suffer billions more in losses. The fault here seems to rest in basic fundamentals. No less than Warren Buffett (who knows something about insurance) reportedly has described these insurance contracts as financial time bombs, because traders misprice the risk of default without setting aside sufficient reserves to cover the claims.

Others. No doubt there might be other culprits, such as realtors who should have known better, intermediaries in the collateralized debt obligations pipeline, and certainly institutional and other investors who bought into the concept that this paper presented a reasonable risk/return ratio. And last but not least: the boards of directors.

Where Were They?

It’s reasonable to ask whether the boards of these highly esteemed financial institutions failed to carry out their responsibilities. (We’ll focus here on the boards of those companies, although similar questions might also be asked of the boards of investor and other organizations.)

Some of these organizations lacked an effective risk-management system, and senior management wasn’t sufficiently informed of what the risks really were.

We can’t know with certainty whether these boards were deficient unless we were sitting in the boardrooms as deliberations happened, and I wasn’t. That said, we still can speculate on what did or didn’t occur, and I see several viable scenarios. First let’s briefly review what responsibilities boards did have pertaining to these risks (and any other sort of risk). As I’ve written previously, boards need to:

Determine whether management is appropriately identifying, assessing, and managing significant risks the company faces;

Receive sufficient information that appropriate, disciplined processes are in place for this purpose;

Gain comfort that management is bringing the more significant ongoing and newly emerging risks to the boardroom, and that it receives relevant and timely analysis of those risks and management’s actions and planned actions;

Review the risks and risk responses, as well as the company’s risk appetite and portfolio view of risks, and consider whether modifications are needed.

So, we return to the question: Where were the boards of these companies? In my mind, the possible scenarios are as follows:

The company did not have an effective risk-management process in place, and senior management itself was not appropriately apprised of the risks. Under this scenario, the boards couldn’t have been informed of the risks, because management wasn’t aware of them.

An effective risk-management process in place only to the extent that management was aware of the risks, but management didn’t communicate the risks to the board. That is, management withheld important information from the board.

Management knew the risks and communicated them to the board, and the board was comfortable with the company’s risk appetite and didn’t object to continuing down the established path.

Do we know whether or not the boards of these firms appropriately carried out their responsibilities? No, because we weren’t in the boardroom. And the extent of blame depends on what the boards did to gain comfort that an effective risk-management process was in place, that it was receiving relevant information on risks and related actions to manage the risks, and that it was comfortable with the company’s risk appetite and that appetite wasn’t being exceeded. Important here is that the board operates in an oversight and not a management capacity, and to a large extent depends on information management brings to the boardroom.

My guess—and that’s all it is—is that some of these organizations lacked an effective risk-management system, and senior management wasn’t sufficiently informed of what the risks really were. If top management did know, one would think they’d have taken action to better protect the companies’ shareholders, not to mention their own jobs.

I also suspect some of these boards might not have delved as deeply as they should have to ensure that the appropriate risk-management processes, including the communication of key risks and actions to the board level, were in place and fully functional. If those processes and channels were operating effectively, then it comes down to the boards agreeing to what seems to be an extraordinarily high-risk appetite subjecting shareholders to serious loss of share value. I’d like to think that the kinds of individuals on those boards wouldn’t allow that to happen—had they known.

Going Forward

While we don’t know what happened in the boardrooms of these firms, we can look to the future. At this time, we can only hope that boards of directors of all companies will gain the benefit of what happened here. I’m an eternal optimist, and I believe things will get better going forward.