Corporate board members are devoting more time to enterprise risk management these days and taking a more aggressive approach to make headway on the sometimes-elusive goal, according to a new survey.

The poll of 802 board members (and 235 general counsels asked about the same subjects) indicates that 45 percent of directors and 48 percent of general counsels devoted more time to ERM in 2006 than in previous years. Topping the list of risks to manage were corporate governance changes and mergers and acquisitions.

That governance risks are foremost on boards’ minds these days should come as no surprise, notes Roger Carlile, senior managing director at FTI Consulting, which conducted the survey along with Corporate Board Member magazine. All the issues typically grouped under that umbrella, he says, from Sarbanes-Oxley compliance to financial reporting to violations of the Foreign Corrupt Practices Act, are what boards have had to grapple with for five years.

Carlile

“I think what we’re seeing is a response to having dealt with emergency or crisis situations,” says Carlile. “The risks are fresh, which causes people to want to focus on those risks in advance to prevent them in the first place or to lessen the impact.”

Corporate governance is “constantly evolving, though not at the same pace as five years ago,” Carlile continues. “People are still sort of catching up. There are still refinements, regulators are still adjusting their focus.”

While he says boards “are getting better and better at” dealing with risk at the enterprise level, he says, “I think we still have a way to go before boards are fully on top of the issue.”

Similarly, Thomas Wardell, a partner in the law firm McKenna Long & Aldridge and head of the firm’s corporate practice, says “companies are all over the map” when it comes to their ERM efforts. “ERM is a topic every board has addressed, but they’ve all dealt with it in different ways,” he says. “People have only begun to get a handle on it.”

Wardell

Wardell says a common scenario he sees is people “doing quite a good job identifying and managing risks within particular operating segments or geographic units, but haven’t yet stitched them together very effectively so people at the top of the organization have a good picture of what’s going on.”

Indeed, the FTI-Board Member survey highlighted a few instances where general counsels and board members differ on how serious a risk is. For example, half of the directors surveyed said e-discovery is a “significant issue” for the company to address; only 34 percent of general counsels felt that way. And nearly 80 percent of directors said they expect the board to use outside counsel in 2007, while only 56 percent of general counsels believed their boards would do so.

T.K. Kerstetter, chief executive of Board Member Inc., which publishes Corporate Board Member, calls ERM “the biggest challenge facing boards today … plenty of companies have gotten in a jam over risk issues.”

Moving on ERM

Baker

Andrew Baker, a partner in the law firm Baker Botts, notes that board members are working harder generally these days, whether it’s on ERM or anything else. The best boards, he says, “are trying to get to the point where they transcend their checklist and get to meaningful discussions of the risks that led those items to be on their lists.”

He sees boards no longer taking “a crisis management approach to ERM.” Rather, they want to take the initiative against risks before a crisis hits, asking, “What should we be thinking about: low-level risks [that] happen all of the time or more impacting risks?’”

The focus on governance risk shows boards “are very sensitive to doing the right thing,” says Baker. Corporate governance is “ultimately trying to produce good decision making.”

“Boards are spending a lot of time thinking about whether they’re making decisions in the best way, whether they’re getting the right advice, whether they’re considering all the issues,” he says. “Boards that aren’t paying attention to good corporate governance are vulnerable to inferior corporate decision making.”

ERM QUESTIONS

Which risk areas do you feel your company most needs to work to understand?

Directors

General Counsels

M&A Risk

32%

33%

Governance changes

41%

35%

HR Risks

13%

21%

Shareholder Litigation

14%

11%

Source

FTI Consulting

Roughly one-third of both board members and general counsels in the survey reported that understanding M&A risk should be their company’s highest ERM priority. That’s not surprising, given the litigation risk associated with such transactions, Kerstetter says. “With shareholders watching over transactions like hawks, it’s one of the most important issues for the board,” he says.

Kerstetter

And since private equity buyouts have surged to nosebleed levels, Kerstetter adds, “The risk of buying other people’s problems has led to a ton more due diligence.”

Baker agrees. “Companies have come to realize that you can buy yourself into a big problem. The increased diligence process in M&A deals reflects the fact that boards expect no surprises,” he says.

For example, says Baker, in the area of cross-border acquisitions (“where a lot of action is these days”) companies have become attentive to the risk of acquiring problems in connection with the FCPA, which prohibits bribery of overseas officials to win business.

In addition, since officers of the acquiring companies are responsible for certifying the adequacy of internal controls, he says, “There’s a great deal of emphasis on accounting due diligence and financial disclosure due diligence.”