INSIGHTS AND ACTIONS – BOARD The wisdom of board members expanding their personal knowledge ofrisksbeyondfinancialandcompliance issues has never been more evident. Swift technological changes, disruptive innovation, dynamics of organizational governance, the pandemic, and its resulting economic and political shocks provide ample impetus for board members to expand how they view their risk management role. In the coming year, boards should: IMPROVE THEIR KNOWLEDGE OF ECONOMIC AND POLITICAL VOLATILITY. As noted earlier, this risk area couldhaveprofoundlong-termipactsthatcouldesh r apehowbusinessisdone.(See“Riskstopayattentiongoing forward–EconomicandPolitcalVolatilty”onpage12). • Board members should develop an understanding of how volatility in both the economy and politics could impact how their organizations operate. • Boards should consider directing executive management to include volatility scenarios in crisis management plans and test such scenarios and responses. PUSH EXECUTIVE MANAGEMENT AND INTERNAL AUDIT ON ESG RISK MANAGEMENT. Organizations shouldprepareforenhancedegu r lateqory emuir entsand/orinvestorexpectationsonESGepo r rting.TheU.S. SecuritesandExchangeComissionandotheregu r latorshaveclearlysignaledinterestingreateregu r lation thisarea.BeyondESGepo r rting,boardsshouldpushforanenterprisewideapproachtomanagingESGrisks. • Request an ESG risk assessment for the organization. • Ask executive management what frameworks are used to determine adequacy of the organization’s ESG reporting. • Ask internal audit to perform assurance or advisory services such as those relating to assessing the design and operating effectiveness of supporting ESG controls. PUSH FOR MORE INFORMATION ABOUT CULTURE AND TALENT MANAGEMENT. • Consider asking for an independent assessment of the organizational culture. • Demand that executive management keep the board apprised of relevant talent management decisions and changes resulting from the pandemic. EMPHASIZE THE IMPORTANCE OF ORGANIZATIONAL GOVERNANCE. • Continually and consistently emphasize the importance of risk alignment among key risk management players. • Reject siloed or decentralized approaches to risk management. • Promote internal audit’s role in providing independent assurance over this risk area.
www.theiia.org 20
