Are you in compliance?

Don't miss out! Sign up today for our weekly newsletters and stay abreast of important GRC-related information and news.

Get updates on Compliance Week offerings, including new features, databases, research, and other resources, along with announcements of upcoming Webcasts, conferences, seminars, CPE/CLE opportunities and more.

Published every Thursday, Compliance Week Europe offers a condensed summary of risk, audit, and compliance news either originating in Europe, or of special interest to European compliance professionals. This newsletter will follow developments by the European Commission, as well as those of national governments across the region, or any U.S.-based news that might have consequence across the Atlantic. Frequency: weekly; Thursday a.m.

A fresh edition of Compliance Week delivered via e-mail and online every Tuesday morning, relentlessly focused on the disclosure, reporting and compliance requirements of our 25,000+ paying subscribers.

Published every Friday, Compliance Weekend was launched at the behest of subscribers, and offers a quick Plain English review of the week's key developments. We hope you enjoy this supplement to Compliance Week's Tuesday edition.

The Risks of Poor Risk Management

Matt Kelly | August 29, 2011

Two ill winds blew through Washington last week. Both left me uneasy about the precarious state of risk assessment and management in this country, which has already been buffeted so much by recession and disruption. Let me start with the less dangerous of the two: Hurricane Irene.

Irene has left me stranded in Sacramento, Calif., 3,000 miles from my home in Boston. Until I fly home later this week, I am spending my time traveling around California's famed Central Valley—famed mostly as Ground Zero in the foreclosure crisis that has crippled the U.S. economy since 2008. I regret to inform you that little has changed here.

Everywhere you go here, you see a "For Sale" or "For Rent" sign. They line the highways crowded in by huge swaths of tract housing; they line the sidewalks crowded by house after house with a tiny front lawn and a sign staked into the ground. They hang from windows in each town's central business district—except for Sacramento itself, which is so crammed with vacant storefronts downtown that even the signs are gone.

I am staying in one of the more upscale suburbs of Sacramento, and still I see people hosting yard sales at odd times, like a Thursday afternoon when potential buyers should be at work. After seeing the third or fourth yard sale in a two-mile stretch, I asked one of my hosts: Is that because they're facing foreclosure and need to get out of the house quickly? "Oh, probably," she said. "That still happens all the time here."

My hosts would know, because it's happening to them too. They had lived in a condo in Sacramento, but went into foreclosure last year when one of them lost a job. Now the bank dutifully sends monthly notices that it will foreclose on the property unless they pay off past-due balances of $45,000. My hosts throw those letters away. Why wouldn't they? The bank has been threatening foreclosure for nearly a year without taking any real action; it has too many other properties to worry about first. Their old neighbors trying to sell their condo, too, listing it at $349,000. In 2007 those neighbors bought the house for $445,000.

All of this and more—I haven't even talked about unemployment here, or the jobless men suffering from depression, or the state government tax crisis—comes from poor risk management. The banking and mortgage industries did not properly assess the risks of giving out mortgages, sub-prime or otherwise, to anyone with a pulse and the notion that he or she should own a 3,000-square-foot home. But then, why would they? Businesses involved in the mortgage industry are just businesses, after all, and their imperative is to mitigate the risk directly in front of them—usually by passing it on to someone else. That's exactly what the private sector did here in the 2000s.

The real travesty was the failure of government to regulate that entire system of mitigating risk by passing it along to someone else. The system itself was a risk, to the economy at large; that's what systemic risk is. But rather than address that flaw in our economy, regulators (federal, state and local) allowed short-term gain at the expense of long-term prosperity. That's how the Central Valley came to be how it is today.

All this brings me to the other ill wind blowing through Washington last week: a coordinated assault on all manner of corporate regulation, largely to help businesses achieve short-term gain, long-term prosperity be damned.

The incipient event happened July 22, when a federal appeals court in Washington, D.C., invalidated the shareholder proxy access rule adopted by the Securities and Exchange Commission last year. That has sparked a full-throated cry from lobbyists for Corporate America and their lackeys in Congress to rescind or revise pretty much any regulation you can find. First up, of course, were various regulations from the Dodd-Frank Act. Now even that venerated compliance pain in the neck, the Foreign Corrupt Practices Act, is in the sights of the U.S. Chamber of Commerce.

What really disturbs me, however, are calls for all new regulations (and many existing ones) to be quantified somehow, either in cost to implement compliance, cost of jobs not created, or some other metric. Cost-benefit analysis, and the alleged lack thereof from the SEC, was at the heart of why the federal appeals court invalidated shareholder proxy access. Rep. Darrell Issa, R-Calif. and chairman of the House Government Oversight Committee, at the start of this year asked businesses to submit their nominations for unnecessary, job-killing regulations. We'll hear much more of this theme, that all regulations carry a compliance cost and therefore hurt prosperity, in coming months.

My question to Congressman Issa is this: When he asks about the jobs destroyed by new regulatory regimes like the Consumer Financial Protection Bureau, does he also calculate the jobs destroyed by the lack of effective regulation as well? Does he include the lost tax revenue to local communities in California, or the unemployment benefits paid to millions of ex-construction and finance workers, or the money unspent by consumers saving more because their homes are worth less?

Of course not. Issa, like most congressman, Democrat and Republican alike, is in the thrall of moneyed interests that want to achieve short-term gain for shareholders. But risk is a lot like water: If you force it down in one place, it will simply turn up somewhere else. You need to drain the whole swamp to get rid of it permanently. That's expensive and time consuming—and is also the only way to stay dry for good. Forward-thinking regulation to prevent risk-taking from spiraling out of control is every bit as necessary as access to capital and low tax rates.

That fact, I fear, eludes too many people in Washington. It has caught up with everyone here in California.