As former SEC Chairman and Compliance Week Columnist Harvey Pitt wrote in these pages back in June 2004: “Management’s most important job is identifying, assessing, and managing risk.” Unfortunately, that is easier said than done, especially when it comes to communicating that risk to the board. In fact, as Pitt pointed out, management regularly fails to communicate risks to directors on a timely basis, “imperiling the value of a company’s securities and ensuring embarrassment (or worse) when inevitable crises occur for which the company is unprepared.”
The failure of management to achieve what is fundamentally its most important job is partially due to the fact that the challenge is massive and three-fold. First, a company must thoroughly understand and prioritize the risks that the company faces—an oversimplified description of an extraordinarily complicated and ongoing process. Second, it must put in place structures to address these risks—both controls to prevent and detect undesirable events, as well as incentives to inspire those events that are desired. Finally, and the focus of this article, a company must be able to capture and analyze relevant indicators in almost real time, resolving or elevating incidents as necessary and making improvements as insights are gained into the organization and its related processes.
