TOP VIEW A multimillion-dollar settlement by former board members at Enron and a lawsuit against former WorldCom directors have prompted many board members to consider their own personal liability for potential malfeasance at, or underperformance of, the companies they serve. Directors are redoubling efforts to unearth and snuff out firm-threatening risks. But some board veterans argue this is the job of management, and that board members cannot be expected to be clairvoyant.

Asking more in most cases means ensuring that risk management and risk-reporting systems unearth serious exposures—be they strategic problems, market risks or, perhaps most perniciously, fraud or other types of malfeasance—before they erupt into firm-crippling events. Only one in five companies recently surveyed by the Conference Board, a New York-based business lobbying group, admitted to having a robust risk management system in place, according to Carolyn Brancato, director of the Conference Board’s Global Governance Research Center. This is partially because risk management is not a term that is easily applied to corporations. Financial institutions, whose main exposures are to easily quantifiable factors such as the prices of securities and probabilities of default, have built elaborate systems that measure those exposures, along with the tools to manage them.

An Elusive Target
But, while market prices certainly affect the performance of nonfinancial corporations (think of the airline industry’s exposure to the price of oil, for example), often the most toxic problems they face fall under the hazy rubric of business risk. This is the catch-all category covering the reasons some companies underperform in their core businesses, falling inexorably behind competitors and eventually failing. These range from manager incompetence to changes in consumer appetite for a key product. They are usually impossible to hedge.