CG Board
CG Board
– The cornerstone
1
What is Corporate Governance?
2
Corporate Governance - Definition
• the system by which business corporations are directed and
controlled
• specifies the distribution of rights and responsibilities among
different participants in the corporation, such as the board,
managers, shareholders and other stakeholders
• spells out the rules and procedures for making decisions on
corporate affairs
• provides the structure through which the company objectives
are set, and the means of attaining those objectives and
monitoring performance
(Source: OECD April 1999)
3
The OECD Principles of
Corporate Governance
1. Ensuring the basis for an effective corporate governance framework
2. The rights of shareholders and key ownership functions
3. The equitable treatment of shareholders
4. The role of stakeholders in corporate governance
5. Disclosure and transparency
6. The responsibilities of the board
- The corporate governance framework should ensure the strategic
guidance of the company, the effective monitoring of management by
the board, and the board’s accountability to the company and the
shareholders.
4
IFC – Russia Corporate
Governance Manual
• Corporate Governance is a system of relationships, defined by
structures and process. [Shareholders – Management]
• These relationships may involve parties with different and sometimes
contrasting interests.
• All parties are involved in the direction and control of the company
• All this is done to properly distribute rights and responsibilities – and
thus increase long term shareholder value.
Definitions
• “Corporate governance deals with the ways in
which suppliers of finance to corporations
assure themselves of getting a return on their
investment”, The Journal of Finance, Shleifer
and Vishny [1997, page 737].
Other Definitions
• "Corporate governance is about promoting corporate fairness,
transparency and accountability" J. Wolfensohn, president of the Word
bank, as quoted by an article in Financial Times, June 21, 1999.
• “The directors of companies, being managers of other people's money
than their own, it cannot well be expected that they should watch over
it with the same anxious vigilance with which the partners in a private
co-partnery frequently watch over their own.” Adam Smith, The
Wealth of Nations 1776
Corporate Governance System
Corporate Governance
Basics of Corporate Governance
• By issuing corporate securities, firms sell claims to control the
companies` resources
– The interests of the various security holders differ
– Separation of ownership and control implies agency relationships.
– Interests of agents (management) are different from those of security
holders, particularly from those of stockholders.
– Monitoring the activities of agents is costly - hence, full monitoring is not
optimal.
– The value forgone due to imperfect optimal monitoring is an explicit
agency cost.
Four core values of the OECD corporate
governance framework
• Fairness: The corporate governance framework should
protect shareholder rights and ensure the equitable treatment
of all shareholders, including minority and foreign
shareholders.
• Responsibility: The corporate governance framework should
recognize the rights of stakeholders as established by law,
and encourage active co-operation between corporations and
stakeholders in creating wealth, jobs, and the sustainability
of financially sound enterprises.
OECD Core Values
• Transparency: The corporate governance framework should
ensure that timely and accurate disclosure is made on all
material matters regarding the company, including its
financial situation, performance, ownership, and governance
structure.
• Accountability: The corporate governance framework
should ensure the strategic guidance of the company, the
effective monitoring of management by the board, and the
board’s accountability to the company and shareholders.
Business Case for Corporate
Governance
• Well governed companies have lower cost of
capital
• Reduction of risks
• Higher valuation of human capital in
companies that are well governed
• Higher share valuation
Business Case
Corporate Governance
• Promote the efficient use of scarce resources
• Promote the trust of investors
• Good corporate governance has a positive link
to economic development and good corporate
performance
• Funds will flow to entities which are seen to
have internationally accepted standards of
corporate governance
15
Reasons for recent Interest in
Corporate Governance
16
Reasons for recent Interest in
Corporate Governance
• Governance mechanisms sometimes fail to
adequately monitor and control top-level
managers’ strategic decisions.
• If the behavior of top-level mangers is not
monitored and controlled effectively, this
could mean that the firm will not be
strategically competitive
Reasons for recent Interest in
Corporate Governance
• Effective corporate governance is also of
interest to nations.
• A country prospers as its firms grow and
provide employment, wealth, and satisfaction
—thus improving standards of living. These
aspirations are met when firms are competitive
internationally in a sustained way.
Reasons for recent Interest in
Corporate Governance
• Corporate governance reflects the standards of the
company, which collectively reflect societal
standards.
• Thus, in many corporations, shareholders attempt
to hold top-level managers more accountable for
their decisions and the results they generate.
• As with individual firms and their boards, nations
that govern their corporations effectively may
gain a competitive advantage over rival countries.
Reasons for recent Interest in
Corporate Governance
• to preserve public interest and restore trust and
corporate integrity.
Reasons for recent Interest in
Corporate Governance
• Becht et al. (2002) identified five reasons why
corporate governance became so prominent in
the past two decades:
• i) the world-wide privatisation wave
• ii) pension fund reform and growth of private
savings
• iii) the takeover wave of the 80s
• iv) deregulation and integration of capital
markets
• v) crises.
Reasons for recent Interest in
Corporate Governance
• Take-overs are a more important influence on
the corporate governance landscape of the
Anglo-US economies than elsewhere
• Franks and Mayer (1990), for example,
document that in the UK there were
approximately double the number of take-
overs as there are in France or Germany
Takeovers
• hostile bids are commonplace in the US and UK
• The hostile takeover wave in the US in the 1980s and in
Europe in the 1990s in addition to the recent merger wave (eg
AOL-Time Warner, DaimlerChrysler, or Acelor-Mittal Steel
recently) has influenced the public debate on corporate
governance.
• The 200 billion dollar cross-boarder hostile bid of Vodafone
for Mannesmann in 2000 was the largest ever to take place in
Europe.
• This takeover together with the recent hostile takeovers in
Italy (Olivetti for Telecom Italia) and in France (BNP-Paribas)
have changed the corporate world in Continental Europe.
• Since these events takeover regulations are political agendas
of the European Union (EU)
Deregulation and capital market
integration
• The greater integration of world capital markets
through the introduction of the Euro and mergers
of stock markets (Euronext and the endless
merger rumours for London Stock Exchange) and
the growth in equity capital throughout the 1990s
increased the interest in corporate governance in
the last few years.
• In addition, increasingly fast growing
corporations in Europe have been raising capital
from different sources by cross listing on multiple
exchanges
Corporate Scandals
• cases of corporate fraud and scandals around
the world.
Examples include:
• Enron corporation – which engaged mainly in
aggressive and creative accounting
• Cadbury Nigeria (2006) – involving
corruption, lack of transparency leading to the
company’s shares dropping by more than 26%
and a financial loss of $15million in that year
Examples
• Some of the more prominent and sensational
ones include:
• WorldCom Inc, in which the management
improperly capitalised expenditures instead of
expensing them
• the near collapse and suspension of China
Aviation Oil (CAO, “The Company”) as a
result of the huge debts it incurred in
speculative oil trading
Examples
• Tyco International, where top executives were
charged for their roles in fraudulent actions
against the company
• the imprisonment of former chief executive of
Accord Customer Care Solutions, Victor Tan,
for bribery and corporate fraud
• revelation of improper business practices and
disclosure standards adopted by Citiraya
Corporate Scandals
• There has been active interest in the corporate
governance practices of modern corporations,
particularly in relation to accountability since the
high profile collapse of a number of large
corporations during 2001 - 2002 most of which
involved accounting fraud
Investors’ expectations
• Directors, owners and corporate managers have
started to realize that there are benefits that can
accrue from having a good corporate governance
structure.
• Good corporate governance helps to increase
share price and makes it easier to obtain capital.
• International investors are hesitant to lend money
or buy shares in a corporation that does not
subscribe to good corporate governance principles
Investors’ expectations
• Transparency, independent directors and a
separate audit committee are especially
important.
• Some international investors will not seriously
consider investing in a company that does not
have these things.
Corporate Governance
• Investors are not willing to invest in
countries/companies that are corrupt, prone to fraud,
poorly managed and lacking sufficient protection for
investors’ rights
• Securities and company law protection may help, but
not enough
• Corporate Governance supplements the legal
framework
31
Corporate Governance
• Corporate Governance also plays an important
role in maintaining corporate integrity and
managing the risk of corporate fraud,
combating against management misconduct
and corruption
32
Recent Corporate Failures
• Enron Corporation
• Worldcom
• Parmalat
• GlobalCrossing
• Aledphia
Even more recent failure related to risk in the
market
• Fannie Mae & Freddie Mac
• BearSterns
• Meryl Lynch
• AIG
• Lehman Brothers
Corporate Governance in practice
35
Board of Directors
• Assume responsibility of leadership and
control of the corporate
• Direct and supervise the corporate’s affairs
• Make decisions in the interests of the
corporate
36
Board of Directors
• Regular meetings
• Active participation
• Freedom to include items in agenda
• Sufficient notice for board meetings
• Access to advice and services of company
secretary and independent professional advice
37
Board of Directors
• Full record of board/committee minutes, and
available for inspection
• Independent non-executive directors should be
present at board meetings to discuss matter
involving conflict of interest
• Abstain from voting if conflict of interest
exists
• Insurance coverage in respect of legal action
against directors
38
Chairman and CEO
• Separation of Chairman and CEO
• Division of responsibilities between Chairman
and CEO clearly laid down in writing
39
Chairman and CEO
• Segregation of the management of the board
and the day-to-day management of the
corporate’s business
• Balance of power at board level to avoid
concentration of power in a single individual
40
Chairman
• Provide leadership for the board
• Ensure the board works effectively and
discharges its responsibilities
• Ensure good corporate governance practices
and procedures are in place
• Ensure all directors are properly briefed on
issues arising at board meeting
• Responsible for ensuring appropriate
information received by directors
41
Chairman
• Encourage full and active contribution to the
board’s affair
• Ensure effective communication between
board and the shareholders
• Hold annual meetings with non-executive
directors
• Ensure constructive relationships between
executive and non-executive directors
42
Board Composition
• Balance of skills and experiences
• Balanced composition of executive and non-
executive directors
• Non-executive directors should be of sufficient
calibre
• Independent non-executive directors should be
expressly identified
• List of directors updated and their respective
role and function identified
43
Appointment, re-election and
removal of directors
• Formal and transparent procedure for
appointment
• Succession plan
• Re-election at regular intervals
• Proper explanation for resignation/removal of
directors
44
Appointment, re-election and
removal of directors
• Specific term for non-executive directors
• All directors subject to retirement by rotation
at regular interval
• Nomination committee formed to make
recommendation on appointment of directors
and succession planning for directors,
chairman and CEO
45
Responsibilities of directors
• Keep abreast of the responsibilities as a director
• Exercise duties of care, skill, integrity and diligence
expected
• Ensure proper understanding of the operation,
business and the regulatory requirement
• Contribute sufficient time and resources to serve the
corporate
• Attend AGMs to share the views of shareholders
46
Non-executive directors
• Active participation in board meetings
• Bring in independent judgment
• Take lead if conflict of interest arise
• Serve on committees
• Monitor the corporate’s performance in
achieving pre-set goals
47
Information access by directors
Directors should be provided with accurate
and appropriate information in order to make
informed decision and to discharge their
responsibilities
48
Information access by directors
• Agenda and board papers should be sent in full
in a timely manner to directors
• Information supplied must be complete and
reliable
• Directors should have access to the senior
management for information
• Information supplied should be of form and
quality to facilitate informed decision
49
Remuneration of directors and
senior management
• Transparency of directors’ remuneration
policy
• Remuneration should be sufficient but not
excessive
• Each director not to involve in deciding his/her
own remuneration
50
Remuneration Committee
• Remuneration committee to be formed, mainly from
non-executive directors
• Consult Chairman/CEO if needed
• Access to professional advice, market comparable
information
• Make recommendation on policy and structure of
remuneration
• Determine specific remuneration packages of all
executive directors and senior management
51
Remuneration Committee
• Review and approve performance-based
remuneration
• Review and approve compensation
arrangement in connection with loss or
termination of office, dismissal or removal of
directors for misconduct
52
Accountability and Audit
– Financial Reporting
• Management provide explanation and information to
the board to enable them to make informed
assessment of financial and other information
• The board should present comprehensive assessment
of the corporate’s performance, position and
prospects in annual and interim reports, price-
sensitive announcements and other financial
disclosures
53
Accountability and Audit
– Internal Control
• Ensure the maintenance of sound and effective
internal controls to safeguard assets
• Conduct regular reviews of the effectiveness
of the internal control system, covering
financial, operational, compliance and risk
management control functions
• Prevent fraud, corruption, and malpractices
54
Audit Committee
• Have clear terms of reference
• A formal and transparent arrangement to apply
the financial reporting and internal control
principles and maintain appropriate
relationship with external auditors
55
Audit Committee
• Full minutes of audit committee to be kept
• Provided with sufficient resources to discharge
its duties
• Independent from external auditors
56
Audit Committee
• Make recommendation for appointment and
removal of external auditors
• Monitor the effectiveness of the audit process,
ensuring auditor’s independence and
objectivity
• Monitor the integrity of the financial
disclosures
• Oversight of the financial reporting and
internal control procedures
57
The audit committee’s main responsibilities
60
Delegation by the Board
• Clear directions to the delegation of the
management and administration functions as
well as the powers of management
• Review the arrangement for segregation of
duties between board and management
regularly
• Board Committee to be formed, with specific
terms of reference, as needed
61
Communication with Shareholders
- Effective communication
• Maintain on-going dialogue with shareholders
and make use of annual general meetings or
other general meetings to communicate with
shareholders
• Transparency in corporate governance
practices and business performances through
proper and adequate disclosures
• Encourage shareholders’ participation
62
Communication with Shareholders
- Effective communication
• Separate resolution for each separate issue
• Chairman of the board and chairman of each board
committees be present in general meetings to answer
questions at any general meeting
• Chairman of independent board committee be present
to answer any questions in any general meeting to
approve transaction requiring independent
shareholders’ approval
63
Communication with Shareholders
- Voting by Poll
• Inform shareholders about procedure for
voting by poll
• Ensure proper compliance to regulatory
requirement about voting by poll
64
Functions of the board
Governance
O
O O
O O
O - executive directors
Management
Majority – executive board
Governance
N
N
N O
O
O O
O - executive directors
N – non executive
Management
directors
Two – tier board
Governance N N N
N N
N N
N N
O - executive directors
O
N – non executive O O
Management
directors
O O
Majority – non-executive board
Governance
N
N
N
N
N O
O O
O - executive directors
N – non executive
Management
directors
The Effective Board
• Clear strategy aligned to capabilities
• Vigorous implementation of strategy
• Key performance drivers monitored
• Effective risk management
• Sharp focus on views of the capital market and
other key stakeholders
• Regular evaluation of board performance
What does the market look for in a board
member?
• Asks the difficult questions
• Works well with others
• Has industry awareness
• Provides valuable input
• Is available when needed
• Is alert and inquisitive
What does the market look for in a board
member?
• Has business knowledge
• Contributes to committee work
• Attends meetings
• Speaks out appropriately at board meetings
• Prepares for meetings
• Makes long-range planning contribution
• Provides overall contribution
The distinction between
Governance and Management
Governance is Different from
Management
Governance
Management
Governance and Management
• Management runs the business
• the board ensures that the business is well run
and run in the right direction
GOVERNANCE VS
MANAGEMENT
• "Governance" as represented by the board of
directors involves the strategic task of setting
the organisation's goals, direction, limitations
and accountability frameworks.
• "Management" represented by managers
involves the allocation of resources and
overseeing the day-to-day operations of the
organisation.
GOVERNANCE VS
MANAGEMENT
One way to think about this is that:
• Governance determines the "What?" - what the
organisation does and what it should become
in the future.
• Management determines the "How?" - how the
organisation will reach those goals and
aspirations.
GOVERNANCE VS
MANAGEMENT
• The single most important feature of good
governance is a clear segregation of the
responsibilities and accountabilities of the
board from those of the management.
• The board's job is to oversee management, not
to manage
The distinction between governance
and management
• Governance refers to representing the will or
interests of a group of people.
• That group being the owners or shareholders.
• Nonprofits - The citizens, who provide tax
breaks, are one class of owners, but members,
or people who care about the mission of the
organization is another class of owners.
Governance
• The governance represents those owners and
directs the management to achieve particular
results that are desired by the owners.
• The governance body also oversees the
management to ensure that the organization is
achieving the desired outcomes and to ensure
that the organization is acting prudently,
legally, and ethically.
Organisational Chart
SHAREHOLDERS
BOARD OF
DIRECTORS /
Governing Body
MANAGEMENT
Management
• Management makes operational decisions and
policies
• keeps the board educated and informed
• brings to the board well-documented
recommendations and information to
support its policy-making, decision making
and oversight responsibilities.
Functions of Governance
Strategic direction
• Exercising effective leadership that optimizes
1. the use of the financial, human, social, and
technological resources of the organisation.
2. Establishing a vision or a mission for the
organisation
3. Reviewing and approving strategic documents
4. Establishing operational policies and guidelines.
5. Continually monitoring the effectiveness of the
organisation’s governance arrangements and
making changes as needed.
Management oversight
• Monitoring managerial performance and
implementation of policies, appointing key personnel,
approving annual budgets and business plans, and
overseeing major capital expenditures.
• Promoting high performance and efficient processes
by establishing an appropriate balance between
control by the governing body and entrepreneurship
by the management body.
• Monitoring compliance with all applicable state laws
and regulations, and with the regulations and
procedures of stakeholder organizations, as the case
may be
Stakeholder participation
• Establishing policies for inclusion of
stakeholders in the organisation’s activities.
• Ensuring adequate consultation,
communication, transparency, and disclosure
in relation to stakeholders that are not
represented on the governing body
Risk management
• Establishing a policy for managing risks
and monitoring the implementation of the
policy.
• Ensuring that the volume of financial
resources is commensurate with the
organisation’s needs and that the sources of
finance are adequately diversified to mitigate
financial shocks
Conflict management
• Monitoring and managing the potential
conflicts of interest of members of the
governing body and staff of the management
team.
• Monitoring and managing conflicting interests
among the organisation’s stakeholders
especially those that arise during the process
of implementation of various organisation’s
activities / projects.
Audit and evaluation
• Ensuring the integrity of the organisation’s
accounting and financial reporting systems,
including independent audits.
• Setting evaluation policy, commissioning
evaluations in a timely way, and overseeing
management uptake and implementation of
accepted recommendations.
• Ensuring that evaluations lead to learning and
continued development of the organisation.
INGREDIENTS FOR
GOOD CORPORATE
GOVERNANCE
Basic elements of Good Governance
• Accountability – being answerable for decisions and having
meaningful mechanisms in place to ensure that all applicable
standards are adhered to
• Transparency/openness – having clear roles and
responsibilities and clear procedures for making decisions and
exercising power
• Integrity – acting impartially, ethically and in the interests of
the organisation, and not misusing information acquired
through a position of trust
• Stewardship –(the careful and responsible management of
something entrusted to one's care) - using every opportunity to
enhance the value of the organisation’s assets and institutions
that have been entrusted to one’s care
• Efficiency – ensuring the best use of resources to further the
aims of the organisation
• Leadership – achieving an organisation-wide commitment to
good governance through leadership from the top.
Corporate Governance
AND
91
MODELS
92
Models of corporate governance
Five broad systems of corporate governance:
The American rule-based mode
The United Kingdom/Commonwealth principles-
based model
The Continental European two-tier model,
The Japanese stakeholder-orientated network
model
The Asian family-based model
The American rule-based model
103
Contract Theory of Corporate Governance
Managers
(Agents)
which creates
Decision
Makers
Agency relationship
112
Agency Theory
Owner Entrepreneur
PRIVATE
COMPANY
SHAREHOLDERS
PUBLIC
COMPANY
MANAGEMENT
COMPANY SHAREHOLDERS
BOARD OF
DIRECTORS
Board Delegates Power to Management
MANAGEMENT
Board Customers
Agent
Employees
Suppliers
Organizational Behavior
Henry Tosi
Prof. Henry Tosi - University of Florida
Psychological and organizational perspectives
Stakeholder Theory
• In agency theory, maintenance or enhancement of
shareholder value is paramount
• Stakeholder theory-argues that the corporation
should include the interests of other stakeholders and
not shareholders only.
• Here, in the stakeholder theory we take into account
a wider group of people:
•shareholders, employees, providers of credit, customers, suppliers,
government, local community
– Should we favor shareholders over other stakeholders?
Stakeholder model of
Corporate Governance
( Freeman, (1984),
ed Crane, A et al, 2008 P114)
Stakeholders theory, is based upon the premise that organisations should be responsible to a
wider range of stakeholders, than the narrow interests of one group. (Cornforth, 2007)
Continue ………..
• Stakeholders will make firm-specific investments in the
corporation.
• Taking the interests of stakeholders into account will
generate more wealth for the organisation.
• CRITICISM
• Managers are told to serve two masters(equity holders
and the community).
• Profit maximisation faces challenges thus corporate
wealth is reduced.
• It becomes very complicated to balance the interests of
all stakeholders.
Basic Points of Transaction Cost Perspective
• Organisations: series of transactions, some
within the Org, some across the Org’s boundaries
Transaction: exchange of goods and services among
groups within the Org. or across organisational
boundaries
Transaction Costs: explicit fees or costs associated
with a transaction; implicit costs of monitoring and
controlling a transaction
Goal: to determine the most efficient arrangement of transactions
— whether transactions should take place inside the Org or across
Organisational boundaries; seek lowest transaction costs.
Transaction Cost as Problem to Remedy
Organisational economists use the term “cost”
to refer to a wide range of problems that
owners must remedy in order to create an
organization that allows for wealth
maximization
Types of Transaction Costs
Bounded Rationality Asset specificity
Opportunism Small Numbers
Information Asymmetry
1- Bounded Rationality
Owners and managers unable to process all of
the available information, and face uncertainty
in transactions or contract relationships
Stewardship theory Owners and managers have Partner Improving Management proposals and
similar interests (Chosen for Performance: systems may not be given
expertise) - add value to top adequate scrutiny.
decisions/strategy
- partner
management
Stakeholder theory Different stakeholder have ‘Represent’ Political: Board members may promote
legitimate but different different - represent and stakeholder interests rather
interests in the balance different than the organisation’s. May
stakeholder
organisation. stakeholder be difficult to agree
views interests objectives.
- make policy
- control executive
Resource dependency theory Organisational survival Supporter External influence: External focus of board
depends on maintaining (Chosen for - secure resources members may mean internal
coalition of support to influence or - improve supervision is neglected.
obtain resources and resources they stakeholder Board members may lack
legitimacy may bring.) relations expertise.
- bring external
perspective
Managerial hegemony theory Owners and managers have Symbolic Legitimacy: Management may pursue own
different interests, but -ratify decisions interests at expense of
managers control main -support ‘owners’, managers gain little
levers of power. management of value from board.
-give legitimacy
Theoretical Perspectives: CG and Board Role
Source: Adapted from Corbet and Mayer (1991); Charkham 1992; Ebster-Grusz and Pugh 1992; and Nunnenkamp (1995)
Theoretical Perspectives: Origin, Analysis, Focus
FOCUS
Source: Adapted from Corbet and Mayer (1991); Charkham 1992; Ebster-Grusz and Pugh 1992; and Nunnenkamp (1995) Stiles and Taylor 2002
Theoretical Perspectives: Origin
Self- Focus on Ensure the Reduce Defines firms The board Perpetuate
interested governance Stewardship uncertainty; as inclusive as elite and
utility needs of of corporate boundary multilateral a ‘legal class
maximizing exchange assets spanning; agreements fiction’; power;
motivation relations highlights the between the Managerial Corporations
of No inherent Interdependence enterprise control as
individual conflict of of firms and multiple exploitative
Interest rather than Need to vehicle for
actors Stakeholders
between understand Accumulation
Managers/
viewing them
Concerned the of wealth
Ensure
with owners, and simply in term
match relationship and
mechanisms that optimum terms of These relation-
Between
Between governance management ships constrain power
which owners,
managers structures and create the
(‘agents’)
reduce costs intentions Managers
associated allow strategic
and and
with coordination possibilities of
shareholders. Connecting firm The board of
contractual of the the company.
(‘principals’) with external Directors
hazards enterprise to
resources help
be achieved
to reduce
uncertainty
Source: Adapted from Corbet and Mayer (1991); Charkham 1992; Ebster-Grusz and Pugh 1992; and Nunnenkamp (1995)
Shareholder Theory
• Argues for the primacy of shareholders
• Argues that the duty of corporate director is to
maximize shareholder value
• Shareholders (unlike other stakeholders) have
the greatest incentive to ensure profit
maximisation.
• This goal will benefit the whole organisation
and other stakeholders.
Continue ……………
• Balancing other stakeholders’ interests could
be costly o the corporate
148
Risk Categorization – Approach
#2
• Known risks
– Those risks that can be uncovered after careful evaluation of the project plan,
the business and technical environment in which the project is being
developed, and other reliable information sources (e.g., unrealistic delivery
date)
• Predictable risks
– Those risks that are extrapolated from past project experience (e.g., past
turnover)
• Unpredictable risks
– Those risks that can and do occur, but are extremely difficult to identify in
advance
149
What is Risk Management?
Risk - The possibility of financial loss
Management - The business function used to plan,
organize, and control all available resources to reach
company goals
Risk Management - The systematic process of
managing an organization’s risk exposure to achieve
objectives in a manner consistent with public interest,
human safety, environmental factors, and the law.
Risk Management Cycle
What is Risk Analysis?
• The process of identifying, assessing, and
reducing risks to an acceptable level
– Defines and controls threats and vulnerabilities
– Implements risk reduction measures
• An analytic discipline with three parts:
– Risk assessment: determine what the risks are
– Risk management: evaluating alternatives for
mitigating the risk
– Risk communication: presenting this material in an
understandable way to decision makers and/or the
public
Slide #152
Benefits of Risk Analysis
• Assurance that greatest risks have been
identified and addressed
• Increased understanding of risks
• Mechanism for reaching consensus
• Support for needed controls
• Means for communicating results
Slide #153
Basic Risk Analysis Structure
• Evaluate
– Value of computing and information assets
– Vulnerabilities of the system
– Threats from inside and outside
– Risk priorities
• Examine
– Availability of security countermeasures
– Effectiveness of countermeasures
– Costs (installation, operation, etc.) of countermeasures
• Implement and Monitor
Slide #154
Identify Assets
• Asset – Anything of value
• Physical Assets
– Buildings, computers
• Logical Assets
– Intellectual property, reputation
Slide #155
Example Critical Assets
• People and skills
• Goodwill
• Hardware/Software
• Data
• Documentation
• Supplies
• Physical plant
• Money
Slide #156
Threats
• An expression of intention to inflict evil
injury or damage
• Attacks against key security services
– Confidentiality, integrity, availability
Slide #157
Types of Risk Analysis
• Quantitative
– Assigns real numbers to costs of safeguards and damage
– Annual loss exposure (ALE)
– Probability of event occurring
– Can be unreliable/inaccurate
• Qualitative
– Judges an organization’s risk to threats
– Based on judgment, intuition, and experience
– Ranks the seriousness of the threats for the sensitivity of the
asserts
– Subjective, lacks hard numbers to justify return on investment
Slide #158
Ways to Handle Business Risks
168