Board oversight of risk management remains front and center in the minds of regulators and boards of directors. This oversight role stems from the board’s fiduciary duty of care, which courts have found requires the board to attempt in good faith to oversee and monitor the operation of the company’s systems designed to identify and mitigate risks, including violations of laws or regulations. The board may be held liable if it is found to have failed to properly oversee the risks facing the company. Thus, the board should ensure that the company implements appropriate risk reporting and monitoring systems, and then the board should review these systems on a regular basis to avoid the possibility of director liability.

While this may sound straightforward, the role and expectations of the board in the area of monitoring and evaluating risk have expanded substantially over the past several years due to the continuous increase in oversight regulation and corporate governance reforms. For example, SEC rules now require that public companies disclose both:

• The extent of the board’s role in risk oversight of the company
• The effect that the board’s risk oversight function has on its leadership structure

The increased focus on risk management can also be seen in the financial area, where the board is required to establish policies and procedures for the preparation of the company’s financial statements and the reports that it files with the SEC.

In meeting the board’s obligations regarding risk management, the board should focus on the “bottom-up” approach to risk management and the role of the chief legal officer of the company. A bottom-up approach involves the company educating and facilitating risk awareness throughout the organization to enable employees to identify and address risk-related issues. If consistently applied, this bottom-up approach will prove the most effective strategy for mitigating risk.

While a bottom-up approach to risk management is key, the board must also ensure that the tone at the top is one that encourages risk management. This means the board should work with management to ensure that the company views enterprise-wide risk management as an integral component of the company’s success. A key to ensuring the correct tone at the top is the company’s chief legal officer.

The chief legal officer is expected to advise and assist the company’s board in overseeing actual or potential risks associated with the company’s business, operations and practices. In this role, it is important that the chief legal officer be candid and frank in discussing the risks and potential problems that face the company.

However, the board and the chief legal officer should keep in mind that the exercise of sound business judgment involves taking risks, and that risk oversight does not mean risk elimination. If this is done, it will help prevent management from viewing the chief legal officer as a policeman. If management views the chief legal officer as a policeman, management may be reluctant to be candid about the risks facing the company, and effective risk management requires a culture where management freely shares concerns with the chief legal officer.

So, it is important that the chief legal officer work to be viewed central to facilitating the company’s overall efforts at mitigating risk, and that management works to ensure that risk management is viewed as an integral component of the company’s success.