Reinventing RI companies risk management

David O'Brien, Jakarta

I read with interest David Finneren's article Assessing business performance in The Jakarta Post of July 11, 2005. The benefits of triple bottom line reporting in the developed world are still being debated with many believing it is better managed through the overall risk management of the organization. In the Indonesian context I believe there remain a few more "baby steps" to go before stretching so far.

The key point I noted from the article was the fact that "the top quartile of JSX (Jakarta stock exchange) firms possessing good governance ratings enjoyed an average share price out- performance of over 200 percent". I am not clear how many companies possessed good governance ratings and subsequently what made up the top quartile but the message is clear. Those companies with best practice governance outperformed the market.

It still begs the question, what is good governance? It seems to be the term, along with legal/regulatory reform and direct foreign investment, which is most readily promoted as the cure to Indonesian economic ills. How will it do that?

One view is that it can best be considered in light of a framework of enterprise wide risk management (ERM) rather than in isolation. ERM is a process for empowering managers so that those closest to the risk take accountability for it under the overall governance framework of the organization.

The importance is accountability rather than elimination of risk. A basic business precept is the relationship between risk and return. More risk the greater the return and vice versa. A balance must be reached between the two which is the governance framework senior management has responsibility for.

The board has responsibility for setting the overall attitude of the business to risk and this will embed itself in the culture of an organization. At Enron you had a "cowboy culture" that embraced and rewarded consistent short term out performance. Later failures in internal controls to highlight the gaming that was occurring in quarterly reporting through off balance sheet vehicles was a consequence of the risk attitude.

A similar attitude seems to have been prevalent in many Indonesian firms prior to the economic crisis and even more recently. The current rash of corruption cases and the backlog of others is evidence of such. When there is malfeasance at the top of the organization and the approach suggests this is appropriate culture, managers and staff down the line will simply fall in with the example set. This is a perception that has stuck in the mind of capital markets and continues to hamper investment in Indonesia.

There is now a shift by the government from privatization to extracting a return from BUMN (state owned enterprises) in the form of dividend. This is a marked shift from the former privatization programs earlier instigated at the urging of multi lateral agencies. There seems to be an attitude that the efficiency gains available via restructuring of agencies can be retained by the state.

To ensure this is a success the government will require that the BUMN run as world best practice businesses to earn an appropriate return on state funds invested in these enterprises. If historical practices of leakages via corrupt business practices continue unabated this will not be possible. In addition such businesses will not meet requirements of the international capital markets, whose support is required to meet the levels of growth required in a rapidly improving economy.

Development of ERM results in ownership of business processes and accountability at all levels throughout the organization. Senior management are accountable for setting the overall governance framework and attitude to risk. They remain accountable to ensure that these risks are ascertained and managed with contingency plans; mitigated via transfer to third parties or shift in business processes; or managed through appropriate level of controls.

The process of identifying risks is usually taken via a process known as Controls Self Assessment (CSA). This is commonly a facilitated approach whereby business processes are mapped through the organization. Risks are subsequently identified and quantified across these business processes. An overall risk register will be developed which allocates responsibilities for specific managers to manage their risks.

Such an approach is to promote the end result whereby risk assessment becomes embedded at all levels of the organization and not another business silo viewed as extra bureaucracy to perform a job. The empowerment and allocating of responsibility to line managers should act to instill an approach that leads to an improvement in business performance. This will especially be the case when these accountabilities are linked to performance measures and subsequent rewards.

We believe ERM will become the industry standard for risk management. ERM will continue to gain acceptance as the best way to ensure that a firm's internal and external resources work efficiently and effectively in optimizing its risk/return profile. New financial disasters will continue to highlight the pitfalls of the traditional "silo" approach to risk management. External stakeholders will continue to hold the board of directors and senior management responsible for risk oversight and demand an increasing level of risk transparency.

More importantly, leaders in ERM will continue to produce more consistent business results over various economic cycles and weather market stresses better than their competitors. Their successes will gain attention and other companies will follow. These trends, coupled with a stock market that is increasingly unforgiving of negative earnings surprises, will compel businesses in all industries to adopt a much more integrated approach to measuring and managing enterprise-wide risks.

The Indonesian capital markets oversight board (BAPEPAM) has already mandated via decree in late 2004 that the responsibility of an audit committee is not confined only to the area of finance, accounting and compliance issues but broader risk management. In addition there are specific Indonesian organizations with instruments listed in U.S. which are experiencing the onerous requirements of Sarbanes Oxley.

At the end of the day the approach is all about lowering Indonesian businesses cost of capital to allow for growth. Such an approach to risk management will help to satisfy capital markets that change is being implemented at the micro level. A well developed and educated investor relations arm can further aid in educating capital markets locally and abroad of the advances being made in such an area.

Businesses can wait for laws to be passed, be pushed into doing something or embrace the opportunity. Employees can be empowered and transparency enhanced which will reduce the power of established forces against change. Such vibrant state and privately owned firms will act as a beacon for international capital and enhance Indonesian growth more effectively than a procession of corruption cases.

The writer is a Technical Advisor at CSA Strategic Advisory. CSA helps businesses through a combination of "soft" behavioral and "hard" financial advice. He can be reached at dobrien@csadvisory.com.