Test
Ten years after the Sarbanes-Oxley Act highlighted the need for better corporate risk management, many experts say that companies’ misguided efforts to do so actually poses a new kind of risk.
The main problem, they argue, is that companies are not defining risk in the right way. They pay too much attention to a common subset of risk management activities, such as insurance coverage, fraud detection, and regulatory compliance, while ignoring more-important risks. Risk management “typically focuses on operational risks and compliance risks, but those are a small piece of the puzzle,” says
Christopher Dann.

Instead, a Booz & Co. study of 1,200 large companies over a five-year period suggests that “more than 60% of [shareholder] value lost over the last decade has been attributable to strategic risks, like being in the wrong market with the wrong product,” Dann says. Very few risk management programs would regard the “What product in what market?” question as falling in the risk domain.
Another flaw in many programs is that they’re too complex, putting form over content. Board members and management “need to be mindful of a risk management program that is so extensive it paralyzes the company,” says Michael Peregrine, a partner at law firm McDermott Will & Emery specializing in corporate governance.
Some CFOs would argue that they dodge these pitfalls by approaching risk management not as a formal process but as a concern that is woven through all strategic decision-making. “Senior management doesn’t think about managing risks; we think about managing the business, where there are risks around every corner,” says Dennis Hernreich, CFO and chief operating officer of the nearly $400 million Casual Male Retail Group. “[Risk management] is just part and parcel of everything we do.”
Whatever the starting point, the good news is that