TheAnnual Reports will soon be out again, but how much do they really tell us about the workings of an organisation? A recent study by the Financial Reporting Council (FRC) found that 62% of investors base decisions on the principal risks disclosed in an Annual Report. This despite the fact significant risks can sometimes be omitted, as was demonstrated by the Carillion collapse.
The FRC last surveyed the quality risk reporting six years ago, its recent report found that the average amount of space devoted to explaining risk had doubled since 2011, typically featuring more about risks faced and control systems employed to mitigate them. Nevertheless there are some learning points from best practice that could be better known. Here are the top five:
- Attitude – Investors like to see a statement on the board’s approach to risk, whether the culture is essentially risk seeking or risk avoiding. This sets the tone for the whole risk management story and the significance of risk within the business model. it is not enough to talk of risk appetite and tolerance just because of the corporate code, investors will demand more context for risk attitude.
- Who – To whom does the risk apply? Where will the damage fall or who will feel the pain? It is important to distinguish between risk to the company and risk to investors. Although in many cases they will be the same, in some instances they will be critically different. A business risk is one that affects the business model, but an investment risk impacts shareholder return and board credibility.
- What – Risk should be qualified within the risk reward ratio. Certain investors will seek high risk in anticipation of high reward, but only if they have confidence in a particular management team or board. Risk reporting should aim to attract suitable investors, ones sympathetic to the business. This is not simply a matter of appetite matching, there is also a time dimension, as below.
- How – The way a risk could materialise in the future is often portrayed in terms of outcome probability, but this assumes only one of several alternative future scenarios. Investors appreciate a risk report that considers alternative future scenarios, or has given some thought to a set of circumstances which match their own investment time horizons. Investor fit is important.
- Why – The most important factor in risk disclosure is to clarify whether a future outcome represents a business threat or opportunity. Typically risk management is treated as a control process to ensure business continuity, yet investors seek risk in order to profit from enterprise, so risk aversion is not always an attractive message to investors. Risk is opportunity to be exploited.
The latest FRC survey on risk reporting highlights the two critical communication strands essential for good risk reporting: Information that helps investors to understand the risk to the company together with information that helps investors to understand how the company is managing risk.
Risk as a management discipline has grown rapidly over recent years, but risk management is semantically an oxymoron because the future cannot be managed. The future contains no certainties so statements of strategy and risk are at most aspirational. Consequently boards, who bear collective responsibility for risk, should take care in how they present risk to investors.