NU Online News Service, March 11, 2:58 p.m. EST

The directors of public companies need to pay closer attention to their risk exposure and must explain to shareholders how they are managing those perils, according to a panel of executives.

Their advice came during a Webinar sponsored by insurance broker Marsh, titled "Enterprise Risk Management: New Rules Demand Compliance."

In late February, the Securities and Exchange Commission instituted rule 407 (h), that requires corporate boards to explain their role in the risk oversight of their company, explained Mat Allen, leader of Marsh's Enterprise Risk Services and Solutions practice.

This disclosure, he said, must include both the structure and strategy the board will employ and it must be part of the company's proxy statement.

This new rule, he and others suggested, will transform companies by encouraging them to employ the enterprise risk management process throughout their entire organization and imbed it into their culture.

The change came in the wake of the financial crisis, explained Mr. Allen, as regulators, rating agencies and the stock exchange realized that an advanced consideration of risk is needed to prevent a repeat of events that led to the recession.

What the new rule requires, explained Christy Kaufman, vice president and consultant in Marsh's Enterprise Risk Services and Solutions practice, is an explanation of what the board is doing to manage risk, but the SEC does not lay out how that is to be done.

There is no standardized requirement, she explained, or a recommendation as to how the board goes about answering that question to investors.

Denise Kuprionis, vice president, secretary and chief ethics and compliance officer for E.W. Scripps Co., a media company, said the new disclosure requirements are good, but they will not be easy for companies to implement.

At her company, she related, evaluating risk involves a wide range of management and requires the management committee that governs risk to both report on perils and give updates.

Implementing ERM practices, she said, is not a hindrance to companies taking risk, but serves to encourage management to take a holist approach to thinking about risk.

"Risk is good and companies have to take risk to be successful," she noted.

John Jarrett, director of research, GovernanceMetrics International, a New York-based consulting firm that monitors corporate governance, said that the disclosure of risk by companies is in its infancy, with some companies giving clear, detailed accounting of its ERM process.

Others, he noted, give only "perfunctory" reports on risk management, which he called an immature approach. However, he expects companies to do better in the future as ERM becomes a part of a corporation's culture.

Ms. Kaufman said a major step companies will need to take is educating their boards and management in understanding the need for an overall risk management program.

Both she and Ms. Kuprionis said the worst thing companies can do is to take a silo approach to delegating risk management assessment throughout the company. Ms. Kuprionis noted that the only way companies can effectively institute the ERM process is by integrating it across the entire company and functions.

Mr. Jarrett acknowledged that this is not an easy area for companies to think about, however, the best boards understand their risk tolerance and can integrate strategic risk into their corporation's functions. For investors, he added, it gives them the opportunity to judge whether the risk is good or excessive.

The challenge for corporations, observed Ms. Kuprionis, is that there are no best practices available to measure themselves against, and while it makes a corporation aware of its accountability for risk, they still need to define their tolerance for risk.

"No one size fits all," she said. "It must be built into the rhythm of the business."

A rebroadcast of the Webinar is available at www.marsh.com.