Fundamentals of Risk Management

Risk assurance
426
In order to comply with the requirements of Sarbanes–Oxley, many organizations 
have decided to set up a disclosures committee to validate all information disclosed
by the organization. Because of the extensive application of SOX, many companies 
based in countries other than the United States have also been obliged to set up dis-
closures committees. The risk architecture shown in Figure 22.1 for a large corpora-
tion includes a disclosures committee.
Compliance with the requirements of the Sarbanes–Oxley Act of 2002 is a costly 
and time-consuming exercise. Questions have been asked about whether the Act has 
been effective in improving the accuracy of reports from companies that are listed on 
US stock exchanges. These criticisms are relevant, given that the SOX requirements 
relate primarily to accuracy of reporting, rather than the achievement of enhanced 
risk management standards. A summary of some of the views of the CEOs of some 
US companies is presented in the box below.
Chief executives across the United States view the Sarbanes–Oxley law as reactionary and 
over-burdensome. Yet they still cite ‘improper accounting practices’ as the number one 
ethical issue facing business today. A survey of CEOs on business ethics by Georgia State 
University polled nearly 300 chief executives at both private and public companies.
Among its findings, most executives agreed that the Sarbanes–Oxley Act strengthened 
public and investor trust in corporate America, although it had done nothing to improve ethical 
standards at their businesses. Many agreed that the act was an over-reaction to the ethical 
failures of a handful of executives and has proven burdensome and unnecessary.
sarbanes–Oxley ineffective
Risk reports by Us companies
Companies that are listed on a US stock exchange are required to make extensive 
disclosures about risk factors. These risk management reports are intended to be 
forward-looking, rather than a commentary on the risks that have materialized in 
the past. The reports are contained in the periodic Form 10-K or Form 20-F filings. 
It is not unusual to find several pages dedicated to risk factors. Typically, this section 
of the filing will be between 3 and 10 pages long.
Table 36.2 provides a partial list of the industry, economic and environmental risks 
reported in Form 20-F for the company identified. Extracts from another example of 
the risk factors that are reported by a US-listed company are set out in Table 36.2.
It is normal for the list to be introduced by a comment, such as ‘important factors 
that may cause future financial difficulties include, but are not limited to’, and then 
followed by a long list with detailed explanations. Items listed typically include:
●
●
regulatory developments and changes;
●
●
competition in our businesses;
●
●
decisions of competition authorities regarding proposed joint ventures;
●
●
compliance with governmental regulations;
●
●
general economic conditions;

---