Boards must make risk management a core part of their work due to the complexity of modern business and its relentless pursuit of competitive advantage. A survey conducted by EY of board members found that risk oversight is at best minimal in a lot of organizations. Many board members are struggling to keep pace with the pace, whether in the format or structure for risk reporting, or the number of times they engage this topic.

There are several steps that can be taken to assist.

Boards should begin by creating clear reporting structures to enable them to understand risks that their companies face. This should include a clear breakdown of the kinds of risks that require monitoring (financial and operational, reputational, etc.). A clear framework also allows the board to ask right questions about risk management, and to know which answers are trustworthy.

Second, the board needs to use sophisticated tools to assess risks and decide on the most appropriate combination of taking risks. The use of Monte Carlo simulations, in addition to more traditional models like Value at Risk models (VaR) can bring this process up to date and even into the age of science. They allow the design of thousands scenarios that weigh the probability of profit or loss against the impact on a company’s operating strategy and model.

In the end, the board should be able track leading indicators for the threats it faces. It should also be equipped with trigger-based actions that can be activated when the trend isn’t positive. This will allow the board to respond quickly in a situation like ransomware.

writing a board resolution