Introduction
Corporate Governance generally refers to the way in which companies are governed, and to what purpose. It is concerned with practices and procedures for trying to ensure that a company is run in such a way that it achieves its objectives. Risk Management, on the other hand, is defined as the continuing process of identifying, assessing, evaluating and controlling risks. Risk Management protects a company from losses and mitigates the adverse effect of losses already incurred.
Risk Management is an integral part of Corporate Governance because it is difficult, if not impossible, to achieve the objectives of a Company such as making profits, maximizing returns and building a lasting legacy without protecting the Company from losses or mitigating the adverse effect of losses. Companies who fail to integrate risk management into their corporate governance scheme would struggle to identify and mitigate risk, reduce their risk exposure, or ultimately limit reputational and financial damage.
Nigeria’s Codes of Corporate Governance and Risk Management
As the need for Companies to put in place a strong Corporate Governance system gained traction in the corporate world, and indeed in many nations of the world over the years, Nigeria also joined the fray, and has since been taking graduated steps to ensure both public and private companies pay significant interest to Corporate Governance. One of the ways it has done this is by making relevant Codes of Corporate Governance.
At a point in time, there were five Sectoral Codes of Conduct for companies in Nigeria, namely:
i) Code of Corporate Governance for the Telecommunication Industry 2016, issued by the Nigerian Communications Commission;
ii) Code of Corporate Governance for Banks and Discount Houses in Nigeria 2014 issued by the Central Bank of Nigeria;
iii) Code of Corporate Governance for Public Companies in Nigeria 2009 issued by the Securities and Exchange Commission;
iv) Code of Good Corporate Governance for Insurance Industry in Nigeria 2009 issued by the National Insurance Commission, and
v) Code of Corporate Governance for Licensed Pension Fund Operators 2008 issued by the National Pension Commission.
However, in 2019, Nigeria unveiled the Nigerian Code of Corporate Governance 2018 (“the Uniform Code”), which provides a uniform corporate governance standard for all companies and across business sectors that fall under the following Category:
a. All public companies (whether a listed company or not);
b. All private companies that are holding companies of public companies or other regulated entities;
c. All concessioned or privatized companies; and
d. All regulated private companies being private companies that file returns to any regulatory authority other than the Federal Inland Revenue Service (FIRS) and the Corporate Affairs Commission (CAC)
These entities are mandated to report on the application of the Code in their annual reports for financial years ending in the form and manner prescribed by the Financial Reporting Council of Nigeria.
Significantly, the Uniform Code exists side by side with the Sectoral Codes, and applies a principle-based approach to specifying the minimum corporate governance expectations placed on companies. However, where standards as prescribed in the Sectoral codes are higher than the provisions in the Uniform Code, those of the Sectoral Codes are expected to be followed since the Uniform Code only sets minimum standards. Furthermore, the Financial Reporting Council of Nigeria (FRCN) has the mandate to monitor the implementation of the Uniform Code and is empowered to issue guidelines towards the implementation of the Uniform Code by the sectoral regulators.
Instructively, the Uniform Code requires that companies should have a clear risk management policy which defines the risk management framework of the company and the extent of risk appetite the company may tolerate as well as ways of safe-guarding shareholders’ assets. Thus, the Uniform Code recognizes the importance of risk management in Corporate Governance.
Unfortunately, it does not seem many companies in Nigeria appreciate the importance of risk management or the consequences of ignoring same, as the level of compliance appears abysmally low. While many companies have in place Corporate Governance policies and structures, not much attention is paid to risk management in the whole scheme of things.
Practical Steps to Integrating Risk Management in a Company’s Corporate Governance Policies
Whether a company is governed by the Uniform Code or not, the following are some of the steps that both public and private companies should take in integrating risk management in their Corporate Governance policies:
1. The Board of Directors should provide policy direction on risk management to the Management either directly or through a Risk Management Ad-Hoc Committee. The Board should provide guidance to Management on where to focus their risk management activities.
2. The Board or its Committee could provide a Risk Management policy statement/manual that speaks to how risks are to be treated, which includes risk transfer, reduction, elimination, retention, and avoidance.
3. A Risk Manager should to be appointed as an officer of the Company, who in concert with Management will be responsible for day-to-day identification, assessment, evaluation and control of risks.
4. The Management should implement a risk management strategy and internal control system that aligns with the Board’s priorities.
5. The Management should include risk management reports in the quarterly reports presented to the Board.
6. The Management should codify its risk management practices and conduct its different activities such as mergers and acquisitions, and third-party and vendor relationships based on its risk management policies.
Conclusion
Risk Management is key to the actualization of the Business objectives of a Company. It is hoped that companies will increasingly pay attention to its central role in Corporate Governance. The Financial Reporting Council of Nigeria (FRCN) should hold companies regulated by the Uniform Code to account on their Risk Management policies, while other private companies should hold themselves to account for their own ultimate good