Controls on Risk Often Flouted

NEW YORK — Controls put in place by chief executives may be flouted by employees, which could mean that when a new product flops or a scandal breaks it may be too late for the executive to save the day.

“Most [CEOs] are not effectively controlling risk, nor are they leading others in their companies to do so,” according to a survey by Louis Harris & Associates Inc. for accountants Coopers & Lybrand.

Steps to control risks vary from mission statements to notices of ethical intent in employee handbooks to job descriptions, audit committees and employee training.

Frequently, “companies don’t have a process in place to determine what risks exist and for employees who do know of them to go to top management,” said the accounting firm’s William Jennings.

In fact, the survey uncovered a yawning gap between what CEOs think they’re doing to prevent corporate calamities and actual practice. Employees can and do brush aside internal controls wholesale.

Many a CEO beaming over a “clean [financial] audit” is unaware of “potentially fatal breakdowns” caused by lack of “compliance with laws” or “fairness in dealing with customers,” the accounting firm warns.

Managers bent on “making their numbers”--particularly in far-flung divisions of large companies--”often take risks with the company’s reputation that the CEO and board of directors wouldn’t permit if they knew about it,” Jennings said.

Statistics taken from the survey reveal how many CEOs view their risk management “controls” through rose-tinted glasses.

* Only 23% think their employees try to work around internal controls that get “in the way,” yet 40% of middle managers say that is what’s going on.

* Only 11% believe “the messenger of bad news takes a real risk in my company,” but one-third of middle managers say it’s a fact, and nearly half of all non-management employees think so, too.

* Although 82% think they’re leading “by personal example in adhering to their firm’s mission and vision,” just 68% of middle managers and 39% of employees are in agreement with them.

* A stunning 80% of senior executives interviewed affirm that “even though most companies stress internal control, when it comes down to compensation, making the numbers is what really matters.”

Avoiding blunders has been made more difficult by corporate downsizing, the survey showed.

“A lot of 50-year-old managers who were holding the [internal] control process together” are often let go, Jennings noted. When they get cut, their employers lose “a lot of corporate memory.”

As Jennings sees it, the survey “paints an unnerving picture.”

“Despite how well they think they are doing, most companies are sending a clear message to employees that control is not a priority,” Jennings said.

In defense of the top brass, Jennings said, “Once an executive is anointed CEO, it becomes tough to keep the information flow going to them.

“In a good company, there will be mechanisms for an employee to report these [negative] things to an ethics office or an ombudsman.”

Harris & Associates interviewed 300 executives and 200 employees at 100 of the nation’s largest companies.

One of its positive findings was that businesses with effective internal controls to manage risks “are more likely to be experiencing rapid growth [and enjoy] success in meeting corporate objectives and increasing return on equity.”

Jennings predicted that the findings on risk management in the survey for Coopers & Lybrand could have significant influence on the future of corporate governance.

“Someday, we’re going to have the C&L; rating on this process and it’s going to be more important than Standard & Poor’s [bond rating],” he said.

“You can have two companies with the same market valuation, and one doesn’t manage its risk well and disaster is right around the corner and management doesn’t know it,” Jennings said.