Two years after the Procter & Gamble fiasco, consultants and corporate boards are deeply divided on whether current derivatives policies are adequate.

The Consultants' Verdict: Still In Trouble

Sound the alarm bells, say risk management consultants. Corporate boards still have lots to learn.

By James Lacey

The litany of derivatives horror stories has become a trickle. Surely that's because America's corporations have learned a thing or two about risk management and implemented the policies and controls that will prevent the derivatives disasters of the future. Right?

Wrong, say risk management consultants. Although they admit things have improved considerably since the recent fiascos, they're quick to add that most corporate boards still have a long way to go. "In my experience most multinational corporations do not have an effective control structure in place," says Richard Klotz, a partner at Coopers & Lybrand in charge of global financial risk management. "That does not mean that things will go wrong today, but one day directors will be looking around and saying, 'How could this have happened to me?'"

Risk management consultants, of course, get paid to ring alarm bells. Nevertheless, the consensus from a wide range of independent consulting firms and accountants is that, in most cases, derivatives market participants need to go back to the drawing board to put together newer, more specific derivatives policy guidelines and controls. The efforts they recommend are remarkably uniform and involve a series of steps that go far beyond the typical efforts companies have pursued thus far.

Risk Profile

The board's first and most important responsibility is making sure it understands the risks to which the company is exposed. Consultants say that thus far, most board members and senior managers have been content with only a cursory grasp of their risk exposures. Determining precisely where risks lie is often not intuitive. A detailed risk audit often takes several months and involves careful examination of a company's entire worldwide operations. It can also involve arduous and expensive efforts to gather data from offices scattered across the globe.

Once a board has a firm grasp of the risks embedded in the business, it can begin to decide which of those risks it wants to accept and which it wishes to remove through the use of derivatives or other hedging strategies. Many times boards will decide to accept a particular set of risks simply because they believe their shareholders expect them to. A gold-mining company, for example, may decide not to hedge the price of gold in the belief that shareholders have bought their shares as a play on gold prices.

When the board has determined which risks it wishes to accept and which it wishes to transfer, it is ready to listen to management's presentation on strategy. Consultants and others who have been through this process warn that management often does not do a very good job of articulating the company's exposures or explaining the effectiveness of the measures they plan to use to minimize it.

Many boards, for example, are often led to believe that their derivatives positions have eliminated risk, when the risk has simply been moved to other areas. "Risk is like matter," says Dori Nagar, a partner at KPMG Peat Marwick. "It can't be destroyed; it can only be transferred. A company that purchases a currency forward, for example, may eliminate a particular currency exposure but may not understand that it has given up a significant amount of upside on its position. Similarly, a board may not understand that a collar strategy protects it only within a certain band and that a radical move in market prices will expose the company to a risk that was poorly defined."

Although understanding risk is critical, board members must make their most important judgments about people: are the right people in senior management capable of making the right decisions? To help them make this assessment, some recommend that board members put their senior risk managers on the firing line and not allow them to hide behind consultants. "Boards should insist that presentations dealing with derivatives be given internally," says James Johnson, a partner at Deloitte & Touche and head of the Financial Instruments Strategy Group. "Consultants can help, but in this area boards need to make some very keen judgments on their own people."

Setting Policy

After board members get a good grasp on risk and evaluate management's proposals, they should sign off on a policy document detailing what managers should be allowed to do. (See box on page 24.)

An important-and often neglected-part of any risk management policy document should detail what happens when things do not go as anticipated. "We see a lot of effort going into the front end of the decision, but very little goes into what to do when things go wrong," says Robert Baldoni, managing director of Irvington-based Emcor Risk Management Consulting. If a company believes interest rates have hit bottom and decides to take out a $100 million loan, it may use derivative instruments to reduce the cost of funds even further. Before it does so, however, it should have a pre-defined strategy to unwind its position if the company's view on interest rates is incorrect. This exit strategy should be formal, written and approved by senior management.

The exit strategy should start with a determination of what amount of money the company will put at risk to shave its interest cost. A company, for instance, may decide to risk $10 million in order to get sub-LIBOR funding. If interest rates go the wrong way, the company's officers would be required to unwind the position once rates reach a certain trigger point. Baldoni points out that only the very senior levels of management should be allowed to override the procedure once the trigger has been reached, and that the costs of unwinding the transaction should be included in the predetermined amount at risk.

Setting Controls

After approving a policy statement, most boards are eager to move on to other subjects-without making sure their policies and procedures are actually enforced. There are a number of important internal control issues that require attention.

The most important part of any control system is setting up an independent risk management unit. Although this point has been harped on by regulatory agencies, auditors, consultants and independent studies, few corporations have rearranged their flow charts to set up genuinely independent risk management functions. "We still see situations where the risk managers report to the traders, both in multinational corporations and financial institutions," says Coopers' Klotz.

At the very minimum, risk managers should report to one level higher then the people who execute and approve derivatives transactions. In most companies that means reporting above the traders and treasurer to the company's CFO. If a CFO gets involved in approving individual transactions, the risk manager should report to the CEO or directly to the board. In some companies risk managers are part of a company's internal audit function and report to the board audit committee.

Many smaller corporations, however, balk at restructuring their reporting lines on the grounds of trust. Consultants say a common refrain is, "We are a small organization and we trust our people." Although consultants concede that trust is an important ingredient in the risk management process, they unanimously warn that relying on trust without any independent verification is the quickest path to disaster.

Other companies begin having second thoughts about an independent risk management function when they add up the costs of the necessary people and systems. The most expensive part of any comprehensive risk management system involves consolidating and integrating data from a number of different systems across the company's operations. That undertaking alone can cost several million dollars. Once that's accomplished, risk management apparatus to analyze the data can run anywhere from $50,000 to a million or two, depending on the level of sophistication of the systems and the personnel.

Getting high-priced systems and personnel, however, is critical if board members want to make sure their policies are properly implemented. "It is not unusual to find that the managers responsible for monitoring the activities of traders are clueless," reveals one consultant. Another consultant recalls a Fortune 1000 company with hundreds of millions in swap positions that instituted a policy to stress test their various positions daily. "The board read in some report that their policies should include stress testing, so they put it in their policy statement," he recalls. "In reality, they were not stress testing anything. We could not find anyone in the treasury who knew how to conduct a stress test. Most of the positions were so plain vanilla the stress tests weren't really necessary."

A risk manager's key skill is the ability to price deals independently. "If you are still outsourcing your mark-to-market values with the dealer that sold you the instrument then you have some more homework to do," warns Elizabeth Glaeser, director of capital markets for Mobil Corp. "You have to have the systems in place to accurately value all the products in your inventory or at the very least have a truly independent third party providing this service."

The risk manager should also have the systems to support those valuations. Although many dealers with complex portfolios have invested in astronomically expensive systems that measure risk in real time or close to real time, most end-users don't need to track their positions minute-by-minute. "None of the major train wrecks happened overnight," says Coopers' Klotz. "They take time to develop."

Staying in Synch

The results of the risk manager's work should be regular reports sent to the board and senior management. These regular reports should check compliance with policies and procedures and make independent valuations of all derivatives positions. They should also check to make sure that positions are in synch with the company's accounting treatment and with disclosures in the company's financial reports.

In many cases, however, the reports delivered to boards are too voluminous to be useful. Too much vague information can do more harm than good. "A lot of detail can set up a forest that will hide some pretty important trees," warns one consultant.

High-tech Audits

To compensate for inadequate reporting from management, some boards rely on independent auditors to bring information to their attention. Unfortunately, when it comes to financial risk, most traditional audits will reveal little of value. Although an audit will usually confirm that a particular swap is in place, it will not be able to tell you if the position is priced correctly or even if it should have been put in place to begin with. It also makes no judgment on the effectiveness of the company's internal controls.

This inadequacy has given rise to a whole new industry of independent risk management consultants and audit services. Most of the major accounting firms have begun competing with the smaller independent firms by establishing their own internal risk management units.

In some cases, consultants can serve to prod board members into instituting the necessary controls. "A lot of times there are one or two savvy board members who call in a consultant as an agent of change," reveals one board member. "They already know what the consultant will find, but want the weight of the consultant's authority to pound the rest of the board into getting serious about its oversight responsibilities." In other cases outside consultants provide necessary assurances and due diligence. "In 1994, given the negative press that was appearing, there was a lot of hand wringing going on," says the CFO of a large insurance company. "An outside consultant was instrumental in helping management assure the board that the derivatives were under control."

The best control procedures will be worthless if traders and managers think they can be ignored. The board's final responsibility is making clear to traders and managers that those who violate the board's policies and controls will be punished. "Boards have to be able to instill the fear of God in their company's management," says Robert Lear, who sits on the board of the Korea Fund, Scudder International Funds, Equitable Capital Enhancement Yield Fund and NewsBank. "There must be real consequences when board limits are not adhered to. The board should severely punish the first one to step out of line. You usually only have to do that once."

A Checklist for Corporate Boards

Understanding Risk

• What types of risk is our company exposed to?
• What is our company's risk tolerance?
• How much variability in earnings are we willing to accept?
• How much are we willing to lose if we decide not to hedge a particular exposure?
• How much profit, if any, do we expect treasury to contribute to earnings?
• What is our past performance and experience at managing risks?
• What regulatory constraints and requirements do we face?

Evaluating Derivatives Programs

• What are the objectives of our program?
• What hedging strategies are appropriate for our objectives?
• What particular instruments are allowed and for what purposes?
• What level of authorization do particular instruments or strategies require?
• How much exposure should we permit for various instruments and how should that level be determined?
• How does the program fit in with our overall business strategies, related businesses and with the other financial risks we take?
• How will our program affect our financial condition and capital levels?
• What is the desired impact and the potentially adverse impact of derivatives on the cash flow and financial statements?
• What accounting approach do we intend to use?
• How much should we reserve for expected future losses?
• What derivatives products or strategies are not allowed?
• How should we inform investors of the company's policies as well as the risks they entail?

Assigning Responsibility for Controls

• What are the separate responsibilities of traders, independent risk managers and internal auditors?
• Who is authorized to commit the company to what instruments and in what size?
• Who is responsible for recording and confirming trades?
• What are the responsibilities of the board, the CFO and the treasury staff?

Risk Management Methodology

• What internal expertise and experience do we have to monitor risk?
• How frequently should we mark our positions to market and what methodology should we use?
• What are our counterparty credit limits and what procedures should we use to monitor exposure to those limits?
• What approach to stress testing should we take and how often should we do it?
• Which variables, given a small market move, would cause a large move in our position or risk valuation?
• Which variables have a high likelihood of change?
• Which variables or exposures could be considered to offset each other?
• How wide is the variance of results produced by other commonly used models compared to ours?
• How well are our models accepted in the marketplace?

Reviewing Policy

• What method should we use to review our derivatives activity and how frequently should we use it?
• Are the assumptions that underlie our pricing models reviewed regularly?
• How should our derivatives strategy reflect changes in the financial environment?

The View from the Boardroom: Under Control

Board members of corporate America feel confident they've put their derivatives problems behind them.

By Linda Keslar

During the past two years Chase Manhattan Bank's board of directors has spent many hours developing a set of board-level risk management policies and procedures. One important goal was to get a handle on all the risks associated with its traditional lending and trading businesses-as well as the newer risks associated with high-growth activities such as derivatives and FX trading.

While the improvements took hold, the derivatives fiascos at Procter & Gamble and elsewhere hit the papers. Board members asked senior managers what had happened as a way of reflecting on whether it was possible to prevent the same types of occurrences at Chase.

After asking some difficult questions, they reached an interesting conclusion: while good management and good board-level policies could prevent many mistaken trading practices, only good management can actually stop a rogue trader in his tracks.

"Can a board develop strategies on derivatives trading to completely prevent a trading event that causes severe losses?" asks Paul MacAvoy, a Chase board member and Williams Brothers professor of management studies at the Yale School of Management. "At least I have concluded that there is no set of board-determined policies that can prevent losses on certain types of transactions. The board can't do that any more than it can prevent someone from walking into a branch and robbing the bank."

Faint Echo

Other directors who have worked to construct derivatives policies and procedures have reached similar conclusions. In fact, the overwhelming impression from a number of interviews with board members is that the alarms about derivatives raised by policy makers, regulators and consultants have echoed only faintly in boardrooms across the land. The response of board members who have helped construct policies and procedures has, by and large, been confident and low-key. "Derivatives are not at the top of the problem list at any boards I serve on," explains Barbara Hackman Franklin. A former Secretary of Commerce, Franklin sits on the boards of Aetna, AMP and Dow Chemical, the last of which is a particularly active user of these instruments.

Barbara Scott Preiskel, who serves on the boards of General Electric, Textron, American Stores, Mass Mutual and The Washington Post, agrees: "At GE, we've never had a full board discussion about derivatives. I'm sure GE Capital has had innumerable discussions about it, but it has not been a major topic for any of the boards on which I sit." At Mass Mutual and Textron, she observes, the board has received reports about derivatives in discussing their use in pension fund management. But at no time did she detect any high anxiety. When the fiascos hit last year, Preiskel, who serves as chairman of the Textron audit committee, asked Textron management about their derivatives use. "We got a report on what kinds were used, what they were doing with them, but it wasn't any major crisis," says Preiskel.

While regulators were afraid the corporate losses might trigger a wave of financial fragility, many corporate managers were busy writing reports and kicking the tires on internal control procedures. And in most cases, clearly, they were quite satisfied with what they saw. Says Donald Frey, retired chairman of Bell & Howell, who is now retired from serving on the boards of Springs Industries, Cincinnati Milicron and Clark Equipment: "[In these companies,] my experience was that derivatives use was extremely conservative. The board had to approve any usage of derivatives except for FX hedging. Each quarter the audit committee reviewed derivatives positions. It was very simple and very straightforward."

The chief service that boards perform may be in keeping their fingers off the panic button. "There's been too much panic language in the media on this subject," says Clayton Yeutter, a former chairman of the Chicago Mercantile Exchange and a director at BAT Industries, Caterpillar, ConAgra, FMC, Lindsay Manufacturing, Texas Instruments and Vigoro. "Sure, there's been a lot of activity before boards, but that's not unexpected given the attention they've been getting. Derivatives are a high-profile issue, and they often receive special attention by the chairman of the audit committees before being addressed by the full board. Within audit committees, however, though derivatives rank high in the priority scale, they rank no higher than any other internal control issue."

Hitting the Books

Getting to that degree of comfort, however, may entail a lot of additional study and orientation by the board, especially where derivatives use is extensive. Steve Ross, a professor at the Yale School of Management who sits on the boards of General Reinsurance and the College Retirement Equity Fund, says he's frequently called on by other companies to explain the ins and outs of derivatives. "Many boards I know are making a serious effort to understand risk control in the corporation. The attitude is anything but 'Let George do it,'" he says. "After all, it is their job to monitor and make sure management is making a good strategy decision for shareholders."

Board members and corporate managers have also kept phones ringing at the Securities and Exchange Commission. "Boards and senior managements are trying to create an environment to protect themselves against aberrant losses," says Brandon Becker, the SEC's director of the division of market regulation. He says his staffers have been approached about derivatives issues both formally and informally at events ranging from financial seminars to social events. Adds Becker, "Everyone wants to make sure they have the right policies and procedures in place."

In the past year or so, a number of corporate boards have drafted or redrafted policies on derivatives and hedging procedures. "When the derivatives issues hit, many boards were blindsided and didn't know what questions to ask," explains John Nash, executive director of the National Association of Corporate Directors, which is holding seminars and publishing white papers on the subject to keep its members informed.

Last year, in a follow-up to its risk management recommendations issued to boards, the Group of Thirty found that 28 percent of the 149 end-user respondents to its survey were implementing either new or updated controls. Furthermore, it found that 66 percent of the respondents' boards of directors had implemented controls prior to July 1993, where the organization's first set of recommendations were issued. Says Charles Taylor, the former executive head of the Group of Thirty: "My feeling is, if treasurers and controllers explained to their boards what they did with derivatives well enough, they continued to use them. And if they didn't, they stopped."

The Right Report

In some cases, the new risk management policies were instituted after a formal risk audit. At US West, for example, the board requested a formal review of the company's derivatives strategy in 1994 after a series of derivatives debacles won heavy media attention. "We asked Coopers & Lybrand to come in and make sure the appropriate controls and procedures were in place," explains Charles Burdick, assistant treasurer at the telecommunications company, which has a currency derivatives portfolio of about $300 million. The result was a report which triggered some changes. "We tightened up the written policy to reflect what was taking place," says Burdick. "That wasn't a negative, but a positive. Nothing changed in terms of our practices. The board was comfortable with our controls and generally conservative implementation of derivatives in risk management."

Other board members felt able to conduct their own research in-house. Barbara Franklin, who chairs the audit committee for all the boards she serves on, requested in each case a review of derivatives use from the CFO and the finance staff. She then discussed the audit committee's conclusions with each full board. "We had the appropriate controls in place in each situation," she says. "This is mainly a control issue, but it also happens to require more creativity and diligence than, say, inventory controls. It's more than counting boxes of Kleenex."

When it's time to report to the larger board, the key challenge is reducing often complicated risk management problems to their most basic components. Harold Brown, a partner at Warburg Pincus in New York and a former Secretary of Defense, is a member of the Alumax, CBS, Cummins Engine, Mattel and Philip Morris boards. Brown says he found analysis based on stress testing a valuable way to take on the issue. "It's a complicated matter, but at least in one case, derivatives were presented in what I thought was an easier way to understand than before-based on 'if interest rates move in either direction, this is how much exposure we have.'"

Overly detailed reports, however, can actually reduce the effectiveness of a board. "There's no excuse to present a board of directors with 300 pages of information a month, at least not for a non-financial institution," exclaims Clayton Yeutter. ConAgra, where Yeutter serves on the board, makes information available on its hedging positions to all directors at every board meeting. "But these are not often discussed at the meetings," he says. "The positions are basically presented as a matter of information." About twenty years ago, adds Yeutter, a predecessor company to ConAgra ran into difficulties speculating in soybeans, so "they probably do more to inform the board than normal."

Meet and Greet

Some board members have concluded that their responsibilities extend beyond listening to reports and asking questions of management. Evaluating the effectiveness of controls often means going out into the field and making personal judgments about people and operations. "What boards have learned is that even a magnificently managed company with all the right controls and fine people at the top can still be taken, and that means everything has to be tightened up even more," says Arthur R. Taylor, the president of Muhlenberg College who also sits on the boards of Pitney Bowes and Louisiana Land & Exploration.

At Pitney Bowes the need for more awareness and education sprang from the discovery of financial problems at its German leasing company, where the operating chief financial officer was eventually dismissed. Some of the abuses included derivatives transactions that had to be unwound. After its investigation the board recommended that top management should personally spend more time with its line managers abroad. "You need human control, people meeting with people," says Taylor. "You go sit there and have some schnapps and ask the right questions. If someone wants to rob you, you have to be shrewd to detect that."

"It's a rare occurrence where the board is in a position to dispute the presentation of a senior financial officer on risk management matters," adds Yeutter. "Some individual board members may be able to do so and the audit committee should develop its level of competence. But if this becomes a board controversy, something is dreadfully wrong with the risk management program. Either the policies for managing risk are inadequate, or the execution of sound policies is wanting. Both require diligent attention by corporate boards and management."

For mid-level treasury personnel, however, the increased controls on which the board's comfort level is based can be hard, even tedious, work. Christine Jaccard, a senior manager of FX and investments at Medtronics, must go through various sign-off levels internally, including the CEO, as part of the FX strategy for the maker of medical devices, which has $500 million in currency hedging annually. She is also required to prepare reviews for the board several times a year. Says Jaccard: "The hedging strategies need a high level of approval, so I spend time explaining that strategy, which I welcome. But once that's decided, as I execute each deal, there's still a lot of paperwork and sign-offs. That's when I think, 'How many more times do I have to explain this?'"

Genentech's Policy Double-check

Policies that pre-dated the headlines were reviewed again.

The Genentech derivatives story follows an almost classic pattern in corporate America. The biotech giant had adequate procedures in place before the "d" word made media headlines. All use of derivatives had been preapproved by Genentech's board of directors after extensive internal review by top management and a detailed discussion with the board. Management presented information on derivatives to the board once a year, as part of its review of cash and risk management policies. Directors also received a report on investment holdings, including derivatives, every quarter.

"After the headlines," says Genentech treasurer Marty Glick, "we had an exhaustive review of our policies and controls by our outside auditors, who confirmed that our procedures and controls were adequate and that our use of derivatives was appropriate. We then went to the board with our outside auditors and reconfirmed how our use of derivatives tied into and was consistent with overall investment policies and was not intended to increase risk."

Genentech's investment policy, formulated two years ago, is unusually specific in detail. It lists all instruments that are permissible and what controls relate to them. Genentech uses derivatives primarily to manage the asset side of the balance sheet and to create synthetic bonds that are permitted by its stated investment policy. It also uses straightforward options to manage the FX risk that springs from its significant international royalties. Its FX swaps are plain vanilla.

At Genentech the derivatives must co-exist with other, larger risks. "For our board members, the most important risk isn't derivatives, but technology," says Glick. "The main point, which we have clearly explained to our directors, is that we use derivatives to execute our financial strategy of managing and reducing financial risk."

The Legal Dangers of NOT Hedging

Some directors, frightened by derivatives horror stories, have been tempted to categorically forbid the use of any and all derivatives for whatever purpose. Although this is not necessarily an incorrect decision, directors may be exposing themselves to significant legal risks if they unilaterally ban derivatives without doing an assessment of the risks the ban would expose them to.

In one landmark case Compaq Computer Corporation was sued by its shareholders for not disclosing that it did not hedge the firm's exposure to currency risk, though 54 percent of the firm's revenue came from overseas. Moreover, in Brane v. Roth, an Indiana state appellate court held the board members of a grain cooperative personally liable to shareholders for losses due to an untrained and unsupervised manager's failure to implement the board's hedging authorizations.

"As a rule, board members are free from personal liability if they have made, and followed up on, an informed business judgment," explains David Yeres, a partner at Rogers & Wells who specializes in derivatives matters. "They have to act in an informed and diligent manner. What is legally required will differ with the particular facts. But generally, if the proper information is assembled, the systems, personnel and controls are in place, the reports are regular, and the disclosure is adequate, then the possibility of surprising gains or disappointing losses as a result of derivatives shouldn't be a basis for legal action."

"Board members do not need to become rocket scientists," explains Yeres. "But it does mean boards have to ensure their decisions are implemented. The Brane v. Roth decision says the directors' responsibilities haven't ended when they've determined to undertake a hedging strategy. It says they have to make sure it is properly implemented."