The buck stops ... where?

Boards are under pressure--regulatory, legal, fiduciary, stakeholder--to oversee the risk management activities of the company. But many board members are unsure how to approach their risk-related responsibilities. They are uncertain about roles and delineation of responsibility. They wonder where to start and how to bring all the disparate pieces together.

In fact, many options are open to companies as they develop a framework for managing risk. One of the earliest questions that must be addressed: Where does risk oversight belong at the board level? Companies have tried myriad approaches, each of which offers pluses and minuses:

1. Keep risk responsibilities at the full board level. This approach gives risk issues a broad and thorough airing for the entire board membership. However, it can also be unwieldy and inefficient to get into detailed risk considerations with the full body.

2. Delegate overall risk responsibilities to the audit committee. This is a seemingly logical choice. But in the Sarbanes-Oxley era, the audit committee may be the most overworked of all board committees. Financial risk is already on its agenda, as is the less-clear-cut financial risk oversight required by NYSE listing standards. Piling on operational, strategic and enterprise-wide risks may present an undue burden that could result in insufficient oversight.

3. Create a risk management committee. This option represents a good choice for many companies (including our parent organization, Deloitte LLP, which recently created a risk committee of its own). Many financial services companies maintain dedicated risk committees; they are less common, but not unheard of, in other industries. Full boards with large memberships are more likely to spin off...