korus m. corporate risk management and …corporate risk management and compliance would a stricter...

Corporate Risk Management and Compliance Would a stricter regulatory approach avoid current financial crises?

Mateusz Korus

July 17, 2009 This is a Bucerius/WHU MLB thesis 14.591 words (excluding footnotes)

Supervisor 1: Dr. Stefan Kröll Supervisor 2: Dr. Carsten Jungmann

2

Corporate Risk Management and Compliance. Would a stricter regulatory approach avoid current financial crises?

Table of content

I. Introduction ....................................................................................................................6

II. Economic concept of corporate risk management and compliance ..................................8

1. Economic concept of corporate risk management function ..........................................8

a) Concept of risk .....................................................................................................8

b) Risk management ................................................................................................ 11

c) General principles regarding risk management process ....................................... 13

2. Economic concept of corporate compliance function ................................................. 15

3. Interplay between risk management and compliance ................................................. 18

III. Regulatory approach ................................................................................................. 19

1. Regulations on risk management and compliance under German law ........................ 19

a) Risk management ................................................................................................ 19

aa) Special provisions on risk management for financial services industry .............. 23

bb) The reform of risk management provisions under German law .......................... 25

b) Compliance ......................................................................................................... 26

2. Regulations on risk management and compliance in international perspective ........... 28

a) Risk management ................................................................................................ 28

aa) U.S.A. ............................................................................................................... 28

bb) European Union ................................................................................................ 30

cc) National corporate governance code .................................................................. 33

dd) Basel II and Solvency II .................................................................................... 34

b) Compliance ......................................................................................................... 36

IV. Current financial crises and economic losses due to a non-compliant behaviour. Comparing legal risk management and compliance framework ..................................... 38

1. Sub-prime crunch ...................................................................................................... 38

a) General overview ................................................................................................ 38

b) Risk management failures ................................................................................... 40

c) Compliance failures ............................................................................................ 41

2. Global credit crunch and financial crises ................................................................... 42



c) Compliance failures ............................................................................................ 47

3. Economic recession .................................................................................................. 49


3


c) Economic losses due to non-compliant behaviour ............................................... 50

V. Would a stricter regulatory approach avoid current financial crises? Considerations de lege ferenda. ................................................................................................................. 52

1. Specifying general corporate risk management requirement ................................ 52

2. Risk assessment and credit ratings ...................................................................... 53

3. Auditing.............................................................................................................. 54

4. Accounting standards .......................................................................................... 56

VI. Conclusions .............................................................................................................. 58

Bibliography......................................................................................................................... 60

4

Abbreviations

ABS..................................................... Asset-backed securities

AktG.................................................... Aktiengesetz

ARM................................................... Adjustable-rate mortgages

Art....................................................... Article

BaFin................................................... Bundesanstalt für Finanzdienstleistungsaufsicht

BB....................................................... Betriebs Berater

BCFS................................................... Basel Committee for Financial Supervision

BCGC.................................................. Belgian Corporate Governance Code

BGBl................................................... Bundes Gesetzblatt

BilMoG............................................... Bilanzrechtsmodernisierungsgesetz

CDS..................................................... Credit default swap

COSO.................................................. Committee of Sponsoring Organizations of Treadway Commission

DCGC................................................. Dutch Corporate Governance Code

e.g........................................................ example

Ed........................................................ Editor

ERM.................................................... Enterprise risk management

et seq................................................... et sequens

EU....................................................... European Union

FASB.................................................. Financial Accounting Standards Board

fn......................................................... footnote

GCGC................................................. German Corporate Governance Code

GDP...................................................... Gross domestic product

Harvard Int’l L. J................................ Harvard International Law Journal

HGB.................................................... Handelsgesetzbuch

i.a......................................................... inter alia

Ibid...................................................... ibidem

ICS...................................................... Internal Control System

5

IDW PS 340....................................... IDW Auditing Standard: The Audit for Risk Early Recognition System Pursuant to § 317 (4) HGB

IDW.................................................... Institut der Wirtschaftsprüfer in Deutschland e.V.

IRB...................................................... Internal rating approach

KonTraG............................................. Gesetz zur Kontrolle und Transparenz im Unternehmensbereich

KWG................................................... Kreditwesengesetz

MBCA................................................. Model Business Corporation Act

NZG.................................................... Neue Zeitschrift für Gesellschaftsrecht

OTC.................................................... Over-the-counter securities

p.......................................................... page

pp........................................................ pages

PR........................................................ Public relations

RM...................................................... Risk management

RMS.................................................... Risk management system

SOX.................................................... Sarbanes-Oxley Act

U.S...................................................... United States

UK....................................................... United Kingdom

VAG.................................................... Versicherungsaufsichtsgesetz

ZRP..................................................... Zeitschrift für Rechtspolitik

All electronic sources have been last visited on 15.07.2009

6

I. Introduction

Corporate risk management and compliance have become of increasing importance during

last years. This has specially been the case due to new legislative initiatives at the

international and national level. The enactment of risk management provisions under national

jurisdiction –extending the duty program of management with elements of a professional risk

management, as well as implementation of industry related, but especially financial services,

requirements opened a wide discussion on the rationale and shape of a prospective legal risk

management framework. Also corporate compliance has been a subject to several theoretical

and practical discussions due to many changes in law during last decades. The enactment of

the U.S. Sarbanes Oxley Act (SOX) and a general trend in amending national corporate

governance frameworks with the obligation for a professional compliance approach brought

new perspectives and requirements on organizational structure in corporations.

Connecting risk management and compliance with the title question is not a coincidence.

Even though both areas are regulated separately, corporate risk management and compliance

are operating on the base of same principles. They can be both considered as a part of

corporate internal control systems. Developed in a responsible way, they both have the same

risk based appendage. And, as a result of this, both functions have the aim to control current

management processes and provide suitable approach helping to reduce any inappropriate,

damaging events to the organization. Due to this, corporate risk management and compliance

can be seen as complementary functions.

There have been several voices of critic, blaming the current, weak as many say, risk

management and compliance frameworks for current financial crises and worldwide

economic recession, one that has not been seen since the Great Recession in the early 30s of

the XX century. This paper tries to deal with general principles and concepts, trends and

mechanisms of risk management and compliance frameworks. The aim is to analyse the legal

environment with strong economic emphasis in order to find additional answers at the end

whether different risk management and compliance approaches would be able to prevent the

current crises happen. The paper itself has been divided into four parts – the first part tries to

show general economic (practical) mechanics of risk management and compliance; the second

part draws a picture on the national and international legal environment; the third tries to

create a general overview on main stages which brought up the international crises linking the

7

events to risk management and compliance failures; and the fourth part includes the title

analysis with opening a window for future developments.

8

II. Economic concept of corporate risk management and compliance

1. Economic concept of corporate risk management function

a) Concept of risk

Dealing with risks is making up an extremely important part of the management life.1 All

business activities like decisions or engagements are bearing a certain level of unpredictability

(uncertainty).2 This unpredictability is related to potential chances and risks.3 Using a simple

language a chance will mean a potential economic profit, the risk will mean potential

economic loss. Any business activity, especially every business decision, can be described as

acting under risk.4 That is the reason why the managerial dealing with risks has become an

important part of business practise.5 The risk itself, as a factor, is representing an essential

part of modern business decision-making theory.6

Risk in the business sense can be described as a condition involving exposure to events that

would have a negative effect on the company’s objectives.7 A company can face several types

of risks. The risk exposure may have an impact on the income structure of a company, its

investments, reputation, technology capabilities and other positions.8 The events may also lay

outside the organization – e.g. in the political, economic or legal environment.9 For a bank

risk will be linked to the possibility that a customer is not willing to pay its credit back. For a

automobile producer the fact of whether he will be able to sell all produced cars or not

represents a risk factor. From the economic perspective, risks themselves can be described by

two basic criteria: probability of occurring and quantification of potential financial impact

(like the extend of losses). This requires a standardized approach within organization. Risks

are then reduced to single risk positions.

1 P. Montana, B. Charnov, Management (2000), pp. 73-74. 2 P. Drucker, Management (2007), p. 125. 3 R. Kalwait, R. Meyer, R. Erben, Fr. Romeike, O. Schellenberger, Risikomanagement in der Unternehmens-führung (2008), p. 51. 4 L. Johanning, Risikomanagement in: W. Ballwieser [ed.], W. Grewe [ed.], Wirtschaftsprüfung im Wandel (2008), p. 259. 5 ibid. 6 A very interesting analysis of the issue: A. McLucas, Decision making (2003), pp. 185 et seq. 7 A. Bowden, M. Lane, J. Martin, Triple bottom line risk management (2001), p. 3. 8 D. Olson, D. Wu, Enterprise Risk Management (2007), pp. 5-6; R. Bowden, M. Lane, J. Martin, Triple bottom line risk management (2001), p. 3. 9 ibid.

9

Like Illustration 1 presents, enterprise risks can be generally divided into two general groups:

financial and non-financial risks.

Illustration 1 – Risk types within a financial institution

(based on UBS, UniCredit Group and Deutsche Bank AG)

Financial risks are directly related to money losses when a certain event occurs. Those risks,

basing on the examples of UniCredit Group and Deutsche Bank AG, can be divided into:

• Credit risk (counterparty risk)10 – risk that a change in credit quality of a

counterparty will affect the value of a organization’s position. Default is the extreme

case, where a counterparty is unwilling or unable to fulfil its contractual obligation11

• Market risk12 – risk of changes in the financial market prices and rates which will

reduce the value of the organization’s financial situation. Market risk is generally

associated with interest rates, exchanges rates, stock prices and commodity prices13

10 Practical example: Risk management program, UniCredit Group, available at: http://www.unicreditgroup.eu/ ucg-static/downloads/credit_risk_ENG.pdf. 11 M. Ammann, Credit risk valuation (2001); C. Bluhm, L. Overbeck, Ch. Wagner, An introduction to credit risk modeling (2002). 12 Practical example: Risk management program, UniCredit Group, available at: http://www.unicreditgroup.eu/ ucg-static/downloads/market_ risk_ENG.pdf. 13 R. Gallati, Risk management and capital adequacy (2003), pp. 34-37.

10

• Liquidity risk14 – risk that the organization will not be able to meet its current and

future payment obligations in full or on time15

Non-financial risks can be understood as events that at the time when they occur do not

directly bear the changes of financial positions in an organization (like wrong assumptions in

strategy, court proceedings, negative PR in press etc.). Still, those categories may also bring

financial consequences like expenses or losses. An example distinction:

• Operational risk16 – risk of losses arising from failed or inadequate processes, from

human errors, technical failures or from external events including:

� Operative risk – failures and errors inside an organization17

� Systemic risk – events in the macro environment18

• Strategic risk – risk of losses due to wrong decisions at strategic, long-term level (e.g.

assumption on client preferences) or changes in market environment (government

policy changes)19 including:

� Legal risk20 – risk of legal liability in case legal or contractual obligations will

be disturbed (Crossing point with corporate compliance)21

� Reputation risk22

– negative image and PR due to a future event23

� Business risk24

– risks related to wrong business decisions or non-financial

events, like drop in sales, causing monetary losses25

� Political and social risk26

– risk related to changes in political and social

environment27

14 Practical example: Legal, Risk & Capital function at Deutsche Bank AG, available at: http://www.db.com/de/ content/company/legal_risk_capital.htm?dbiquery=null%3Arisk+management. 15 P. Jorion, Value at Risk (2000), pp. 340 et seq. 16 Practical example: Risk management program, UniCredit Group, available at: http://www.unicreditgroup. eu/ucg-static/downloads/operational_ risk_ENG.pdf. 17 Ibid. 18 R. Effros, Current legal issues affecting central banks (1998), pp. 111-112. 19 G. van den Brink, F. Romeike, Corporate Governance und Risikomanagement im Finanzdienst-leistungsbereich (2004), p. 90. 20 Practical example: Legal, Risk & Capital function at Deutsche Bank AG, available at: http://www.db.com/ de/content/company/legal_risk_capital.htm?dbiquery=null%3Arisk+management. 21 P. Jorion, Value at Risk (2000), pp. 20 et seq. 22 Well developed within the Risk management program, UniCredit Group, available at: http://www.unicredit group.eu/ucg-static/downloads/reputational_risk_ENG.pdf. 23 M. Power, The Risk Management of Everything (2004), pp. 35 et seq. 24 Practical example: Legal, Risk & Capital function at Deutsche Bank AG, available at: http://www.db.com/ de/content/company/legal_risk_capital.htm?dbiquery=null%3Arisk+management. Here, managing business risk will be included in the scope of the Treasury function tasks. 25 H. Scott, Capital adequacy beyond Basel (2005), p. 263. 26 Practical example: Risk Management Handbook, UBS, available at: http://www.ubs.com/1/ShowMedia/ investors/annual_reporting2005/handbook/0027? contentId=96467&name=hb0506_e_FINAL_web.pdf. 27 R. Daft, R. Allen, E. Sandburg, Management (2008), pp. 110-111.

11

b) Risk management

In order to deal effectively with risks in an organization, there is a systematic process

approach needed. The process itself will be described as risk management (RM) and will be

realized with the organizational support of a risk management system (RMS)28 providing

necessary recourses. A widely accepted RM-definition has been proposed by the U.S.

Committee of Sponsoring Organizations of Treadway Commission (COSO), where Risk

management means:

"A process, effected by an entity's board of directors, management and other

personnel, applied in strategy setting and across the enterprise, designed to identify

potential events that may affect the entity, and manage risks to be within its risk

appetite, to provide reasonable assurance regarding the achievement of entity

objectives."29

According to another definition risk management concerns a process in which an organisation

methodically addresses the risks attaching to their activities with the goal of achieving

sustained benefit within each activity and across the portfolio of all activities.30 Risk

management itself can be seen as a wide, cross-divisional business support function inside an

organization.31 All functions of a company like corporate finances, strategy, sales, logistics,

etc. are facing within management process several risks. Using a risk management system can

help to limit losses or failures due to exposure to risks and strengthen the chance of achieving

competitive advantage.32 An effective risk management has to include all risks related to all

corporate functions within a one risk map also known as company’s risk portfolio.33

The importance of risk management has grown rapidly during last 20 years.34 This has been

the case as the business environment became more complex and sophisticated and the

development of technology brought the possibility of using new techniques to developed

standardized mathematical models on risks.

28 In the U.S. called “enterprise risk management” (ERM), e.g. terminology of COSO Enterprise risk management – integrated network. 29 COSO Enterprise risk management – integrated network, available at: http://www.coso.org/Publications/ ERM/COSO_ERM_ExecutiveSummary.pdf. 30 F. Romeike, Lexikon Risiko-Management (2004), p. 151. 31 P. Witt in P. Hommelhoff, K. Hopt, A. v. Werder, Handbuch Corporate Governance (2003), p. 249; more about integrating risk management with other corporate functions: Ch. Culp, The risk management process (2001), pp. 216 et seq. 32 T. Merna, F. Al-Thani, Corporate Risk Management (2008), pp. 153, 187, 224, 350. 33 F. Romeike, Lexikon Risiko-Management (2004), p. 151. 34 D. Chew, Corporate Risk Management (2008), p. 323.

12

Important is to define the distinction between risk management (RM) and internal control

systems (ICS). Internal controls can be described as special measurement instruments (checks)

that help to assess whether financial and non-financial goals of an organization are

achieved.35 The theory has not developed one view on the relation between RM and ICS. In

one opinion, risk management is seen as a part of internal controls, in other, ICS is defined as

part of RM.36 But following either opinion, effectiveness of both systems will be based on a

standardized monitoring function which focuses “limitation of financial losses and

operational failures”.37 Risk management will use a risk based approach and internal controls

will be focusing broader multidisciplinary scope of measurement points. Both systems can be

seen as complementary and integrate-able.38 How complex a corporate risk management

organization integrated within an ICS can be shows Illustration 2.

Illustration 2 – Organization of risk management at UBS (source: http://www.ubs.com/1/ShowMedia/investors/annual_reporting2005/handbook/0027?

contentId=96467&name=hb0506_e_FINAL_web.pdf)

35 A. Trenerry, Principles of Internal Control (1999), pp. 6 et seq. 36 M.Leitch, Intelligent Internal Control and Risk Management (2008), p. 20. 37 D. Chorafas, Implementing and auditing the internal control system (2001), p. 30. 38 A. Friedman and S. Miles, Stakeholders: Theory and practise (2006), p. 256.

13

c) General principles regarding risk management process

Risk management is broadly seen as a central part of corporation’s strategic management.39

This means that the essential base for the whole system shall be included in the company’s

strategy. The corporate strategy includes main mid-term and long-term strategic objectives

and goals that the organization wants to achieve. Those aims can be seen as chances for the

company to achieve a competitive advantage in the market. All chances, due to uncertainty,

are bearing a certain scope of risks. As the best approach, governing the organization’s risk

shall be related to encouraging the chances to be achieved. That is why the company’s

strategy shall include chances and risks.40 The risks shall be categorized in one organization-

wide document – risk portfolio or map. This portfolio includes only categories where the

exposure, due to certain types of risks, exists. At the strategy level risks are only localized and

defined, but not quantified.41 The strategy shall also include a general approach on how

certain risks will approached while occurring – the objective setting.42 There are four possible

approaches toward risks:

• Risk acceptance – This means the acceptance for losses or failures in case an event would

occur. In case of financial losses the company should have prepared reserves (credit lines

or cash). The loss itself will then be consolidated within the company’s accountings.43

• Risk avoidance – The company wants to avoid or not be engage in any situation linked to

risks (e.g. not to invest in an unstable country). Gaining economic profit is always related

to risks. There is no profit without the risk bearing. Correctly, the higher the risk the

higher the potential profit but also the higher the risk of losses or failures.44

• Risk reduction – Due to this approach, the risks are not avoided, so possible losses or

failures may occur. The organization from its side tries to implement certain steps in order

to reduce the risks (e.g. hedging the currency risk of a transaction).45

• Risk transfer – The risks are shifted to third parties (e.g. to insurance companies). Even

though the company does not bear the risk, this approach still generates costs such as the

39 e.g. – Risk Management Standard of The Institute of Risk Management (IRM),The Association of Insurance and Risk Managers (AIRMIC) and ALARM The National Forum for Risk Management in the Public Sector, p. 2., available at: http://www.theirm.org/publications/documents/Risk_Management_Standard_030820.pdf. 40 P. Drucker, Management (2007) , pp. 125 et seq. 41 Ibid. 42 Ibid. 43 R. Moeller, COSO Enterprise Risk Management (2007), p. 78. 44 Ibid. 45 Ibid., p. 77.

14

counterparty requires a risk fee (price for bearing the risk – e.g. insurance premium). So,

the higher the risk, the higher the price for transferring it.46

As shown on Illustration 3, risk management can be seen as a permanent, ongoing process.

This process can be divided into five main stages: risk identification on strategic and

operative stages, risk assessment, risk treatment, risk communication and risk monitoring.

Illustration 3 – Corporate risk management framework as process cycle (based on: F. Romeike, R. Finke, Erfolgsfaktor Risikomanagement: Chance für Industrie und Handel, Lessons

learned, Methoden, Checklisten und Implementierung (2000), p. 153)

• Risk identification – has two levels. First, as described above, the management within the

corporate strategy prepares a company’s risk portfolio. At this level, the risks to which the

company is exposed (general risks and categories of risks as event identification) have to

be detected and categorized. Second, as the risk portfolio is developed, it will be the duty

46 D. Chew, Corporate Risk Management (2008), p. 210-212.

15

of management to identify the single risks in the daily business conduct and take over the

risk positions.47

• Risk assessment – once a risk is identified it needs to be estimated and transformed into

mathematical terms. The risk assessment includes estimation of the probability that a risk

related event may occur and the scope of its impact (quantification of losses).48

• Risk treatment (response) – means the factual dealing with risks. It includes all actions or

activities that will serve as an answer on the risk position. The process of selecting and

implementing measures shall result in modification of the risk position. The measures will

contain – risk acceptance, risk avoidance, risk reduction or risk transfer.49

• Risk monitoring (control) – includes monitoring of identified, assessed and treated risk

positions. It may serve to evaluate the effectiveness of risk treatment. It can be also used

to monitor the effectiveness of the whole RMS (e.g. existence of appropriate RM-controls

or monitor of implementing the RM-procedures by the employees).50

• Risk communication – The results of risks identification, assessment and treatment need

to be communicated. They can be communicated internally within the company (e.g. to a

higher business unit or to the senior management) or externally (e.g to shareholders or

other stakeholder). The external reporting at listed companies is typically sanctioned

under the law (requirement of risk reporting).51

How the system shall be structured in details depends on the company itself and the business

sector. In financial industry it is much easier and more important to establish a sophisticated

RMS, as money is the primary “product” and the risk assessment, communication and

treatment can be – to a higher extend – automatized. In a production industry the RMS will be

focused on different categories. The system itself will not need as much resources and the

profit can be achieved sometimes even already by implementing a corporate “risk culture”.

2. Economic concept of corporate compliance function

Compliance generally means following the provisions of law and internal regulations.52 In

general, everyone bears the obligation for a compliant behaviour. On the corporate level this

47 Ch. Culp, The risk management process (2001), p. 210. 48 Ibid., p. 211. 49 A. Bowden, M. Lane, J. Martin, Triple bottom line risk management (2001), p. 93. 50 COSO Enterprise risk management – executive summary, p. 2, available at: http://www.coso.org/Publications/ ERM/COSO_ERM_ExecutiveSummary.pdf. 51 Ch. Culp, The risk management process (2001), pp. 211-212. 52 Legal definition - 4.1.3 German Corporate Governance Code. See infra fn. 91.

16

requirement can be fulfilled with the support of a separated organizational structure equipped

with own resources. There are several functions associated with corporate compliance.

The main function of corporate compliance is reducing the risk of legal liability of the

company, its management and employees.53 This can be seen as a protection function and can

be only achieved with a risk-based compliance approach. Compliance organization shall also

be focused on providing support to employees in form of internal proper conduct standards. It

should be fully committed in setting internal standards and processes. The internal rules can

form a framework of different types and levels of conduct provisions (example of Daimler AG

– Illustration 4).54 At the same time, the compliance structure shall ensure that compliance

Illustration 4 – System of internal (compliance) regulations at Daimler AG (source: http://ar2008.daimler.com/reports/daimler/annual/2008/gb/English/602010/our-understanding-of-

compliance-and-our-principles.html.)

relevant information will be provided to addressees (information and communication

function).55 This can be specially ensured by offering dedicated trainings or providing other

forms of education and by giving the possibility for consultation and advising on compliance

issues (advise function).56 The establishment of compliance framework with own resources,

internal rules and processes may strengthen the governance processes, as the identified

responsibilities and defined processes can bring more clearness and overview on the

53 F. Banks, Corporate Legal Compliance Handbook (2002), pp. 135, 169; B. Youngberg, The Risk manager's desk reference (1998), pp. 112-113. 54 T. Lösler, Das moderne Verständnis von Compliance im Finanzmarktrecht, NZG 2005, p. 105. Practical example: Compliance program of Daimler AG, available at: http://ar2008.daimler.com/reports/daimler/annual/ 2008/gb/English/602010/ our-understanding-of-compliance-and-our-principles.html. 55 Practical example: METRO Group, METRO Group Compliance Program, available at: http://www.metro group.de/servlet/PB/menu/1138270_l2/ index.html. 56 T. Lösler, Das moderne Verständnis von Compliance im Finanzmarktrecht, NZG 2005, p. 105. Practical example: Merck & Co., Inc. Comprehensive Compliance Program, available at: http://www.merck.com/about/ compliance/ ccp.html.

17

governance structures of the organization.57 As seen at the UniCredit Group, corporate

compliance can serve as a value creation function as well.58 This is specially the case, when

the output of a compliance program will have the form of a better firm’s reputation,

stakeholder confidence and better perspectives for sustainability.59 The approach, how an

organization deals with its compliance program outside of the company, can also bring some

advantages to the corporation. Within the marketing function, the organization can use its

compliance program as a positive massage within PR what can encourage the firm’s image.

Compliance can also bear the preventive function. By setting and communicating clear

network of rules it can reduce the number of cases of improper conducts. Also regular

monitoring and audit of the business activities can help to ensure that compliance is being

adopted.60 Dealing with compliance risks shall also prevent the organization from reputation

damages like corruption scandals. A sensitive compliance network should specially deal with

minimizing the situations of a conflict of interests in relation to the company, its employees

and the external environment.

As this is the case in RMS, the structure of corporate compliance will also depend on

company’s and industry’s specifics. For example, the most common areas covered by the

German corporations are corruption61 and anti-competition62.63 But a corporate compliance

program, as the case of BASF Group, may also cover more topics like:

• Industrial and plant safety

• Protection of health and environment

• Antitrust regulations

• Insider knowledge

• Ban on exploiting knowledge of internal processes for personal purposes

57 E.g. see the objectives of the ING Group Compliance Risk Management Charter and Framework, available at: http://www.ing.com/group/ showdoc.jsp?docid=139868_EN&menopt=cog|coc|gpo. 58 Practical example: Compliance function at UniCredit Group, available at: http://www.unicreditgroup.eu/ en/Governance/ compliance.html. Effective compliance ensuring good corporate governance can be seen as an important pillar in corporate value creation, T. Clarke, International corporate governance (2007), pp. 45 et seq. 59 J. Doorley, H. Garcia, J. Osborn, Reputation Management (2006), p. 52. Practical example: GlaxoSmithKline Compliance Programme, available at: http://www.gsk.com/about/corp-gov-ethics.htm; Compliance function at UniCredit Group, see supra fn. 61 60 Practical example: Coca-Cola Company Ethics & Compliance, available at: http://www.thecoca-colacompany.com/citizenship/ governance_ethics.html. 61 J. Campos Nave, S. Bonenberger, Korruptionsaffären, Corporate Compliance und Sofortmaßnahmen für den Krisenfall, BB 2008, p. 734. 62 G. Pampel, Die Bedeutung von Compliance-Programmen im Kartellordnungswidrigkeitenrecht, BB 2007, p. 1636. 63 R. Lothert, J. Greve in: Ch. Hauschka [ed.], Corporate Compliance (2007), § 17 para 17 and § 24 para 62 et seq.; Ch. Hauschka, Von Compliance zu Best Practice, ZRP 2006, pp. 258-260; Ch. Hauschka, Der Compliance-Beauftragte im Kartellrecht, BB 2004, p. 1178.

18

• Embargo and trade control regulations

• Handling company property and the property of our business partners

• Money laundering

• Dealing with business partners and representatives of government bodies.64

Corporate compliance can be seen as a supporting function to internal controls as – defined

within the UniCredit Group – a “second-level internal control system”.65 Within this scope,

compliance will incorporate also set of controls and checks (e.g. in form of KPI66) measuring

the quality and effectiveness of the compliance program. This states that compliance can be

understood also as a part of organization’s ICS.

3. Interplay between risk management and compliance

Corporate compliance and risk management are very often considered as being a part of a one

corporate platform – GRC (Governance, Risk Management, Compliance). With a risk based

approach combining both governance structures in an organization can be enhance an

interesting protection system.67 As the example of ING Group shows, combining risk

management with compliance can bring potential synergies and more transparency.68

64 Practical example: Compliance Program of the BASF Group, source: http://www.basf.com/group/corporate/ en/about-basf/ vision-values-principles/code-of-conduct/index. 65 Practical example: Compliance function at UniCredit Group, see supra fn. 61. 66 Key Performance Indicators – set of measures focusing organizational performance, critical for future success of a company (or function, project, etc.), D. Parmenter, Key performance indicators (2007), pp. 3 et seq. 67 P. Purpura, Security and Loss Prevention (2007), pp. 260 et seq.; L. Geishecker, R. Weston, Risk! (2007), pp. 125 et seq.; N. Pal, From Strategy to Execution (2008), pp. 168 et seq. 68 ING Group Compliance Risk Management Charter and Framework, see supra fn. 60.

19

III. Regulatory approach

1. Regulations on risk management and compliance under German law

a) Risk management

The first step toward sanctioning the legal requirement of risk management under German

law has been made in 1998 by establishing the Corporate Control and Transparency Act

(KonTraG).69 This act has the aim to serve as a legal reaction on corporate “negative

developments” in Germany from the previous years and established a minimum requirement

for companies that would help to avoid the corporate crunches.70 Under KonTraG a broader

corporate law reform had to be proceeded.71

With the new § 91(2) AktG, the German legislator put on the management board of a stock

corporation the obligation for establishing a “monitoring system” so the “early detection of

any risks endangering the continued existence of the company”72 could be ensured.73 This

early monitoring system had been given due to the new § 317 (4) HGB under the audit of the

certified auditors.74 There are several difficulties concerning the fulfilment of the § 91(2)

AktG requirement. First of all, the legislator uses a very general language connecting the

expressions “monitoring system” and “early detection”, without using the expressions risk

management or risk controlling. Even though, the German doctrine75 established a harmonic

interpretation of § 91(2) AktG and it is commonly understood that the “early monitoring

system” stands for a requirement of a risk detection system being a part of an economic risk

management notion.76 As there are no indications for how this system has to be structured, the

69 K. Wolf, B. Runzheimer, Risikomanagement und KonTraG, Edition 4 (2003), p. 21. 70 T. Martin, T. Bär, Grundzüge des Risikomanagements nach KonTraG (2002), p. 37 – the authors are pointing specially the corporate crunches of Metalgesellschaft, Schneider, Balsam, Sachsenmilch. 71 K. Wolf, B. Runzheimer, Risikomanagement und KonTraG (2003), p. 21; S. Lingemann, D. Wasmann, Mehr Kontrolle und Transparenz im Aktienrecht: Das KonTraG tritt in Kraft, BB 1998, p. 853-862. 72 Can be linked also with the Business Judgment Rule and prudent businessman requirement. 73 Technically this has not been seen as an essential improvement, as also before the KonTraG, due to §§ 76 and 93 AktG the board was obliged to provide an appropriate organization within the corporation and detect imperiling developments, Begr. RegE BT-Drucks. 13/9712 p. 15; G. Spindler in H. Fleischer, Handbuch des Vorstandsrechts (2006), § 19 para 6. 74 G. Spindler in: Münchener Kommentar zum Aktiengesetz (2008), § 91 para 1. 75 M. Kort in: K. Hopt, H. Wiedemann [ed.], Aktiengesetz Großkommentar (2008), § 91 para 30 et seq; G. Krieger, V. Sailer in: K. Schmidt, M. Lutter [ed.], Aktiengesetz Kommentar (2008), § 91 para 6 et seq. 76 This is also because the legislator itself in the explanation to the KonTraG brought that risk management is a part of the duty of care of a prudent businessman, Begr RegE BT-Drucks 13/9712, p. 15.

20

German doctrine makes organization dependent on size and business segment characteristics

of the company.77 This means that the board has a wide discretion in fulfilling this

requirement.78 There are no doubts in literature that the scope of § 91(2) AktG is covering

also German partnership limited by shares (KGaA) and mutual insurance company (VVaG).

Discussed is the applicability to the limited liability company (GmbH).79

The existence of the “early monitoring system” has been included into the program of the

mandatory annual audit under § 317 (4) HGB.80 Under the general clauses of § 91(2) AktG

there are only few indications concerning the scope of audit. It is commonly understood that

assessment shall not evaluate whether a company is equipped in a full risk management

system including treatment of risks (so whether the risks have been properly treated by the

management board).81 The audit shall be rather focused on whether the risk detection,

analysis, assessment, communication and the linked monitoring system is covering all risks

and business areas, and whether the system fits to the structure of the company.82 So the audit

is not assessing the processes working in the company, but checking the systematic

arrangement and its “operability”83.

The German legislator put hardly no indications on the content of the monitoring system. This

space has been filled by the Institute of Public Auditors in Germany84 (IDW) which

introduced the IDW Auditing Standard 340 (IDW PS 340)85. This act has been especially

designed as a recommendation list for auditors having to assess the requirements set in §

91(2) AktG in connection with § 317 (4) HGB. The IDW PS 340 defines what the scope86 is

and how the plan87 for the audit should be prepared. It also recommends how the conduct of

the audit88 should be taken and the reporting89 of the results should be proceeded. But, more

77 M. Kort in: K. Hopt, H. Wiedemann, Aktiengesetz Großkommentar (2008), § 91 para 69. 78 Ibid. 79 As suitable shall be considered an adequate applicability of § 91(2) AktG to GmbH being part of a group of companies, where the parent entity is required to fulfill the requirement of an early monitoring system, G. Spindler in H. Fleischer, Handbuch des Vorstandsrechts (2006), § 19 para 4. 80 This provision is sanctioning the obligation of § 91(2) AktG and serves for its execution but with limitation only to the companies listed on the stock exchange, W. Ebke in: Münchener Kommentar zum Handelsgesetzbuch, 2. Edition (2008), § 317 para 79. 81 F. Wall, Komptabilität des betriebswirtschaftlichen Risikomanagements mit den gesetzlichen Anforderungen?, WpG 56/2003, pp. 457, 471. 82 W. Ebke in: Münchener Kommentar zum Handelsgesetzbuch (2008), § 317 para 82. 83 S. Fiege, Risikomanagement- und Überwachungssystem nach KonTraG: Prozess, Instrumente, Träger (2006), G. Krieger, V. Sailer, in: K. Schmidt, M. Lutter [ed.], Aktiengesetz Kommentar (2008), § 91 para 16. 84 Institut der Wirtschaftsprüfer in Deutschland e.V., privately run incorporated association which members are 86.68% of all German Public Auditor. 85 The full title – “IDW Auditing Standard: The Audit for Risk Early Recognition System Pursuant to § 317 (4) HGB”. 86 IDW PS 340.19. 87 IDW PS 340.20-23. 88 IDW PS 340.24-31.

21

interesting is the fact that the IDW PS 340 gives also a roadmap for the management board

how to create an “early monitoring system” due to § 317 (4) HGB. There can be following

measures divided:

• Determination of risk areas that may lead to developments endangering the going on

concern (IDW PS 340.7-8),

• Rules for the recognition and analysis of risks (IDW PS 340.9-10),

• Risk communication inside the company (IDW PS 340.11-12),

• Assignment of responsibilities and duties within the structure and for employees of the

company (IDW PS 340.13-14),

• Establishment of a monitoring system (IDW PS 340.15-16),

• Documentation requirements concerning the “early monitoring system” (IDW PS

340.17-18).

As it can be seen on Illustration 5, the standard provides also a guide for risk treatment

mechanisms. This has been included especially in the risk absorption and risk acceptance

functions. Even though the IDW PS 340 gives a wide map on how to develop a risk

recognition system within a company. Still, the nature of this act is unbinding. It has been

developed only as an outline for certified public auditors. As IDW is associating more than

85% of the PCA’s in German and as annual audits have an important impact on companies

themselves, the auditing standards released by the IDW are commonly implemented in

Germany.

89 IDW PS 340.32-33.

22

Illustration 5 – Risk management under IDW Auditing Standard 340 (source: G. van den Brink, F. Romeike, Corporate Governance und Risikomanagement im Finanzdienst-

leistungsbereich (2004), p. 90)

Parallel to this, the provision of § 91(2) AktG has an equivalent in the German Corporate

Governance Code (GCGC)90. Under 4.1.4 GCGC, there exists a requirement for an

appropriate risk management and risk controlling. Risk management shall be here understood

as a full function risk management including risk identification, assessment, treatment,

monitoring and communication.91 Risk controlling can be understood as a risk early

monitoring system.92 What is very interesting according to introduction of the GCGC. The

part including provision 4.1.4 contains no recommendations, but restatement of law. Even

though, the legislator does not use the terminology of 4.1.4, the provision itself shall be

connected to § 91(2) AktG.93 At the same time the German Corporate Governance Code sets

some other interesting accents. First, due to 4.1.4 GCGC, the code stresses the required

90 The Government Commission on the German Corporate Governance Code, German Corporate Governance Code of 2008, http://www.corporate-governance code.de/eng/download/ E_Kodex %202008_final.pdf. 91 R. Ringleb in: R. Ringleb, T. Kremer, M. Lutter, A. v. Werder, Kommentar zum Deutschen Corporate Governance Kodex (2005), para 657. 92 Ibid., para 643. 93 Ibid., para 640.

23

management board and supervisory board for cooperation in questions of risk management.94

Second, in accordance to 3.4 GCGC, management has to supply continually the supervisory

board with all relevant risk information. Third, under 5.2 GCGC, the chairman of the

supervisory board has a special advisory function to the management on risk management

questions. It has to be stressed that the GCGC is only applicable to capital corporations listed

on German stock exchanges.95 This makes the applicability of the 4.1.4 GCGC more limited

comparing to § 91(2) AktG.

aa) Special provisions on risk management for financial services industry

Credit institutions96 and financial service institutes97 enjoy a special regulation on risk

management in Germany.98 The German Banking Act (KWG) requires in its § 25a (1) those

two groups of institutions having an appropriate and effective risk management within the

business organisation. The institutions are obliged to implement a proper strategy and internal

control procedures (including internal control system (ICS) and internal audit (IA))99 in order

to calculate and secure the capacity of their risk bearing.100 A special obligation concerns

internal control system which has to include procedures for risk detection, assessment,

treatment, monitoring and communication.101 ICS has to be organized in a way where the

internal procedures are design with a clear separation of responsibilities.102

The risk management needs to be equipped with “adequate human and organizational

resources” and well prepared “contingency plan”.103 The main distinction comparing to the

corporate law is that the German banking law requires a full function operating risk

management. So, it is not only important whether the early detection of risks is working but

also whether the detected risks are treated and monitored, so the capacity of the risk bearing

of the institute is not endangered. Still, the German legislator left space for discretion again.

Under § 25a (1) KWG the criterion for risk management is being appropriate, so the way of

how the system will be designed may dependent on the “type, scope, complexity and risk

94 R. Hilz-Ward, O. Everling and N. Löhndorf, Risk Performance Management (2009), p. 19. 95 Ibid. 96 German „Kreditinstitute“ 97 German „Finanzdienstleistungsinstitute“ 98 U. Braun in: K. Boos, R. Fischer, H. Schulte-Mattler, Kreditwesengesetz (2008), § 25a para 1 et seq. 99 G. Hellstern in: G. Luz, W. Neus, P. Scharpf, P. Schneider, M. Weber [ed.], Kreditwesengesetz (KWG) (2009), pp. 754-755. 100 § 25a (1) para 1 KWG. 101 § 25a (1) para 1 (b) KWG. 102 § 25a (1) para 1 (a) KWG. 103 § 25a (1) para 2 and 3 KWG.

24

level of the institutes’ business activity”.104 So it depends on the banks profile – whether the

institute will offer simple products like a consumer bank or if it is offering a greater portfolio

of complex and sophisticated products like a wholesale or investment bank.105 The provision

of § 25a (1) KWG itself looks more like a specification of § 91(2) AktG with relation to the

financial industry. There are still doubts in literature if § 25a (1) KWG has to serve as an

industry related substitute for § 91(2) AktG.106 This is not the case in jurisprudence, that states

the link between § 91(2) AktG and § 25a (1) KWG.107

As the rules set in § 25a (1) KWG are very general, in order to provide an explanatory

framework for them and incorporate the Basel II requirements under German regulatory

framework, the Federal Institution for Supervision of Financial Service (BaFin) released the

“Minimum Requirement for Risk Management” (MaRisk).108 MaRisk encompasses a form of

a “regulation for implementing standards”109 – binding interpretation of BaFin on how a risk

management shall be structured in German financial institutions.110 There are currently two

versions of MaRisk – one is related to German crediting institutions (MaRisk BA)111, the

other is binding German insurance institutions (MaRisk VA)112. Both – MaRisk BA and VA

are very similar. The main difference concerns the implementation of Solvency II113 rules

with regard to German insurance institutions within MaRisk VA.114 While the MaRisk BA is

implementing a big part of Basel II requirements.115

104 U. Braun in: K. Boos, R. Fischer, H. Schulte-Mattler, Kreditwesengesetz (2008), § 25a para. 77. 105 Ibid. 106 U. Hüffer, Die leitungsbezogene Verantwortung des Aufsichtsrates, NZG 2007, pp. 47-49. 107 Decision of VG Frankfurt a.M. from 8 July 2004, 1 E 7363/03 (I), WM 2004, pp. 2157, 2160. 108 G. Hellstern in: G. Luz, W. Neus, P. Scharpf, P. Schneider, M. Weber [ed.], Kreditwesengesetz (KWG) (2009), pp. 755 et seq. 109 German “norminterpretierende Vorschrift”. 110 C. Kraft, Die Mindestanforderungen an das Risikomanagement (2008), p. 11. 111 Circular 05/2007, Banking supervision minimum requirements for risk management (Rundschreiben 05/2007, Bankenaufsicht Mindestanforderungen an das Risikomanagement), available at: http://www.bafin.de/ cln_006/nn_721290/SharedDocs/Veroeffentlichungen/DE/Service/Rundschreiben/2007/rs__0705__ba.html?__nnn=true. 112 Circular 3/2009, Minimum requirements for insurers risk management (Rundschreiben 3/2009, Mindestanforderungen an das Risikomanagement für Versicherer), available at: http://www.bafin.de/cln_109/ nn_721290/SharedDocs/Veroeffentlichungen/DE/Service/Rundschreiben/2009/rs__0903__marisk__va.html?__nnn=true. 113 European Parliament legislative resolution of 22 April 2009 on the amended proposal for a directive of the European Parliament and of the Council on the taking-up and pursuit of the business of Insurance and Reinsurance (COM(2008)0119 – C6-0231/2007 – 2007/0143(COD)), available at: http://www. europarl. europa.eu/sides/getDoc.do?pubRef=-//EP//TEXT+TA+P6-TA-2009-0251+0+DOC+XML+V0//EN. 114 S. Fus, Business Continuity Management bei Finanzdienstleistern (2008), pp. 24-25; V. Altenähr, T. Nguyen and F. Romeike, Risikomanagement kompakt (2004), p. 43. 115 U. Braun in: K. Boos, R. Fischer, H. Schulte-Mattler, Kreditwesengesetz (2008), § 25a para 7 et seq.

25

The MaRisk itself is not a very detailed act. It shall serve more to set some common standards

for the risk management in the financial industry segment.116 With the AT 2.2 MaRisk there

are four categories of risks to be distinguished:

• Counterparty (credit) risks117

• Market price risks

• Liquidity risks

• Operational risks.

The MaRisk includes at the same time further provisions specifying measures required to deal

with those risks.118 The shelf of this act consists of provisions specifying requirements

mentioned under § 25a (1) KWG:

• Risk-bearing capacity and strategy (AT 4.1-2),

• Internal control system (AT 4.3),

• Internal audit (AT 4.4),

• Organisational guidelines (AT 5),

• Documentation requirements (AT. 6),

• Resources (AT. 7).

Important is also that MaRisk has been used to implement provisions of European law on

“requirements for ensuring adequate internal capital to cover all material risks”119, as well as

European standards on financial instruments120.121

bb) The reform of risk management provisions under German law

With enactment of the BilMoG (Act to Modernise Accounting Law)122, German legislator

intended to push the development of German accounting law forward and to implement the

rules of European law under the Directive 2006/43/EC (audit) and the amending Directive

2006/46/EC (accounting).123 This modernization will also have a significant impact on the

116 Ibid. para 78. 117 including country risks. 118 BTR 1-4 MaRisk. 119 Articles 22 and 123 of the Directive 2006/48/EC (Capital Requirements Directive (CRD)). 120 Art. 5,7,8 and 13 of the Directive 2004/39/EC (Markets in Financial Instruments Directive) and Art. 13 and 14 of the Directive 2006/73/EC (Implementing Directive for the Markets in Financial Instruments Directive). 121 MaRisk AT 1.1-3; for more see: G. Hellstern in: G. Luz, W. Neus, P. Scharpf, P. Schneider, M. Weber [ed.], Kreditwesengesetz (KWG) (2009), pp. 759 et seq. 122 Gesetz zur Modernisierung des Bilanzrechts vom 25. Mai 2009, BGBl. I 2009, 1102. 123 A. Müssig, Bilanzielle Risikovorsorge und außerbilanzielle Risikoberichterstattung (2006), p. 181; V. Basin, Die Modernisierung der 8. EU Richtlinie unter Einfluss des Sarbanes-oxley Acts (2009), p. 58.

26

German corporate and business law, especially on requirements concerning risk management.

The core of the new bill in relation to this issue has been included within the new provisions

of § 107 AktG and § 289a HGB.

With the reform, due to the new § 107 (3) sent. 2 AktG-E,124 the supervisory board’s

monitoring responsibility will be extended on monitoring the effectiveness of the company-

wide internal control system (ICS) and the internal risk management system (RMS).125 This

regulation brings wide going implications. Even, when the German legislator has not

introduced a general duty for establishing a full function –RMS, the supervisory board will be

faced with assessing not only existence of RMS but also its effectiveness.126

The second part of the “risk management reform” considers the disclosure requirements. Due

to § 289 V HGB-E, the management board has to describe all main characteristics of the

accounting-related internal control and risk management system in the management report.127

As the management board will be required to provide relevant information on effective

internal RMS to the supervisory board and for the external disclosure purpose, a functioning

corporate RMS will become de facto an obligation. This will be realised without any help

from legislative side on legal description of elementary features of a RMS. This will probably

increase the importance of the IDW PS 340 as an only explanation and road-map for

establishing a German-fitting risk management system.

Incentives concerning more conscious risk decision making can be found also in the German

Management Compensation Bill.128

b) Compliance

The definition of corporate compliance can be found under the German Corporate

Governance Code. Due to provision 4.1.3 GCGC, compliance has been defined as a

124 The scope of new provisions brought with the BilMoG is of significant importance, as the rules shall apply not only to stock corporations (AG) but to all capital market oriented corporations (including Societas Europaea (SE), partnership limited by shares (KGaA), private limited companies (GmbH) as well as cooperatives, mutual benefit societies and commercial partnerships present at the capital market), C. Meyer, Gesetz zur Modernisierung des Bilanzrechts (Bilanzrechtsmodernisierungsgesetz - BilMoG) - die wesentlichen Änderungen, DStR 2009, p. 765. 125 D. Mattheus, P. Hommelhoff, Risikomanagementsystem im Entwurf des BilMoG als Funktionselement der Corporate Governance, BB 2007, pp. 2787 et seq. This responsibility can be delegated to one of the members of the supervisory board. 126 K. Wolf, Zur Anforderung eines internen Kontroll- und Risikomanagementsystems im Hinblick auf den (Konzern-) Rechnungslegungsprozess gemäß BilMoG, DStR 2009, pp. 921 et seq. 127 G. Burwitz, Das Bilanzrechtsmodernisierungsgesetz - Eine Analyse des Regierungsentwurfs und der Änderungsvorschläge des Bundesrats, NZG 2008, p. 699. 128 Entwurf eines Gesetzes zur Angemessenheit der Vorstandsvergütung (VorstAG) from 17. 03. 2009, BT Druck-sache 16/12278, available at: http://dip21.bundestag.de/dip21/btd/16/122/1612278.pdf.

27

managements board responsibility to ensure that “all provisions of law and the enterprise’s

internal policies are abided”. Even though the GCGC is not a binding act, the applicability of

this provision is under German publicly listed capital corporations commonly accepted.129

The German Corporate Governance Code does not contain any further explanations how to

achieve “compliance” within the company.130 The understanding how to fulfil the

requirement, can be reached only in the way of legal interpretation. The provision 4.1.3

GCGC has been included in the part of the Code describing management responsibilities and

tasks in a company. This means that compliance has to play a prominent role within the

management boards duties. The requirement itself can be divided into two levels. Compliance

shall be understood as a broad requirement for legality of all companies’ activities,131 as well

as an organizational duty to establish a compliance system.132 In other words – the

compliance-system has to encourage the establishment and fulfilment of conduct standards

within the company by implementing organizational arrangements.133 The conduct standards

will be here described by the law itself, as well as internal regulations134 released only for the

employees of the company. Specially the internal regulations play an extremely important

role, as they can be used for the purposes of risk avoidance – by showing and

communicating135 to the employees concrete risks and providing ready rules of conduct that

can be applied for those risk-bearing situations.136 Companies, in order to inspirit this

approach, appoint a corporate chief compliance officer who (supported by a slim compliance

organization) is dealing only with compliance aspects.137 Another question is, how the scope

of the corporate compliance should be defined. As there are no legal provisions on the

structure of a compliance system, the management board, in shaping a corporate fitting

compliance structure, shall follow the Business Judgement Rule138 as well as take companies-

and industries characteristics139 into account. At the same time, the requirement of compliance

129 For more, see M. Kort, Verhaltensstandardisierung durch Corporate Compliance, NZG 2008, pp. 83-86. 130 R. Ringleb in R. Ringleb, T. Kremer, M. Lutter, A. v. Werder, Kommentar zum Deutschen Corporate Governance Kodex (2005), para 617. 131 M. Peltzer, Deutsche Coprorate Governance , Ein Leitfaden (2004), p. 48. 132 J. Bürkle, Corporate Compliance – Pflicht oder Kür für den Vorstand der AG, BB 2007, pp. 1797, 1798. 133 M. Kort, Verhaltensstandardisierung durch Corporate Compliance, NZG 2008, p. 83. 134 E.g. Integrity Codes, Codes of Ethics, Codes of Conduct, Internal Guidelines, Policies but also articles of associations or employment contracts and others. 135 Using e.g. the channel of corporate “internal communication function”. 136 R. Lothert, in: Ch. Hauschka [ed.], Corporate Compliance (2007), § 17 para. 2; G. Wecker, H. v. Laak, Compliance in der Unternehmerpraxis, pp. 136, 169; J. Bürkle, Corporate Compliance – Pflicht oder Kür für den Vorstand der AG, BB 2007, pp. 1797, 1798. 137 J. Berwanger, S. Kullmann, Interne Revision (2007), p. 82. 138 O. Sieg, S. Zeidler, in: Ch. Hauschka [ed.], Corporate Compliance (2007), § 3 para. 1 et seq. 139 J. Bürkle, Corporate Compliance – Pflicht oder. Kür für den Vorstand der AG, BB 2007, pp. 1797, 1798.

28

has to be applied within the entire group of companies (Konzern).140 Due to 3.4 GCGC,

management board has to inform the supervisory board “regularly, without delay and

comprehensively” on all compliance related issues. In addition, supervisory board has to

establish an audit committee which will inter alia deal with compliance matters as well (5.3.2

GCGC).

Beside the GCGC, provisions on compliance have been included in legislative acts as well.

This applies specially to the financial services industry. The most prominent example exists

under the German Banking Act (KWG) and Insurance Supervision Act (VAG). With almost

similar provisions,141 the management board of a credit (financial services) or insurance

institution has the duty to create a corporate organization enabling achievement of compliance

with legal provisions. Further requirements can be found in German Securities Trade Act142

and in German competition law143.

2. Regulations on risk management and compliance in international perspective

a) Risk management

aa) U.S.A.

The regulation that influences the environment for risk management in the U.S. at most is the

Sarbanes-Oxley Act of 2002144. This law has been enacted as a reaction on a series of

corporate scandals in the U.S. (especially the cases of Enron145 and Worldcom146) and had to

bring back the trust of shareholders for investing in the U.S. corporate stocks.147 Being

corporate governance regulation, under the SOX the expression of risk management is not

used at any place. The provisions are creating mainly a new framework for mandatory annual

140 Provision 4.1.3, German Corporate Governance Code 2008. 141 § 25a KWG and § 64a VAG. 142 Due to § 33 I WpHG (being a transposition of the MiFID-Directive provisions), all investment firms ("Wertpapierdiensstleistungsunternehmen") have to ensure that the company itself, as well as its employees, are following (so are compliant with) the provisions of the German securities trade law. 143 The requirement for a corporate compliance has not been defined expressis verbis, but a non-establishment of a compliance-system may follow, under some circumstances, negative legal consequences (§ 130 (1) OWiG), K. Rogall, in: L. Senge [ed.], Karlsruher Kommentar zum OWiG (2006), para 1-116; Ch. Hauschka, Der Compliance-Beauftragte im Kartellrecht, BB 2004, p. 1178. 144 Sarbanes-Oxley Act of 2002, H. R. 3763. 145 Report of Investigation by the Special Investigative Committee of the Board of Directors of Enron Corp. v. 1. 2. 2002, availbale at: http://news.findlaw.com/hdocs/docs/enron/sicreport/index.html. 146 Report of Investigation by the Special Investigative Committee of the Board of Directors of Worldcom, Inc. v. 31. 3. 2003, availbale at: http://www.edgar-online.com/bin/irsec/finSys_main.asp?dcn=0000931763-0300186 2&x=118&y =17. 147 L. Johanning in: W. Ballwieser, W. Grewe [ed.], Wirtschaftsprüfung im Wandel (2008), p. 280.

29

audits and financial reporting tools. Still, introduction of SOX had quite strong impact on

shaping the environment for risk management.148 The most important parts having impact on

RMS are the Sections 302 and 404 SOX. The Sec. 404 SOX requires establishment of an

adequate internal control system, which has to be assessed in terms of its effectiveness for

financial reporting purpose, which, due to Section 302 SOX, management has to disclose in

the annual or quarterly report. Auditors have at the same time the duty to control and certify

the management effectiveness reports.149 Under Sec. 409 SOX exists a strict obligation for

having a monitoring system that on a “rapid and current basis” detects and provides “such

additional information concerning material changes in the financial condition or operations”.

Still, all of those provisions stay more in the sphere of financial reporting and internal controls

rather than risk management mechanics. Concerning the fulfilment of Sec. 404 SOX, SEC

and Public Company Accounting Oversight Board (PCAOB) developed as a guidance the

Accounting Standard (AS) No. 2, which contains a "top-down risk assessment".150 The

advantage of this guidance is that the proposal enables the company to develop tools being

useful for an effective and early detection of significant risks of a company.151 Another guide

for risk management system is the COSO Enterprise Risk Management – Integrated

Framework.152

Even thought the direct general requirement for establishing a risk management system (or

part of it) can be hardly found in any U.S. act, an important provision on this issue can be

found in the U.S. Model Business Corporation Act of 2005153. Under Sec. 8.01 (c) MBCA,

the corporations management has to pay “attention to major risks to which the corporation is

or may be exposed” and “effectiveness of the corporation’s internal controls”. But,

“administration of risk management is not a board function coming within the ambit of

directors’ duties”.154 In addition, due to Regulation S-K, companies admitted to stocks

exchange market have to fulfil very detailed requirements on disclosing their risk positions

within financial reporting.155

148 R. Moeller, COSO Enterprise Risk Management (2007), p. 182. 149 H. Williams, Federal banking law and regulations (2007), pp. 245-246. 150 W. Fletcher, T. Plette, The Sarbanes-Oxley Act (2008), pp. 44-45. 151 M. Ramos, How to comply with Sarbanes-Oxley section 404 (2006), pp. 19-20. 152 D. Olson, D. Wu, Enterprise Risk Management (2007), pp. 35-36. 153 Available at: http://www.abanet.org/buslaw/committees/CL270000pub/nosearch/mbca/assembled/20051201 000001.pdf. 154 Committee on Corporate Laws of the American Bar Association, Model business corporation act annotated: official text with official comments and statutory cross-references, 2005, para 8-52. 155 Item 101, 303, 305 and 503c, Standard Instructions for Filing Forms under the Securities Act of 1933, Securities Exchange Act of 1934, and Energy Policy and Conservation Act of 1975 – Regulation S-K, available at: http://www.law.uc.edu/ CCL/regS-K.html; A. Gutterman, The legal considerations in business financing (1994),

30

When it comes to risk management within financial services sector, the situation is very

complicated. In the U.S. exist three banking supervisors:

• Federal Reserve (Fed)

• Office of the Comptroller of the Currency (OCC)

• Office of Thrift Supervision (OTS),

four supervisors for non-banking financial institutions:

• National Credit Union Administration (NCUA)

• Financial Industry Regulatory Authority (FINRA)

• Federal Deposit Insurance Corporation (FDIC)

• Commodity Futures Trading Commission (CFTC)

and two securities regulators:

• Securities and Exchange Commission (SEC)

• Financial Industry Regulatory Authority (FINRA)

All of those authorities use very different approaches to oversee risk management practices

and because of a high split and general overlap in responsibilities and activities, regulators

may have only a limited view of institutions risk management.156 This hurts the effectiveness

of the U.S. financial supervision – including risk management rule giving.

Another weak point in the U.S. system is the application of Basel II recommendations. The

U.S. just recently started adopting those standards.157 Still, the extent of application is not

bright – the implementation concerns generally supervisory review on capital adequacy and

Basel II advanced approaches only to very narrowly defined banking institutions.158

bb) European Union

In Europe, the issue of risk management has been typically regulated under national corporate

governance codes. It is very common that this regulation has been closely related to

pp. 71-72; R. Gallati, Risk management and capital adequacy (2003), p. 117; C. Rogers, Financial reporting of environmental liabilities and risks after Sarbanes-Oxley (2005), pp. 296-297. 156 United States Government Accountability Office (GOA), Financial Regulation – Review of Regulators’ Oversight of Risk Management Systems at a Limited Number of Large, Complex Financial Institutions (2009), p. 2, available at: http://www.gao.gov/new.items/d09499t.pdf. 157 Due to U.S. Federal Reserves (Fed) guide, available at: http://www.federalreserve.gov/GeneralInfo/basel2/US Implementation.htm#Current. 158 Ibid.

31

requirements of corporate internal controls.159 Still, as the EU has gained greater impact in the

field of corporate and business law,160 also the area of risk management has been added,

during last five years, on the agenda. The main general provisions touching this issue have

been included in following directives: Directive 2004/109/EG (Transparency Directive)161,

Directive 2003/71/EC (Prospectus Directive)162, Directive 2006/46/EC (amending Accounting

Directives)163 and Directive 2006/43/EC (Audit Directive)164.

A direct requirement of establishing a corporate risk management system has not been

included in any of them. Still, under Art. 4 Sec. 2(c) of the Transparency Directive

2004/109/EG the management of a company is obliged to include in the company’s annual

report “description of the principal risks and uncertainties” that the company is facing. The

scope of this provision concerns companies whose “securities have been admitted to trading

on a regulated market situated or operating within an EU member state”.165 In addition to

Art. 4 Sec. 2(c), under Directive 2004/109/EG, the management is required to disclose also

“principal risks and uncertainties for the remaining six months of the financial year” in half-

yearly interim management report (being part of the financial report).166 A bit different

requirement on disclosing risk information has been included in the Prospectus Directive

2003/71/EC. Here, due to Art. 5 Sec. 2, before an initial public offer (IPO), a company has to

disclose in its prospectus in a “brief manner and in nontechnical language, convey the

essential characteristics and risks associated with the issuer”.167 Still in both cases, the

European law facing financial reporting requires only disclosuring the information on risk. To

159 Ch. Van der Elst, M. van Daelen, Risk Management in European and American Corporate Law (2009), p. 27. 160 C. Timmermans, Company Law as Ius Commune?: First Walter van Gerven Lecture (2002), available at: http://www.law.kuleuven.ac.be/ccle/pdf/wvg1.pdf. 161 Directive 2004/109/EG of the European Parliament and the Council of 15 December 2004 on the harmonisation of transparency requirements with regard to information about issuers whose securities are admitted to trading on a regulated market, OJ L 390/ 38. 162 Directive 2003/71/EC of the European Parliament and the Council of 4 November 2003 on the prospectus to be published when securities are offered to the public or admitted to trading and amending Directive 2001/34/EC, OJ L 345/64. 163 Directive 2006/46/EC of 14 June 2006 of the European Parliament and of the Council amending Council Directives 78/660/EEC on the annual accounts of certain types of companies, 83/349/EEC on consolidated accounts, 86/635/EEC on the annual accounts and consolidated accounts of banks and other financial institutions and 91/674/EEC on the annual accounts and consolidated accounts of insurance undertakings, OJ L 224/1. 164 Directive 2006/43/EC of the European Parliament and the Council of 17 May 2006 on statutory audits of annual accounts and consolidated accounts, amending Council Directives 78/660/EEC and 83/349/EEC and repealing Council Directive 84/253/EEC, L 157/87. 165 Art. 1 para 1, Directive 2004/109/EG. 166 Art. 5 para 4, Directive 2004/109/EG. 167 This provision has been specified with the Commission Regulation (EC) No 809/2004 of 29 April 2004 implementing Directive 2003/71/EC of the European Parliament and of the Council as regards information contained in prospectuses as well as the format, incorporation by reference and publication of such prospectuses and dissemination of advertisements, L 149/1. Due to ANNEX I para 4 and ANNEX III para 2 the risk associated with the issuer will contain “specific to the issuer or its industry” or “material to the securities being offered and/or admitted to trading in order to assess the market risk associated with these securities” .

32

fulfil this requirements the companies do not have to establish a sophisticated risk

management system. A simple risk and uncertainty identification and monitoring system will

be sufficient.

Under EU law there are also requirements existing on effectiveness and monitoring duty of

risk management. With the Audit Directive 2006/43/EC, the audit committee168 has not only

the aim to “monitor the financial reporting process”, it has as well the duty to “monitor the

effectiveness of the company's internal control (...) and risk management system”.169 At the

same statutory auditor will report to the audit committee on every weaknesses in the internal

control system (in Germany to be implemented with the BilMoG – § 171 (1) sent. 2 AktG-

E).170 Due to the latest amendments, companies listed on stock exchanges are covered with

the requirement of disclosing main features of any existing risk management systems and

internal controls in relation to the financial reporting process in annual corporate governance

statement.171 So, the requirements related to risk management have been defined indirectly,

within financial reporting and auditing duties.

There are also some more stricter, specific provisions on risk management in regard to the

financial sector within EU law. With the introduction of the Mifid Directive 2004/39/EC172,

the first effort for integrating European financial markets and establishing “risk‑sensitive”173

regulation framework has been made. Under Art. 13 investment firms shall “have sound

administrative and accounting procedures, internal control mechanisms, effective procedures

for risk assessment, and effective control and safeguard arrangements for information

processing systems”.

Due to Art. 39 (b) Mifid, Member States shall require the regulated market to be adequately

equipped to manage the risks to which it is exposed, to implement appropriate arrangements

and systems to identify all significant risks to its operation, and to put in place effective

measures to mitigate those risks. This serves as a general framework. Specification can be

168 Under EU law it is a general obligation for every public-interest entity to have an audit committee. It might be composed of “non-executive members of the administrative body and/or members of the supervisory body of the audited entity and/or members appointed by the general meeting of shareholders” of the company, Art. 41 Sec. 1, Directive 2006/43/EC. 169 Art. 41 para 2 (b), Directive 2006/43/EC. 170 Art. 41 para 4, ibid. 171 This “in relation to the financial reporting process” and “in relation to the process for preparing consolidated accounts” – Art. 1, para 7 and Art. 2, para 2, Directive 2006/46/EC. 172 Directive 2004/39/EC of the European Parliament and of the Council of 21 April 2004 on markets in financial instruments amending Council Directives 85/611/EEC and 93/6/EEC and Directive 2000/12/EC of the European Parliament and of the Council and repealing Council Directive 93/22/EEC, OJ L 145/1. 173 Facilit 5, Directive 2004/39/EC.

33

found in other directives regulating financial markets. The Directive 2002/87/EC,174 which

has a much wider scope of applicability (covering not only investment firms, but also credit

institutions, insurance undertakings) within Art. 9 (2) introduces a requirement of adequate

risk management. This act deals also with risk concentration175 issues and capital adequacy

requirements176 (implementing Basel II framework).

A detailed requirement for establishing risk management for investment firms has been set up

under Art. 7 of Directive 2006/73/EC.177 This provision provides not only the obligation of a

risk identification and communication system, but requires a full function risk management

system including risk assessment, treatment and monitoring. This is realised with a more

decentralized approach within the investments’ firm structure – it is the senior management

(so the persons who direct business) that has been made responsible for fulfilling this

requirement178.

cc) National corporate governance code

Provisions on risk management can also be found under other national regulations. Typically

this has its place under the national corporate governance code. In the UK, the main focus

goes on the corporate internal controls. The general management obligation to establish “a

sound system of internal control” has been defined under the principle C2 of the Combined

Code on Corporate Governance (CCCG) from 2008.179 Due to provision C2.1, risk

management has been defined as a material part of internal control system. The provisions of

the Dutch Corporate Governance Code (DCGC)180 require that companies shall have an

internal risk management and control system that is suitable for the company (provision II.1.3

DCGC). Management board directly bears the duty of managing the risks associated with the

company activities and shall discuss questions of risk management with supervisory board

174 Directive 2002/87/EC of the European Parliament and of the Council of 16 December 2002 on the supplementary supervision of credit institutions, insurance undertakings and investment firms in a financial conglomerate and amending Council Directives 73/239/EEC, 79/267/EEC, 92/49/EEC, 92/96/EEC, 93/6/EEC and 93/22/EEC, and Directives 98/78/EC and 2000/12/EC of the European Parliament and of the Council, OJ L

35/1. 175 Facilit 29, Directive 2002/87/EC. 176 Art. 6 and 7, Directive 2002/87/EC. 177 Commission Directive 2006/73/EC of 10 August 2006 implementing Directive 2004/39/EC of the European Parliament and of the Council as regards organizational requirements and operating conditions for investment firms and defined terms for the purposes of that Directive, OJ L 241/26. 178 Art. 7 para 1 (c) (ii), Directive 2006/73/EC. 179 Financial Reporting Council (FRC), The Combined Code on Corporate Governance (2008), available at: http://www.frc.org.uk/documents/pagemanager/frc/Combined%20code%202006%20OCTOBER.pdf. 180 Monitoring Commission on Corporate Governance Code, The Dutch Corporate Governance Code - Principles of Good Corporate Governance and Best Practice Provisions, December 2008, available at: http://www.corpgov.nl/ page/downloads/CODE%20DEF%20ENGELS%20COMPLEET%20III.pdf.

34

and its audit committee.181 A quite interesting and modern construction has been established

under recently amended Belgian Code on Corporate Governance (BCGC).182 Due to guideline

1.1 BCGC, within requirement of adopting clear corporate governance structure, the

management board’s duty is to enable risks to be assessed and managed. This has been

defined as a critical point in pursuing long-term success of the company, where definition of

risk-bearing profile of the company has been included at the same level as defining strategy

and core values.183 At the same time, the role of supervisory board has been extended to a

body approving the “framework184 of internal control and risk management”185 designed by

the management.

All of those regulations have the same character, as they are not directly binding the

companies. Requirements on risk management are mostly applicable on the “comply or

explain” basis.186

dd) Basel II and Solvency II

A prominent position in the international financial systems regulation has been reserved to the

so-called “Basel Accords” – international financial standards formulated by the Basel

Committee on Financial Supervision (BCFS) and having no direct legal binding effect187 and

not being a part of the international law.188 From the perspective of risk management, the

most important is the second Accord (Basel II)189 of that framework.

Basel II is intended to provide an overall system of risk-based supervision and risk

management for banks.190 The act describes handling rules with five types of risks:

• Credit risk

181 Principle II.1, Dutch Corporate Governance Code 2008, see supra. 182 Belgian Corporate Governance Committee, The 2009 Belgian Code on Corporate Governance, March 2009, available at: http://www.corporategovernancecommittee.be/library/documents/final%20code/CorporateGov% 20UK%202009%205.pdf. 183 Principle 1.2, Belgian Code on Corporate Governance 2009. 184 Framework has to “describe the main features of the company's internal control and risk management systems” and has to be “disclosed in the Corporate Governance Statement”. See below. 185 Principle 1.3, Belgian Code on Corporate Governance 2009. 186 The Comply or explain rule in corporate law means that companies are required to disclose whether they are following the recommendation of corporate governance codes and if not they should state what are their reasons for non-complying, C. Mallin, Corporate Governance (2007), p. 169. 187 As they are not a part of the international customary law nor international treaties, A. Powell, Basel II and developing countries (2004), p. 4; D. Kaltofen, S. Paul, S. Stein, Retail Loans & Basel II: Using Portfolio Segmentation to Reduce Capital Requirements (2005), p. 3. 188 K. Alexander, R. Dhumale, J. Eatwell, Global governance of financial systems (2006), p. 136. 189 Available at: http://www.bis.org/publ/bcbs128.htm. 190 D. Arner, Financial stability, economic growth, and the role of law (2007), p. 212; M. Kort in: K. Hopt, H. Wiedemann [ed.], Aktiengesetz Großkommentar (2008), § 91 para 114.

35

• Market risk

• Operational risk

• Liquidity risk

• Legal risk

From its structure, Basel II has been divided into three main thematic blocks – “Pillars”.

Pillar I addresses minimum capital requirements. Under the Basel Accords banks are required

to have a certain level of own capital guaranteeing their liquidity. Minimum capital

requirement can be described as a proportion between ratio of capital (in total) to risk-

weighted assets. Banks can chose three methods in order to calculate the risk-weighted assets:

• Standardized approach – Banks risk is assessed on the base of external rating

assessments (e.g. using ratings done by rating agencies like Standard & Poors,

Moody’s or Fitch) and this is the most commonly used approached in the financial

industry191

• Foundation (IRB) internal rating approach – allows banks to use their own

system of measuring the risk but established on standards provided by the national

supervisors192

• Advanced IRB – more sophisticated and more risk sensitive than previous. Banks

can use this approach only as a subject to approval from their local regulators.193

No matter which type of approach the banks will apply, they are obliged to a minimum ration

of capital equal to at least 8% of risk-adjusted assets.

Pillar II addresses supervisory review. The national supervisory bodies have to ensure that the

banks have adequate capital and appropriate systems running for measuring, managing and

monitoring risks.194 The supervisors have become strengthen instruments in order to monitor

and execute the standards on minimum capital and risk management.195

Pillar III – disclosure requirements, is called also as market discipline196. Within Pillar III,

there are several rules concerning disclosing information on the risk management process. Its

aim is to create more transparency in the financial market, so all stakeholders (creditors,

191 M. Crouhy, D. Galai, R. Mark, The essentials of risk management (2006), p. 72. 192 D. Tarullo, Banking on Basel (2008), p. 124. 193 M. Crouhy, D. Galai, R. Mark, The essentials of risk management (2006), p. 72. 194 A. Griffiths, S. Wall, Applied economics (2007), p. 429. 195 J. Barth, G. Caprio, R. Levine, Rethinking bank regulation (2006), p. 3. 196 I. Akkizidis, V. Bouchereau, Guide to optimal operational risk & Basel II (2006), p. 103.

36

shareholders) could assess whether the bank has correctly measured and managed the risks.197

This aims to work as a supplement to the banking supervision system as professional

investors and financial analysts are seen to be a powerful instrument enhancing the

implementation of the Basel II standards by banks.198

The Solvency II199 framework serves for insurance industry as an equivalent to Basel II.200

They both have been developed with the same principles provided under three pillars structure

including capital adequacy, supervision and risk management issues.

b) Compliance

The most prominent regulation on corporate compliance is the Sarbanes Oxley Act. This act

established a general requirements framework for corporate governance standards in the U.S.

The process of implementing and monitoring the following of the SOX standards can be

considered as the basics for organizational approach for corporate compliance. In the key, the

SOX deals with requirements internal controls (Sec. 302), assessment of internal control and

auditing (Sec. 404) as well as criminal penalties for violation of SOX (Sec. 802 and 1107).

Those provisions are supplemented with general requirement of MBCA. Due to Sec. 8.01 (c)

(4) MBCA “the board’s oversight responsibilities include attention to policies and practices

to foster the corporation’s compliance with law and ethical conduct”. The importance of

corporate compliance programs have been underlined also under the U.S. case law – in the

1996 Caremark landmark decision201 and 2006 decision in Stone v. Ritter202. It has to be

stressed that the SOX is very costly in fulfilling and is generally blamed for current low

interest of international corporations on the U.S. capital market.203 Even though some

197 D. Chorafas, Stress testing for risk control under Basel II (2007), pp. 314 et seq. 198 I. Akkizidis, V. Bouchereau, Guide to optimal operational risk & Basel II (2006), p. 103. 199 European Parliament legislative resolution of 22 April 2009 on the amended proposal for a directive of the European Parliament and of the Council on the taking-up and pursuit of the business of Insurance and Reinsurance (recast) (COM(2008)0119 – C6-0231/2007 – 2007/0143(COD)). 200 A. Adam, Handbook of Asset and Liability Management (2008), p. 378. 201 Much of the current standard of director’s duty of care in the oversight and monitoring context derives from the 1996 Caremark decision, B. Banks, Corporate Legal Compliance Handbook (2002), pp. 74 et seq.; D. Burke, D. Guy, K. Tatum, Audit Committees (2008), para 12.01 et seq. 202 Delaware Supreme Court affirmed the Caremark standard for the director’s duty with respect to corporate compliance programs in its decision in Stone v. Ritter of 6 November 2006; Ch. Van der Elst and M. van Daelen, Risk Management in European and American Corporate Law (2009), p. 23, available at: http://ssrn.com/abstract=1399647; M. Biegelman, Building a World-Class Compliance Program (2008), p. 77. 203 S. Bainbridge, The complete guide to Sarbanes-Oxley (2007), pp. 242, 247.

37

countries took the SOX as a model in implementing own corporate governance regulations –

like Japan204, Canada205 or Australia206.207

It is also very common that a general requirement on compliance with law and corporate

internal regulations has been included in a variety of national corporate governance codes –

like in the UK208, Belgium209, the Netherlands210 or Italy211. On the other hand, the EU started

to provide industry specific compliance standards for the energy212, chemical213, and food

production214 sectors.

204 The Act for the Amendment of the Securities and Exchange Act, etc. (Act No. 65 of 2006) and the Act for the Development, etc. of Relevant Acts for Enforcement of the Act for the Amendment of the Securities and Exchange Act, etc. (2006 Act No. 66), available at: http://www.fsa.go.jp/common/diet/164/index.html. 205 i.a. Certification of disclosure in issuers’ annual and interim filings (MI-52-109). 206 Corporate Law Economic Program – Audit reform and corporate disclosure (CLERP-9), available at: http://scaleplus.law.gov.au/pasteact/3/3673/top.htm. 207 I. Bizmanualz, Finance & Treasury Procedures for Compliance and Performance (2008), p. 438; A. Tarantino, Manager's guide to compliance (2006), pp. 82-83. 208 C.2.1.1, The Combined Code on Corporate Governance 2008, see supra fn. 179. 209 Principle 5.2./14, The 2009 Belgian Code on Corporate Governance, see supra fn. 182. 210 Principle II.1, The Dutch corporate governance code, see supra fn. 180. 211 Article 8 Principle 2, Italian Corporate Governance Code, available at: http://www.borsaitaliana.it/chi-siamo/ ufficio-stampa/comunicatistampa/2006/codiceautodisciplina.en_pdf.htm. 212 Proposal for a directive of the European Parliament and of the Council amending Directive 2003/54/EC concerning common rules for the internal market in electricity, COM (2007) 528 Final. 213 So-called REACH Regulation – Regulation (EC) No 1907/2006 of the European Parliament and of the Council of 18 December 2006 concerning the Registration, Evaluation, Authorisation and Restriction of Chemicals (REACH), establishing a European Chemicals Agency, amending Directive 1999/45/EC and repealing Council Regulation (EEC) No 793/93 and Commission Regulation (EC) No 1488/94 as well as Council Directive 76/769/EEC and Commission Directives 91/155/EEC, 93/67/EEC, 93/105/EC and 2000/21/EC, OJ L 396/1. 214 Food safety laid down in: Regulation (EC) No. 178/2002 of the European Parliament and of the Council of 28 January 2002 laying down the general principles and requirements of food law, establishing the European Food Safety Authority and laying down procedures in matters of food safety, OJ L 031/1.

38

IV. Current financial crises and economic losses due to a non-compliant

behaviour. Comparing legal risk management and compliance framework

The current financial crises can be described by three main elements: the mortgages crunch

due to the crises on sub-prime market, the financial crises, and the economic recession. All

three have occurred on the time scale one after another and can be defined as stages of how

the current economic situation has arisen. This chapter is divided into three parts describing

main stages how current economic situation has been developed. Each stage includes a

broader focus on the risk management and compliance mechanisms influencing current crises

on corporate and market level.

1. Sub-prime crunch

a) General overview

It has been widely recognized, that the current economic turbulences have its origins in the

U.S. mortgage market. During the period between 2002 and 2007, the U.S. real estate market

discovered a rapid investment boom. This has been specially the case due to the government

policy “house for every household”. Due to this policy, each household in the U.S. should be

offered the opportunity for having an own house. The privates, specially those mid- and mid-

below situated received an access to cheap credits for financing new houses. The U.S.

government had seen this as a valuable opportunity for a further long-term economic

development based on a fast growing construction sector. The policy could be considered as a

full success. The demand for new houses begun to grow increasingly as the U.S. citizens

started to buy more and more houses (quite often buying even several). The construction

segment started to boom and the real estate prices, due excess demand, started to grow fast as

well. The boom trend became stable for five years. This was possible, especially, due to very

borrow friendly mortgage secured credit instruments like the ARM (adjustable-rate

mortgages). Within ARM households became cheap credits exceeding sometimes the price of

the property subject to mortgage. The only security was the mortgage established on the

bought real estate. Quite often, during an initial period of up to 3 years, the borrowers needed

to pay only interest rates. Those conditions were possible because the real estate prices were

39

rising rapidly, so theoretically, in case the credit would default, the loan could be paid back

from the mortgage as the value of the house would exceed after short time the sum of

security. Parallel to this, the international financial market was very interested in supplying

capital in order to gain from the real estate boom.215 The trust in future development made it

possible for American institutions to combine several ARMs into one instrument called

mortgage-backed securities. Those securities had excellent ratings, so the investors where not

sensitive to measure their “ingredients” and to assess related risks. As the capital was broadly

coming and in order to perpetuate the real estate boom, the U.S. institutions started to give

credits to more and more risky creditors.

Illustration 6 – traditional model of mortgage lending vs. mortgage-backed securities (Source: BBC, http://news.bbc.co.uk/2/hi/business/7073131.stm)

This could only work until the real estate prices would appreciate. In 2007, the real estate

market was oversupplied, the prices went down and a sharp rise in U.S. mortgage default rates

occurred.216 The houses covered by default mortgages could not be sold. A historical depth of

215 The booming real estate market was the base that between 2001 to 2006 the United States was able to attract $ 3,573 billion (“lions share”) of world capital outflows (International Monetary Fund data), M. Fratianni, Financial crises, safety nets and regulation (2008), available at: http://ssrn.com/abstract=1286903. 216 S. Schwarcz, Understanding the subprime crises, South Carolina Law Review (Vol. 60/2009), pp. 550-552; The downturn in facts and figures, BBC NEWS 21.11.2007, available at: http://news.bbc.co.uk/2/hi/business/ 7073131.stm.

40

the fall in housing prices was the biggest impact.217 Also mortgage specialists like Freddie

Mac and Fannie May were on the way to insolvency.218 The sub-prime crunch began.

b) Risk management failures

Wrong and negligent risk management systems within the institutions active at the U.S.

mortgages market can be seen as the main reason for the sub-prime crunch. First of all, banks

active at the U.S. real estate financing market, due to regulatory framework as well as due to

easy access to capital disregarded the importance of a proper risk assessment.219 From one

side, they had several customers wanting to take a loan and booming real estate prices that

were increasingly boosting the value of mortgages. From the seconds side, mortgage banks

had an extremely high interest of the international financial institution in supporting the U.S.

real estate credit action by buying mortgage-based financial instruments (asset-backed

securities). Very smartly, several single mortgages have been securitized, due to risk classes,

within one financial instrument, which later has been acquired by financial institutions at

international market. Those backed securities have been seen as a very attractive financial

product, so the demand for them was high. The U.S. banks faced a situation, where high

demand for mortgage loans could be easily matched. This has been an incentive to make the

access for mortgage loans easier in order to achieve further profit from the market. Due to a

mid-term assumption of a constantly rising real estate price and a constant credit default rate,

banking institutions overlooked potential risks.

The U.S. financial institutions were not interested in the quality of the mortgage loans, as

suppliers of additional capital, assessing the risks related to U.S. mortgage based securities,

have primarily basing on ratings granted by rating agencies. Those ratings have been

excellent,220 as the U.S. real estate market was booming, the banks financial situation proper

and the safety of mortgages seen as adequate. But rating agencies assessing those backed

instruments have not assessed the quality of the mortgages as well. The impact was that the

quality of loan portfolio of the mortgage institutions lowered dramatically.221 The assessment

217 G. Gorton, The Panic of 2007, Nat’l Bureau of Econ. Research, Working Paper No. 14358 (2008), pp. 49-50, available at: http://www.nber.org/papers/w14358. 218 D. Bogoslaw, Fannie Mae and Freddie Mac: A Damage Report, BusinessWeek 29.08.2008, available at: http://www.businessweek.com/investor/content/aug2008/pi20080828_330540.htm. 219 A. Murphy, An Analysis of the Financial Crisis of 2008: Causes and Solutions (2008), p. 5, available at: http://ssrn.com/abstract=1295344. 220 R. Whalen, The Subprime Crisis -- Cause, Effect and Consequences, Indiana University, Networks Financial Institute Policy Brief 2008-PB-04, p. 12. 221 The downturn in facts and figures, BBC NEWS 21.11.2007, available at: http://news.bbc.co.uk/2/hi/business/ 7073131.stm.

41

of financial situation of lenders has not been proceeded. The simplification of credit giving

procedure brought only requirement of assessing the value of the property by an appraiser for

approving a credit, so the financial situation of the lender had lost its importance. The quality

of loan portfolio declined also, as the banks very commonly hired third parties – mortgage

brokers – who only focused on bringing new lenders. Those brokers, very often misused the

agency relation, in order to acquire new customers.222 Banks themselves lost control over the

granted loans and as the events of year 2007 showed it was only a rapid loan default rate rise

needed, strengthened with macroeconomic slowdown, in order to bring a financial

earthquake.

c) Compliance failures

The structure of sub prime market mortgage loans shows also a high compliance negligence.

In the macro perspective, the U.S. regulatory framework has not brought sufficient brakes in

order to slow down and sanction with safety requirements the getting wilder mortgage market

boom.223 On contrary, as strengthening the real estate market was a national policy, the

regulation on mortgage market has been kept very liberalized.224 It has to be stressed that the

stricter risk management requirements of the Basel II framework had not been adopted at all

at this time in the U.S.

At the corporate level, the negligence was even higher. Mortgage engaged institutions had not

adopted a proper protective compliance structure due to loan business activities. Lack of

appropriate internal rules and effective procedures made it possible to loose control over their

sub-prime activities. As the crises occurred in 2007, U.S. banking institutions were not

equipped with adequate internal control, risk management and compliance systems that would

have provided a quality system and an early risks detection framework to them. The

effectiveness of those systems would helped to milder the impact or even to hinder the crises

happening. Monitoring the quality of loan portfolio can be seen as a very important

management duty. Broader compliance problems of U.S. mortgage institutions can be seen

very well in cases of Fannie Mae and Freddie Mac. Both institutions worked as mortgage

specialists, buying mortgages from approved mortgage sellers. They have been active also as

intermediaries, securitizing owned mortgages into mortgage-backed securities and selling

222 Ibid. 223 C. Reinhart, K. Rogof, Is the 2007 U.S. Sub-Prime Financial Crisis So Different? An International Historical Comparison, Harvard University Working Paper 5.02.2009, pp. 10-11, available at: http://www.economics. harvard.edu/faculty/rogoff/files/Is_The_US_Subprime_Crisis_So_Different.pdf. 224 S. Schwarcz, Understanding the subprime crises, South Carolina Law Review (Vol. 60/2009), pp. 566 et seq.

42

them to investors in the secondary mortgage market. Fannie Mae faced an accounting scandal

with inappropriate accounting and internal control system (total cost of restatement $6.3

billion)225 in 2004 and Freddie Mac was fined with $3.8 million in 2006 by the Federal

Election Commission for illegal fund raising for members of the House Financial Services

Committee, a regulator that supervises the mortgage based financial institutions in the U.S226.

Both companies have been part to the bailout program of the U.S. government227 and been

seen as co-responsible for the sub-prime crunch.

2. Global credit crunch and financial crises

a) General overview

The falling house prices in the U.S. and the construction of mortgage-backed securities

extended the impacts of the sub-prime crises very fast in comparison to other sectors of

financial services not only in the U.S. but also worldwide.228 Falling sub-prime securitization

prices undermined the financial position of several banks in 2008. First victim was the U.S.

bank Bear Stearns, due to problems with its engagement in sub-prime market, it could only be

prevented from insolvency by merging with J.P. Morgan supported by the U.S. state in form

of public funds and guarantees.229 At the same time, the biggest underwriter of mortgage-

backed securities – U.S. investment bank Lehman Brothers – had to proceed enormous write-

downs because of troubling mortgages portfolio. 230 The problem of Lehman Brothers was

that it held to large positions of sub-prime and other mortgage backed securities.231 In

September 2008 Lehman had to file for bankruptcy in order to find protection from its

creditors. The negative developments in asset-backed securities (inclusive mortgage based

225Fannie Mae, Annual Report on Form 10-K, pp. 39 at seq., available at: http://www.fanniemae.com /ir/pdf/sec/2006/form10k_120606.pdf. 226 Z. Goldfarb, D. Cho, B. Appelbaum, Treasury to Rescue Fannie and Freddie: Regulators Seek to Keep Firms' Troubles From Setting Off Wave of Bank Failures, Washington Post: pp. A01. http://www.washingtonpost.com/wp-dyn/content/article/2008/09/06/AR2008090602540.html?hpid=topnews. 227 C. Barr, Fannie, Freddie: The biggest losers, CNNMoney.Com, 7.09.2008, available at: http:// money.cnn.com/2008/09/07/news/economy/shareholder_wipeout.fortune/index.htm. 228 J. Garfinkel, J. Sa-Aadu, A Decade of Living Dangerously: The Causes and Consequences of the Mortgage and Financial Crises (2008), pp. 23 et seq., available at: http://ssrn.com/abstract=1331294. 229 F. Allen, A. Babus, E. Carletti, Financial Crises: Theory and Evidence (2009), p. 2. 230 $2,8 billion only in the second quater of 2008, source: J. Anderson; E. Dash, Struggling Lehman Plans to Lay Off 1,500, The New York Times from 29.08.2208, available at: http://www.nytimes.com/2008/08/29/business/ 29wall. html?em. 231 J. Anderson; E. Dash, Struggling Lehman Plans to Lay Off 1,500, The New York Times from 29.08.2208, available at: http://www.nytimes.com/2008/08/29/business/29wall.html?em.

43

portfolios) interrupted also other big U.S. financial institutions like Citi Group,232 Merrill

Lynch233 or AIG234. Very quickly, the sub-prime crunch hit also non-U.S. institutions. The

U.K. mortgage specialized bank Northern Rock had to face deep liquidity problems between

2007 and 2008. It would have had to file for insolvency if it not had been nationalized.235 The

Swiss bank UBS has written off a total of $37 billion on U.S. mortgage-related loans and its

survival could not been assured without raising additional capital from investors.236 U.S.

mortgage-backed securities have also been part of security portfolios of several German

banks. Hypo Real Estate had to be nationalized, and several institutions like Commerzbank or

state owned Landesbanken had to make record write-downs and seek for survival chances

under the umbrella of national bail-out program.

But it is not only the sub-prime market that can be made responsible for the financial crises.

The U.S. sub-prime crunch hurt not only the mortgage-based instruments but also all other

structured asset-backed securities (ABS).237 Like domino-effect, instability of fixed-income

instruments had influenced negatively also other instruments markets.238 The fall of U.S.

financial system including the insolvency of Lehman Brothers had an unexpected impact on

worldwide financial market. The market for credit default swap (CDS)239 can be seen as a

perfect example. The collapse of Bear Stearns followed by two AIG hedging funds

insolvencies and later Lehman Brothers insolvency disrupted this market deeply. Due to their

insolvency, those institutions defaulted as parties to contracts, so millions of CDS stopped to

exist. This was a huge hit to the hedging strategies of the remaining parties. They had to

replace those instruments, but under a much higher price.

The sub-prime crunch and fall of big international financial institutions brought

destabilization of the interbank markets. Interbank markets play a key role in financial

232 Singing the blues, The Economist 27.11.2008, available at: http://www.economist.com/businessfinance/ displayStory.cfm?story_id=12689930. 233 B. Miller, C. Kong Ho, Merrill Lynch Cut to ‘Sell' at Goldman on Writedowns, Bloomberg, 5.09.2008, available at: http://www.bloomberg.com/apps/news?pid=20601087&sid=aDWTPYeHBS8g&refer=home. 234 A lifeline for AIG, The Economist 17.08.2008, available at: http://www.economist.com/businessfinance/ displayStory.cfm?story_id=12244993. 235 L. Lauren, Northern Rock Nationalized, Forbes.Com, 17.02.2008, available at: http://www.forbes.com/ 2008/02/17/northern-nationalize-bank-markets-cx_ll_0217northernrock.html. 236 R. Boyd, Another Swiss miss at UBS, CNNMoney.Com, 1.04.2008, available at: http://money.cnn.com/ 2008/04/01/news/companies/boyd_ubs.fortune/. 237 G. Krohn, W. Gruver, The Complexities of the Financial Turmoil of 2007 and 2008 (2008), pp. 11 et seq., available at: http://ssrn.com/abstract=1282250. 238 J. Garfinkel, J. Sa-Aadu, A Decade of Living Dangerously: The Causes and Consequences of the Mortgage and Financial Crises (2008), pp. 23 et seq., available at: http://ssrn.com/abstract=1331294. 239 CDS is a swap contract where the buyer makes a series of payments to the seller and, in exchange, receives a pay-off if a credit instrument (e.g. bond or loan) goes into default (fails to pay). This instrument has been used very often in hedging strategies, M. Simkovic, Secret Liens and the Financial Crisis of 2008 (2009). American Bankruptcy Law Journal, Vol. 83 (2009), p. 271.

44

systems,240 serving as a platform supplying banks with capital needed for their business

operations. How far the interbank markets have been destabilized can be seen on Illustration 7

illustrating the change of Libor – London Interbank Offered Rate during a very sensitive

period in 2008. The crisis on the interbank markets caused a worldwide credit crunch as banks

had neither the resources for further loan operations nor enough trust to borrow it at the

interbank markets.

Illustration 7 – changes in Libor rates in the middle of the financial crises (Source: http://www.economist.com/businessfinance/displayStory.cfm?story_id=12381995)

Generally taking, the mortgage crunch disturbed bond markets, futures, swaps and many

more. The financial institutions having complex mortgage instruments in their portfolios had

to account huge value losses. This had an impact on the financial balance within those

organizations. Hedging strategies using very often low risk in theory mortgage-backed

securities were endangered. This has been the reason, why those instruments have been

included to portfolios of several institutions around the world. Mortgage market instability

and fall of U.S. financial sector had to misbalance those portfolios. This was a step to a total

crises. As the rating agencies first time evaluated the backed securities itself and not only

financial situation of issuing institutions, the ratings had to be corrected and dramatically

lowered. Accounting, huge value losses in the books and in order to fulfil minimum capital

requirement banks had to limit their crediting business. The liquidity ratio of banks began to

depreciate rapidly.241 Some of them, overleveraged gone insolvent, most suffered deep

problems. But the biggest impact was the trust crises. Banking institutions did not trust each

240 F. Allen, A. Babus and E. Carletti, Financial Crises: Theory and Evidence (2009), p. 10. 241 G. Krohn, W. Gruver, The Complexities of the Financial Turmoil of 2007 and 2008 (2008), pp. 24 et seq., available at: http://ssrn.com/abstract=1282250.

45

other and were not enthusiastic in keeping high capital flows (mutual borrowings, financing

and refinancing) within the banking system. This has been a large hit into the worldwide

financial system.


The failure of risk management causing current financial crises can be analysed at two –

micro (corporate) and macro (systemic) levels.

At corporate level, institutions engaged in U.S. mortgage loans have not ensured the quality of

credit portfolio. Those mortgages, unhappily, have been securitized by intermediaries and

afterwards distributed to a international capital market. While securitizing, a superficial and

automatic approach on assessing risk brought negative consequences. Asset-backed

instruments have been securitized only relying on very general risk classes of single

mortgages provided by the mortgage crediting institutions themselves. “Backing” institutions

did not assess the quality of mortgage portfolio and were assuming that the constantly

growing real estate market would provide sufficient security. The next problem concerns

investors, who acquiring ABS at financial market, evaluated securities only within the credit

risk criterion depending on credit rating of those instruments given by rating agencies like

Standard & Poor or Moody’s.242 Those ABS had excellent ratings, typically “AAA”.243 Asset-

backed securities, being in fact bonds, have always been assumed as “safe” instruments so

investors had not the incentive to look “inside” those papers. Relying only on external credit

ratings, they had no overview what those instruments, specially in terms of quality, really

contained. So, in reality the process of securitizing and later acquiring ABS have run out of

control. The very brief risk management approach made early detection of several serious

risks impossible.244 This created a financial pyramid, where if one of basic pillars would

default, like real estate market in the U.S., due to mortgage-baked securities, the whole system

would collapse. A similar situation could be observed at other markets, like the CDS. The

credit default swaps have been widely used for hedging the ABS portfolio.245 A CDS is, in

fact, a credit risk transfer instrument. It serves as an insurance, in case a loan would go

242 A. Murphy, An Analysis of the Financial Crisis of 2008: Causes and Solutions (2008), pp. 4-5, available at: http://ssrn.com/abstract=1295344. 243 R. Whalen, The Subprime Crisis -- Cause, Effect and Consequences, Indiana University, Networks Financial Institute Policy Brief 2008-PB-04, p. 12. 244 F. Ostrup, L. Oxelheim, C. Wihlborg, Origins and Resolution of Financial Crises; Lessons from the Current and Northern European Crises (2009), p. 11, available at: http://ssrn.com/abstract=1407613. 245 G. Krohn, W. Gruver, The Complexities of the Financial Turmoil of 2007 and 2008 (2008), p. 12, available at: http://ssrn.com/abstract=1282250.

46

default. The dissolution of the CDS, due to bankruptcies of big players (e.g. Lehman), and

realization of those contracts, due to unexpected rise of mortgage loans defaults, have been

an additional element undermining the condition of international finances. Many critical

voices are blaming the CDS market due to low transparency and general deregulation.246 Lack

of transparency in some over-the-counter (OTC) derivative (including swap and future)

markets have also caused difficulties and uncertainties about the risk of some

counterparties.247

The current financial crises shows two negative approaches within the risk management

systems of financial institutions. First, concerns the assessment of credit and counterparty

risks. Financial institutions, entering business with a party or acquiring a certain financial

instrument, were basing risk assessment on ratings given by international rating agencies.

Financial institutions fully relied and trusted those ratings, even though they have been

prepared by private non-regulated institutions what indicates that the criteria and procedures

for rating have not been disclosed. Failures in risk management systems are related to the fact,

that risk assessment has been based on an assumption that those ratings will be correct. When

the market situation changed and ABS instruments have been dramatically devaluated,

financial institutions had not only to face huge write-downs but also holes in their portfolios.

This also undermined the situation at the financial market, as no one was sure whether the

present indicators would be correct. The second negative approach was related to the

complexity of financial products. Financial institutions lost control over products they have

been offering and purchasing. In fact, they did not understand many of them. Without true

understanding, an effective and adequate risk management system cannot be developed. For

example, the Lehman Brothers bankruptcy in September 2008 forced markets to re-assess

risk.248 The underestimation of counterparty risk exposure, specially within the cross-boarder

exposure, needed to be controlled. As IMF identifies:

246 F. Ostrup, L. Oxelheim, C. Wihlborg, Origins and Resolution of Financial Crises; Lessons from the Current and Northern European Crises (2009), p. 4, available at: http://ssrn.com/abstract=1407613. 247 International Monetary Fund, Lessons of the Financial Crisis for Future Regulation of Financial Institutions and Markets and for Liquidity Management (2009), p. 15, available at: http://www.imf.org/external/np/ pp/eng/2009/ 020409.pdf. 248 F. Allen, A. Babus, E. Carletti, Financial Crises: Theory and Evidence (2009), p. 3.

47

“The crisis revealed surprisingly large exposures of non-U.S. banks to the U.S. sub-

prime market and to Lehman Brothers, suggesting that the underlying vulnerabilities

were under-appreciated by both bank risk managers and supervisors.”249

The underestimation of international interdependence of the international market can be

demonstrated by taking a look on the credit default swap (CDS) market.

From the macro level, the current financial crises serves as a proof for integration and

interdependence of the global financial system. This was not symmetric with a common and

unified legal framework as well as international coordination. Exposure to systemic risk,

where the event is related to disruption of the financial system as a whole shall not only be

considered at corporate level. Companies can prepare themselves with insurances, but a real

help and prevention can only be provided by central banks, national and international

financial supervisors and other authorities250. The current situation showed that there was no

early cross-boarder detection system which would signalize negative developments coming.

Also in neutralizing the impacts of current financial crises cannot be found as a sufficient

cross-border cooperation. There is a lot of space for a closer coordination of international

market supervision.

c) Compliance failures

As nature of risk management failures of U.S. financial institutions show that the compliance

approach within the financial industry has not been a strong one. Even though, the U.S. enjoys

one of the strictest corporate compliance regulation worldwide especially with the SOX, still

the strict regulatory approach on the financial services is not as strong there as in many other

countries. Especially, as the Basel II accord had not been adopted in the U.S. before or during

the crises at all, and even now the planned implementation shall cover only the biggest

financial institutions. Likewise, a big part of institutions offering financial services, but

classified as NBFIs (Non-bank financial institutions)251 have been excluded for stricter risk

management and compliance requirements which U.S. banks have to fulfil. This liberal

approach also concerns several financial instruments. For example, future and other OTC

249 International Monetary Fund, Lessons of the Financial Crisis for Future Regulation of Financial Institutions and Markets and for Liquidity Management (2009), p. 16, available at: http://www.imf.org/external/np/pp/ eng/2009/ 020409.pdf. 250 International Monetary Fund, Initial Lessons of the Crisis (2009), pp. 6-11, available at: http:// www.imf.org/external/np/pp/eng/2009/020609.pdf. 251 Non-bank financial institutions – financial institution that are not having a full banking license or are not supervised by a national or international banking regulatory agency, J. Carmichael, M. Pomerleano, Development and Regulation of Non-Bank Financial Institutions (2002), p. 12.

48

instruments have not been combined with securities regulations what creates a highly

deregulated environment in the U.S.252

The impact of this laissez-faire environment can be seen in corporate crises of several U.S.

financial institutions like Bear Stearns, Lehman Brothers or Merrill Lynch. Those institutions

failed in creating an effective internal control system that would include a standardized cross-

divisional risk management and controlling system. As there has been no obligation of

fulfilling regulatory requirement and as institutions themselves have not been motivated to

place responsibility for that no internal rules were developed enabling complex, organization-

wide understanding and dealing with risks. As the example of Lehman shows, there was an

understanding of risk, but “there was to big faith in complex, abstract and abstract

mathematical models on risks. Due to lack of Basel II implementation in the U.S., risks have

not been identified and quantified within standardized categories. Risk management itself has

been a to decentralized process and risk reporting within the corporation have been

processed individually and not collectively. The existing risk management itself had a low

documentation and monitoring approach and the level of leverage have been extremely high.

A group-wide risk portfolio have not exists as well as several risks were overseen.”253

The outcome of this deficiencies was the company’s exposure to risks related to mortgage-

backed securities became unprotected within investment portfolio what had negative

consequences later on. Even though, there have been no regulatory compliance requirements,

all of the named shortcomings could be avoided by adopting best practice rules, like the

COSO risk management framework.

But even a stricter regulatory approach could not have prevented the financial crises coming

to Europe. An excellent example provides German Hypo Real Estate (HRE). This bank faced

a deep corporate crises in early 2008. Without help from the German bail-out program and

later nationalization it would probably have gone insolvent. As a report from the German

Bundesbank states HRE's “compliance with key banking regulations on managing liquidity

and other market risks must be seen as nonexistent”.254 This occurred not least because the

German financial-markets regulator BaFin was unable to execute the HRE's compliance as

252 M. Simkovic, Secret Liens and the Financial Crisis of 2008, American Bankruptcy Law Journal, Vol. 83 (2009), p. 288. 253 Based on an interview with Alex Davidson, former head of compliance and regulation at Lehman Brothers. Source: Complinet, Compliance has greater role than before crisis, says ex-Lehman head of compliance, http://www.complinet.com/connected/news-and-events/webcasts/great-crash/share/great-crash-articleA.pdf. 254 D. Crawford, M. Walker, German Regulator Warned of Hypo Bank Problems Before Bailout, WSJ from 28.05.09, p. A6, available at: http://209.85.135.132/search?q=cache:J5KpI11AKOAJ:online.wsj.com/article/ SB12 4346085723259931.html.

49

German law does not allow BaFin to regulate holding companies. In addition, HRE was

exposed, due to its Irish daughter company Depfa, in a very high extend to U.S. mortgage-

based securities crunch. So, even a strict regulation, implementing Basel II framework, was

not able to ensure a serious and conscious corporate risk management and compliance

approach. It has to be stressed, that German banks lost on account of the financial crises

between €200 billion to €300 billion (it is estimated that only €100 billion had been written

down).255

3. Economic recession

a) General overview

As a result of credit crunch on the market, access to capital in form of credits has been

diminished to corporate and private persons. The crises of trust of financial market players has

stretched also to other industries.256 Lower access to capital, specially credits, lower capital

transfers and lack of trust in further development pushed institutional and private investors, as

well as simple households, to lower their spending at all.257 This brought the international

economy to a situation where the whole demand began to fall dramatically. Lower demand

brought excess supply and problems in selling produced goods. Companies have been left

with finished products and huge stocks of inventory. Lower production, investment and

household spending made the macro economic impact of falling GDP rates, rising

unemployment and unpredictable economic environment.258


It is not only the financial crises itself that can be blamed for enormous economic losses

across corporations of all industries. In past years, several corporations from non-financial

industries started to offer financial products as well. As excellent examples serve in-house

banks of main automotive corporations, helping to push the sales of cars, offering cheap car-

255 D. Crawford, M. Walker, German Regulator Warned of Hypo Bank Problems Before Bailout, WSJ from 28.05.09, p. A6, available at: http://209.85.135.132/search?q=cache:J5KpI11AKOAJ:online.wsj.com/article/ SB124346085723259931.html. 256 U. Osili, A. Paulson, Bank Crises and Investor Confidence, Federal Reserve Bank of Chicago Working Paper No. 2008-172, pp. 2 et seq. 257 Ibid. 258 U. Osili, A. Paulson, Bank Crises and Investor Confidence, Federal Reserve Bank of Chicago Working Paper No. 2008-172, p. 2.

50

loans or leasing services. At the same time, several industry corporations gained importance

at complex financial product markets. This extended the global exposure to problems creating

current financial crises. As well, some unfortunate risk management approaches and decisions

undermined financial positions of several corporations. As examples can serve:

• Porsche SE – where not lower sales but billion € engagement in OTC transactions

undermined the financial situation of the car producer.259

• British Airways Plc – where losses due to wrong fuel-purchases hedging strategy

exceeded losses generated by lower sales.260

• GMAC (being a financial-services part of automotive corporation GM) – where

subsidized loans and lease strategy, as well as exposure to mortgage operations turned

into a big threat for the entire group.261

• Polish coal industry – where big profits due to participation in currency hedging on

the OTC market undermined the financial performance after the market situation

changed.262

c) Economic losses due to non-compliant behaviour

It is often stressed that a non-compliance or non-adequate compliance with risk management

rules has been a cause for the current crises. The inadequate risk assessment and management

approaches at financial institutions like Fannie Mae, Freddie Mac, Lehmann Brothers, Hypo

Real Estate and others. But also compliance scandals during last years like the cases of:

• Siemens – bribery scandal263

• ThyssenKrupp – anti-competitive behaviour264

• Societé General – mismanagement of an employee and internal control failure265

259 T. Katzensteiner, A. Riedl, M. Boschen, Die Akte Porsche, WitrschaftsWoche from 8.06.2009, pp. 101 et seq. 260 Short-sellers target M&B and British Airways, Reuters on 3.06.2009, available at: http://www.reuters.com/ article/hedgeFundsNews/idUSLNE56200U20090703. 261 J. Stempel, GMAC mortgage lender teeters toward bankruptcy, The New York Times from 6.10.2008, available at: http://www.nytimes.com/2008/11/06/business/worldbusiness/06iht-deal07.1.17579017.html. 262 T. Głogowski, Pawlak wyrzuca prezesów za opcje, Gazeta Wyborcza from 22.06.2009, available at: http://gospodarka.gazeta.pl/Gielda/1,85951,6746110,Pawlak_wyrzuca_prezesow_za_opcje.html. 263 A. Höpner, Siemens zahlt 800 Millionen Dollar, WirtschaftsWoche on 15.12.2008, available at: http:// www.wiwo.de/unternehmer-maerkte/siemens-zahlt-800-millionen-dollar-381406/. 264 EU Court: ThyssenKrupp Must Pay EUR3 Million Cartel Fine, DowJones Deutschland on 01.07.2009, available at: http://www.dowjones.de/site/2009/07/eu-court-thyssenkrupp-must-pay-eur3-million-cartel-fine.html. 265 SocGen postmortem, Financial Times on 25.01.2008, available at: http://www.ft.com/.

51

brought economic losses due to enormous fines from public authorities or ineffective

compliance and internal control systems.

52

V. Would a stricter regulatory approach avoid current financial crises?

Considerations de lege ferenda. The financial services industry is perhaps the most regulated in the world. However,

regulations seem to have done little to prevent current crisis.266 There are some areas where

stricter or sometimes more harmonised legal framework could prevent some negative

developments causing current crises. With improvements concerning legal framework for

corporate risk management and compliance the extent of current financial crises could surely

be reduced and impacts for the economy would be smoother.

1. Specifying general corporate risk management requirement

A general corporate requirement for dealing with risks can be found under several

jurisdictions. The biggest problem concerns the uncertainty of provisions related to risk

management. Under some jurisdiction, like in U.S. or Germany, a requirement for a full

function corporate risk management has not been regulated expressis verbis. It can be

generally interpreted from duty program of management or from supervision responsibilities

of the corporate organs. A bit easier situation exists when it comes to compliance. A general

requirement for corporate compliance has been included under most jurisdictions as a

management responsibility. But in both cases, legislator typically provides no further

guidelines how to live and realise at corporate level risk management and compliance

systems. As support can serve non-binding best practise frameworks created by certified

auditors associations and other forums. They provide more specified guidelines on how to

structure those functions within a corporation. But, those provisions serve as non-binding

recommendations. For a greater transparency and legal certainty, the state should take a

bigger role in a form of supervising, influencing and sanctioning provisions concerning risk

management and compliance systems.267 As good example can serve the formulation of

national corporate governance codes, where state power has generally a greater influence on

the private codification practice. Another important task is the further unification of standards

on the international arena. As current financial crises showed, errors in one deregulated state

266 F. Allen, A. Babus and E. Carletti, Financial Crises: Theory and Evidence (2009), pp. 29-30. 267 Generally taken, current legislator is introducing risk management and compliance requirements without bearing the responsibility for an universal transparency, equality and unity for organizational fulfilling of legal duties.

53

can have negative consequence in states having relatively stricter framework.268 In present,

interference of markets should have impact on creating equal standards that everyone has to

comply with, otherwise the mechanisms of current financial crises will repeat quickly.

2. Risk assessment and credit ratings

Current legal framework enabled not only financial institutions but also all other corporations

to use a certain automatisation concerning risk management while playing at the international

financial market. Companies were typically assessing the risks concerning certain financial

instruments like bonds or asset-backed securities relying on credit ratings prepared by rating

agencies. The rating agencies themselves are private entities dealing commercially with

providing ratings. At the same time, they do not generally disclose the rules and criteria for

rating. Generally, rating agencies do not act as state agents. As just the legislator itself has not

directly influenced or supervised the rating process. So, in the international market,

participants rely on external assessments done by organizations who do not provide

transparency about their activity. There is a high level of trust given by the market

participants. Financial institutions rely on external measurements typically having no

possibility to estimate whether the ratings are correct and reliable. This approach had to bring

a negative impact in the current crises.

It is undisputed, that the “big three” rating agencies Standard & Poor’s, Moody’s and Fitch

played starring roles in current failure of finance.269 Those agencies enjoyed a high level of

trust. Their ratings have been main - and sometimes even the only - part of assessing credit

risk by institutions active at the financial market. Those ratings served as a recommendation

for investing or avoiding certain financial products. The same considered the creditworthiness

of business parties as well. The ratings themselves had and still have the power to influence

the price of capital for market participants.270 In former times, there have only been bigger

banks that were using the internal criteria (e.g. Basel II approach – IRB) as an alternative of

substitutions for external ratings. But, as the sub-prime and later the financial crises show,

268 International Monetary Fund, Initial Lessons of the Crisis (2009), pp. 2-5, 10-11, available at: http:// www.imf.org/external/np/pp/eng/2009/020609.pdf. 269 Rating agencies – The wages of sin, The Economist 23.04.2009, available at: http://www.economist.com/ businessfinance/displaystory.cfm?story_id=13527929; A. Sy, The Systemic Regulation of Credit Rating Agencies and Rated Markets, IMF Working Paper 09/129, p. 3, available at: http://ssrn.com/ abstract=1422699. 270 A. Sy, The Systemic Regulation of Credit Rating Agencies and Rated Markets, IMF Working Paper 09/129, p. 9, available at: http://ssrn.com/abstract=1422699.

54

those ratings have not been reliable measures. Before the crises happened, rating agencies in

evaluating credit risks were following certain market trends. But, due to weak regulation, their

rules had a lot of gaps (e.g. the systemic risk exposure).271 Assessing this in detail is not

possible as the rules for rate giving are not public.

Participants of the financial market fully entrusted the accurateness of the external rating

system, failing to rely more on own knowledge, business judgement and resources.

Assumption of stability and correctness of external rating, made it easy to develop

instruments of a before unseen complexity. Organizations, relying on that “external

knowledge” related to this highly sophisticated mathematical models, did not exactly know

what the products they were offering or buying were about, and had also low understanding of

the instruments of the market they approached. Without this basic understanding the

development of a proper risk management system that would support decision making was

not possible. This was one of the main reasons for current crises.

There are some reforms considered in relation to credit risk assessment. From one side, it

seems to be promising, to encourage financial market participants to rely more on their own

risk assessment resources. Clearly, the credit ratings of rating agencies are a subject to

considerations. In the U.S., the main focus goes on extending the competition between rating

agencies.272 But, what is more important, there is a bigger transparency in the rating market

needed. As a very smart initiative can be seen the EU proposal obliging rating agencies to

disclose their rating criteria and procedure, so everyone could evaluate on what conditions a

certain rating has been given.273 This would help to improve conditions and create more

understanding and discussion on corporate risk culture.

3. Auditing

Under current regulatory framework, the external audit plays a very important role in

assessing the implementation of risk management and compliance provisions by corporate

271 E. Wymeersch, Corporate Governance and Financial Stability, Ghent University, Financial Law Institute Working Paper No. WP 2008-11, p. 5. 272 R. Chang, Entry barriers stifle U.S. credit ratings competition, Reuters on 24.06.2009, available at: http://www.reuters.com/article/ousiv/idUSTRE55N4VU20090624. 273 EU Commission consultation on (i) a draft Directive / Regulation with respect to the authorisation, operation and supervision of credit rating agencies (CRAs) and (ii) on policy options to address the problem of excessive reliance on credit ratings, available at: http://www.ec.europa.eu/internal_market/consultations/2008/securities_ agencies_en.htm.

55

entities. It is generally taken the annual auditor who proofs whether a corporate risk

management or compliance system has been adopted and assesses its functionality, adequacy

or effectiveness.

Every larger corporate274 scandal renews the question of effectiveness and independence of

annual audits. The same issue arisen after the analysis of corporate crunches with relation to

Fannie Mae, Freddie Mac, Bear Stearns, Lehman Brothers, Hypo Real Estates (HRE) and

more examples of the current crises.

The existence and further assessment of risk management and compliance systems has under

several jurisdictions been laid down under the assessment of certified auditors. The regulator

gave them a special guaranteeing function which has to ensure that corporation fulfils its legal

requirements concerning inter alia accounting, financial reporting and internal control

standards. Coming to the company as external and independent assessors, they have the task

to undertake a deep, cross-functional analysis of that issues. The impact is the certification or

non-certification of corporate reports, which are of great importance for the capital market.

There are several voices of critics concerning this system. Many argue that the independence

of certified auditors is getting weaker.275 This shall be especially because of the fact that

companies choose on their own the annual auditors and also pay by themselves for their

assessments. There is a high risk, that the auditors will not be able to overcome the temptation

of handling in favour (and without sufficient scrutiny) for the assessed company in order to

keep the client satisfied. Another problem concerns the structure of the international auditing

market. It has been dominated by few major players who started to take an important part in

consultant services.276 Their deep linkage (through several business relations with assessed

companies) undermines also their independence. As the example of HRE or Lehman Brothers

shows, those companies passed positively the annual audit tests even though their situation

was rather critical and poor. Perhaps, a more independent system, where auditors would be

designated by financial supervisors would set a higher safety level. And, for example, the

services of certified auditors could be then paid from a centralized fund, to whom each

assessed firm would have to contribute to. The greater independence and scrutiny of annual

auditors, could serve as a good mechanism for reducing the systemic risk and enhancing

better standards for corporate risk management and compliance in the financial industry.

274 Like Enron, Worldcom or Parmalat. 275 M. Jennings, The seven signs of ethical collapse (2006), pp. 184 et seq. 276 Ibid.

56

4. Accounting standards

As the correctness of credit ratings offered by rating agencies have been due to the crises

undermined, companies may look for other sources of information that can be used while

assessing credit or counterparty risks related to a potential business partner. One source of

information could come from disclosure of financial data that banks have due to market

transparency regulation, have to publicise within financial reporting. But even this channel

can be taken as sufficient. Due to very flexible application of international accounting

standards (IFRS), information disclosed by different banks within financial reporting is

incomparable.277 The same problems face corporations of all other industries.

A comparative study on annual financial reports of 16 biggest European banks have been

recently prepared by the international audit and consulting company KPMG. The research

showed that even though the annual reports disclose a massive portion of data,278 the bank’s

discretion in interpreting and applying accounting standards makes comparableness of data

between institutions hardly difficult. One problem concerns disclosing judgements in applying

accounting policies and sources of estimation uncertainty, where generally taken, the

information given cannot serve as sufficient in understanding the bank’s accounting

approach.279 The second uncertainty concerns the applicability of IAS 39 – fair values

measurement. In accounting fair value is used as an estimation method to calculate the market

value of an asset or liability for which a market price cannot be determined.280 Within annual

financial reports of 16 biggest European banks can be observed that the scope and methods

for application of fair value complicates a comparison of positions on financial assets and

financial liabilities among them.281 A very sensitive area is concerning also disclosure of risk

management information. The main differences affect:

277 Banks and accounting standards – Messenger shot, The Economist 8.04.09, available at: http://www.economist.com/opinion/displaystory.cfm?story_id=13446745; KPMG-Studie: Abschlussberichte von Banken schwer vergleichbar, FAZ 9.07.2009, p. 19. 278 Including up to 300-400 pages. 279 KPMG, Focus on transparency – Trends in the presentation of financial statements and disclosure of information by European banks (2009), pp. 14-16. 280 International Valuation Standards Committee, Exposure Draft of Proposed Revised International Valuation Standard 2, para. 6.4, available at: http://www.ivsc.org/pubs/exp_drafts/ivs2.pdf. 281 KPMG, Focus on transparency – Trends in the presentation of financial statements and disclosure of information by European banks (2009), p. 17.

57

• Disclosure of credit risk – where “significant variability in respect of the spread of

individual vs. collective impairment” is stated

• Disclosure of market risk – Banks used different assumptions and parameters in

calculating their market risk exposure

• Disclosure of liquidity risk – Not all banks show their liquidity ratio and different

methods used for liquidity management and measurement; only some banks used

Basel Committee recommendations for quantitative and qualitative exposures on their

liquidity risk.282

Being able to compare financial performance of business partners is an important value for

stabile and transparent markets. Stricter accounting rules, preventing such a wide discretion

and flexibility in application as now, would bring more transparency and trust into the

financial world.283 This is a postulate, that for years, could not find implementation. There are

some reform movements seen, like the EU and FASB initiatives toward stricter regulation on

fair value method.284 A stricter regulation on accounting standards could probably not avoid

current financial crises, but would help to create more healthy environment for financial

services market.

282 KPMG, Focus on transparency – Trends in the presentation of financial statements and disclosure of information by European banks (2009), pp. 26, 34, 36 et seq. 283 C. Johnson, A. Mosich, W. Meigs, Financial Accounting (2003), para 1.14-1.15. 284 EU executive to ease fair value on banks – document, Reuters 10.10.2008, available at: http://www.reuters.com/article/governmentFilingsNews/idUSLA68354320081010; Financial Accounting Standards Board, Determining the Fair Value of a Financial Asset When the Market for That Asset Is Not Active, FASB Staff Position No. 157-3 (2008).

58

VI. Conclusions

There is no clear answer whether a stricter risk management and compliance framework

would help to avoid current financial crises. It has to be considered that every business

decision bears a certain level of hazards and that very often making brave decisions is

essential for business success.285 Also the cyclicality of economies, when after a period of

growth a crises has to come in order to prepare another period of growth has always been an

important part of the markets during history.286 Due to this theory, a stricter regulatory

approach on corporate risk management and compliance would probably not avoid current

crises occur, but definitely would deeply change its form and extend.

There are some areas, where a stricter regulatory framework would change a lot. This

concerns the regulation of several financial instruments like credit default swaps, over-the-

counter instruments or assed-backed securities. Also a different approach to risk assessment

and clearer rules creating regulated environment for credit rating agencies could encourage

preventive measures as well. At the same time, stricter and more detailed rules for

arrangement of corporate risk management and compliance systems that is executed by a

different certified audit model would bring more harmonization and enhance corporate risk

culture, specially in the financial services industry. This would probably help to create more

effective early risk detection systems at the corporate level. Parallel to this, a different

positioning of national and international financial supervision could coordinate and deal more

conscious with exposure of the entire economic to systemic risks. Specially, a greater

international cooperation would be very promising.

Note that the need of corporate risk management and compliance will grow further. As the

economic environment will constantly become more complex, sophisticated and

internationalized, both functions can bring new positions and approaches to corporations at an

essential – cross-corporate level. The main postulate for the legislator in creating prospective

legal framework is to enhance a wider international coordination and harmonization on risk

management and compliance issues, so a minimum set of standards would be required

worldwide.

285 P. Drucker, Management (2007), p. 125. 286 M. Wolfson, Financial Crises (1994), pp. 143 et seq.

59

The current crises should be used as an incentive chance for reforms. As M. Wolf argues, “the

man is getting well, but without handling the illness can come back very quickly”.287

287 M. Wolf, After the storm comes a hard climb, Financial Times from 15.07.2009, available at: http:// www.ft.com/cms/s/0/1f7ab9d4-70aa-11de-9717-00144feabdc0.html.

60

Bibliography

Books and commentaries

Adam A., Handbook of Asset and Liability Management (John Wiley and Sons 2008).

Akkizidis I., V. Bouchereau, Guide to optimal operational risk & Basel II, (Auerbach Publications 2006).

Alexander K., R. Dhumale, J. Eatwell, Global governance of financial systems (Oxford University Press, USA 2006).

Altenähr V., T. Nguyen and F. Romeike, Risikomanagement kompakt (Verlag Versicherungswirtschaft GmbH 2008).

Ammann M., Credit risk valuation (2. Edition, Springer 2001).

Arner D., Financial stability, economic growth, and the role of law (Cambridge University Press 2007).

Bainbridge S., The complete guide to Sarbanes-Oxley (Adams Media 2007).

Ballwieser W. [ed.], W. Grewe [ed.], Wirtschaftsprüfung in Wandel (C.H. Beck 2008).

Banks F., Corporate Legal Compliance Handbook (Aspen Publisher 2002).

Barth J., G. Caprio, R. Levine, Rethinking bank regulation (Cambridge University Press 2006).

Basin V., Die Modernisierung der 8. EU Richtlinie unter Einfluss des Sarbanes-oxley Acts (Grin Verlag 2009).

Berwanger J., S. Kullmann, Interne Revision (Gabler Verlag 2007).

Biegelman M., Building a World-Class Compliance Program (John Wiley and Sons 2008).

Bizmanualz I., Finance & Treasury Procedures for Compliance and Performance (Bizmanualz, Inc. 2008).

Bluhm C., L. Overbeck, Ch. Wagner, An introduction to credit risk modeling (Chapman & Hall/CRC 2002).

61

Boos K., R. Fischer, H. Schulte-Mattler, Kreditwesengesetz (4. Edition, C.H. Beck 2008).

Bowden A., M. Lane, J. Martin, Triple bottom line risk management (John Wiley and Sons 2001).

Brink G. van den, F. Romeike, Corporate Governance und Risikomanagement im Finanzdienstleistungsbereich. Grundlagen, Methoden, Gestaltungsmöglichkeiten (Schäffer-Poeschel 2004).

Burke, D., Guy, K. Tatum, Audit Committees, A Guide for Directors, Management, and Consultants (5. Edition, CCH, Inc. 2008).

Carmichael J., M. Pomerleano, Development and Regulation of Non-Bank Financial Institutions (World Bank Publications, 2002).

Chew D., Corporate Risk Management (Columbia University Press 2008).

Chorafas D., Implementing and auditing the internal control system (Palgrave Macmillan, 2001).

Chorafas D., Stress testing for risk control under Basel II (Butterworth-Heinemann 2007).

Clarke T., International corporate governance : A Comparative Perspective (Routledge 2007).

Crouhy M., D. Galai, R. Mark, The essentials of risk management (McGraw-Hill 2006).

Culp Ch., The risk management process : Business Strategy and Tactics (John Wiley and Sons 2001).

Daft R., R. Allen, E. Sandburg, Management (8. Edition, South-Western College Pub 2008).

Doorley J., H. Garcia, J. Osborn, Reputation Management (2. Edition, Routledge 2006).

Drucker P., Management (HarperBusiness 2007).

Effros R., Current legal issues affecting central banks (Volume 4, International Monetary Fund 1998).

Fiege S., Risikomanagement- und Überwachungssystem nach KonTraG Prozess, Instrumente Instrumente, Träger (Gabler 2006).

Fischer R., H. Schulte-Mattler, Kreditwesengesetz. Kommentar zu KWG und Ausführungsvorschriften (C.H. Beck 2008).

62

Fleischer H., Handbuch des Vorstandsrechts, (C.H. Beck 2006).

Fletcher W., T. Plette, The Sarbanes-Oxley Act: Implementation, Significance, and Impact (Nova Science Publishers 2008).

Friedman A. and S. Miles, Stakeholders: theory and practise (Oxford University Press, USA 2006).

Fus S., Business Continuity Management bei Finanzdienstleistern (Grin Verlag 2008).

Gallati R., Risk management and capital adequacy (McGraw-Hill 2003).

Geishecker L., R. Weston, Risk! (AMR Research 2007).

Griffiths A., S. Wall, Applied economics (Pearsons Publications 2007).

Gutterman A., The legal considerations in business financing (Quorum Books 1994).

Hauschka Ch. [ed.], Corporate Compliance (C.H. Beck 2007).

Hilz-Ward R., O. Everling and N. Löhndorf, Risk Performance Management (Gabler 2009).

Hommelhoff P., K. Hopt, A. v. Werder, Handbuch Corporate Governance (Verlag Otto Schmidt 2003).

Hopt K., H. Wiedemann [ed.], Aktiengesetz Großkommentar (7. Edition, Walter de Gruyter 2008).

Jennings M., The seven signs of ethical collapse (St. Martin's Press 2006).

Johnson C., A. Mosich, W. Meigs, Financial Accounting (John Wiley and Sons 2003).

Jorion P., Value at Risk (2. Edition, McGraw-Hill 2000).

Kaltofen D., S. Paul, S. Stein, Retail Loans & Basel II: Using Portfolio Segmentation to Reduce Capital Requirements (CEPS 2005).

Kalwait R., R. Meyer, R. Erben, Fr. Romeike, O. Schellenberger, Risikomanagement in Der Unternehmensfuhrung (Wiley VCH 2008).

Kraft C., Die Mindestanforderungen an das Risikomanagement (Grin Verlag2008).

Luz G., W. Neus, P. Scharpf, P. Schneider, M. Weber [ed.], Kreditwesengesetz (KWG) (9. Edition, Schäffer-Poeschel 2009).

63

Leitch M., Intelligent Internal Control and Risk Management (Ashgate 2008).

Mallin C., Corporate Governance (2. Edition, Oxford University Press, 2007)

Martin T., T. Bär, Grundzüge des Risikomanagements nach KonTraG (Oldenbourg Verlag 2002).

Merna T., F. Al-Thani, Corporate Risk Management (2. Edition, John Wiley and Sons 2008).

Moeller R., COSO Enterprise Risk Management (John Wiley and Sons 2007).

Montana P., B. Charnov, Management (Barron's Educational Series 2000).

Müssig A., Bilanzielle Risikovorsorge und außerbilanzielle Risikoberichterstattung (Gabler 2006).

Olson D., D. Wu, Enterprise Risk Management (World Scientific Publishing Company 2007).

Pal N., From Strategy to Execution: Turning Accelerated Global Change into Opportunity (Springer 2008).

Parmenter D., Key performance indicators: Developing, Implementing,and Using Winning KPIs (John Wiley and Sons 2007).

Peltzer M., Deutsche Coprorate Governance , Ein Leitfaden (2. Edition, C.H. Beck 2004).

Powell A., Basel II and developing countries (World Bank, Financial sector operations and policy department 2004).

Power M., The Risk Management of Everything: Rethinking the Politics of Uncertainty (Demos 2004).

Ramos M., How to comply with Sarbanes-Oxley section 404 (John Wiley and Sons 2006).

Ringleb R., T. Kremer, M. Lutter, A. v. Werder, Kommentar zum Deutschen Corporate Governance Kodex (2. Edition, C.H. Beck 2005).

Rogers C., Financial reporting of environmental liabilities and risks after Sarbanes-Oxley (John Wiley and Sons 2005).

Romeike F., Lexikon Risiko-Management (Bank Verlag Köln 2004).

Schmidt K., M. Lutter [ed.], Aktiengesetz Kommentar (2. Edition, Verlag Otto Schmidt 2008).

64

Scott H., Capital adequacy beyond Basel: Banking, Securities, and Insurance (Oxford University Press, USA 2005).

Senge L. [ed.], Karlsruher Kommentar zum OWiG (2. Edition, C.H. Beck 2006).

Tarantino A., Manager's guide to compliance (John Wiley and Sons 2006).

Tarullo D., Banking on Basel (Peterson Institute 2008).

Trenerry A., Principles of Internal Control (New South Wales University Publishing Limited 1999).

Williams H., Federal banking law and regulations (American Bar Association 2007).

Wolf K., B. Runzheimer, Risikomanagement und KonTraG, (4. Edition, Gabler 2003).

Youngberg B., The Risk manager's desk reference (2. Edition, Jones & Bartlett Publishers 1998).

Reports, research papers & professional standards

Begründung zum Regierungsentwurf eines Gesetzes zur Kontrolle und Transparenz im Unternehmensbereich (KonTraG), Begr RegE BT-Drucks 13/9712.

Committee on Corporate Laws of the American Bar Association, Model business corporation act annotated: official text with official comments and statutory cross-references (2005).

Financial Accounting Standards Board, Determining the Fair Value of a Financial Asset When the Market for That Asset Is Not Active, FASB Staff Position No. 157-3 (2008).

Gorton G., The Panic of 2007, National Bureau of Economic Research, Working Paper No. 14358 (2008).

Institut der Wirtschaftsprüfer in Deutschland (IDW), Prüfungsstandard 340: Die Prüfung des Risikofrüherkennungssystems nach §317 Abs. 4 HGB, Die Wirtschaftsprüfung 1999 (WPg 1999), pp. 658 – 662.

International Monetary Fund, Initial Lessons of the Crisis (2009), http://www.imf.org/ external/np/pp/eng/2009/020609.pdf.

International Monetary Fund, Lessons of the Financial Crisis for Future Regulation of Financial Institutions and Markets and for Liquidity Management (2009), http://www.imf.org/external/np/ pp/eng/2009/ 020409.pdf <last visit: 15.07.2009>.

International Valuation Standards Committee, Exposure Draft of Proposed Revised International Valuation Standard 2, http://www.ivsc.org/pubs/exp_drafts/ivs2.pdf <last visit: 15.07.2009>.

65

KPMG, Focus on transparency – Trends in the presentation of financial statements and disclosure of information by European banks (2009),

Osili U., A. Paulson, Bank Crises and Investor Confidence, Federal Reserve Bank (FRB) of Chicago Working Paper No. 2008-172.

Reinhart C., K. Rogof, Is the 2007 U.S. Sub-Prime Financial Crisis So Different? An International Historical Comparison, Harvard University, Institute of Economics Working Paper 5.02.2009.

Sy A., The Systemic Regulation of Credit Rating Agencies and Rated Markets, International Monetary Fund, IMF Working Paper 09/129 (2009).

The Institute of Risk Management (IRM),The Association of Insurance and Risk Managers (AIRMIC) and ALARM The National Forum for Risk Management in the Public Sector, Risk Management Standard, http://www.theirm.org/publications/documents/Risk_Management_ Standard_030820.pdf <last visit: 15.07.2009>.

United States Government Accountability Office (GOA), Financial Regulation – Review of Regulators’ Oversight of Risk Management Systems at a Limited Number of Large, Complex Financial Institutions (2009), http://www.gao.gov/new.items/d09499t.pdf <last visit: 15.07. 2009>.

Whalen R., The Subprime Crisis -- Cause, Effect and Consequences, Indiana University, Networks Financial Institute, Policy Brief 2008-PB-04.

Wymeersch E., Corporate Governance and Financial Stability, Ghent University, Financial Law Institute Working Paper No. WP 2008-11.

Elst Ch. Van der, M. van Daelen, Risk Management in European and American Corporate Law, European Corporate Governance Institute, Law Working Paper No. 122/2009 TILEC Discussion Paper No. 2009-023.

U.S. Committee of Sponsoring Organizations of Treadway Commission, COSO Enterprise risk management – integrated network, available at: http://www.coso.org/Publications/ ERM/COSO_ERM_ExecutiveSummary.pdf <last visit: 15.07. 2009>.

Corporate sources

BASF Group, Compliance Program of the BASF Group, http://www.basf.com/group/ corporate/en/about-basf/vision-values-principles/code-ofconduct/index <last visit: 15.07.2009>.

Coca-Cola Company, Coca-Cola Company Ethics & Compliance, http://www.thecoca-colacompany.com/citizenship/ governance_ethics.html <last visit: 15.07.2009>.

Deutsche Bank AG, Legal, Risk & Capital, http://www.db.com/de/content/company/ legal_risk_capital.htm?dbiquery=null%3Arisk+management <last visit: 15.07.2009>.

Fannie Mae, Annual Report on Form 10-K, http://www.fanniemae.com/ir/pdf/sec/2006/ form10k_120606.pdf <last visit: 15.07.2009>.

GlaxoSmithKline, GlaxoSmithKline Compliance Programme, http://www.gsk.com/about/ corp-gov-ethics.htm <last visit: 15.07.2009>.

66

ING Group, ING Group Compliance Risk Management Charter and Framework, http://www.ing.com/group/showdoc.jsp?docid=139868_EN&menopt=cog|coc|gpo <last visit:

15.07.2009>.

Merck & Co., Inc. Comprehensive Compliance Program, http://www.merck.com/about/ compliance/ ccp.html <last visit: 15.07.2009>.

METRO Group, METRO Group Compliance Program, http://www.metrogroup.de/servlet/ PB/menu/1138270_l2/ index.html <last visit: 15.07.2009>.

UniCredit Group, Compliance function, http://www.unicreditgroup.eu/en/Governance/ compliance.html <last visit: 15.07.2009>.

UniCredit Group, Risk management program, http://www.unicreditgroup.eu/ucg-static/ downloads/credit_risk_ENG.pdf <last visit: 15.07.2009>.

Report of Investigation by the Special Investigative Committee of the Board of Directors of Enron Corp. v. 1. 2. 2002, availbale at: http://news.findlaw.com/hdocs/docs/enron/sicreport/ index.html.

Report of Investigation by the Special Investigative Committee of the Board of Directors of Worldcom, Inc. v. 31. 3. 2003, availbale at: http://www.edgar-online.com/bin/irsec/finSys_ main.asp?dcn=0000931763-0300186 2&x=118&y =17.

Articles

Bürkle J., Corporate Compliance – Pflicht oder Kür für den Vorstand der AG, Betriebs Berater 2005 (BB 2007), pp. 565-570.

Burwitz G., Das Bilanzrechtsmodernisierungsgesetz - Eine Analyse des Regierungsentwurfs und der Änderungsvorschläge des Bundesrats, Neue Zeitschrift für Gesellschaftsrecht 2008 (NZG 2008), pp. 694-700.

Campos Nave J., S. Bonenberger, Korruptionsaffären, Corporate Compliance und Sofortmaßnahmen für den Krisenfall, Betriebs Berater 2008 (BB 2008), pp. 734-740.

Fratianni M., Financial crises, safety nets and regulation (2008), http://ssrn.com/abstract =1286903 <last visit: 15.07.2009>.

Garfinkel J., J. Sa-Aadu, A Decade of Living Dangerously: The Causes and Consequences of the Mortgage and Financial Crises (2008), http://ssrn.com/abstract=1331294 <last visit: 15.07.2009>.

Garfinkel J., J. Sa-Aadu, A Decade of Living Dangerously: The Causes and Consequences of the Mortgage and Financial Crises (2008), http://ssrn.com/abstract=1331294 <last visit: 15.07.2009>.

Hauschka Ch., Der Compliance-Beauftragte im Kartellrecht, Betriebs Berater 2004 (BB 2004), pp. 1178-1182.

Hauschka Ch., Von Compliance zu Best Practice, Zeitschrift für Rechtspolitik 2006 (ZRP 2006), pp. 258-261.

Hüffer U., Die leitungsbezogene Verantwortung des Aufsichtsrates, Neue Zeitschrift für Gesellschaftsrecht 2007 (NZG 2007), pp. 47-54.

67

Kort M., Verhaltensstandardisierung durch Corporate Compliance, Neue Zeitschrift für Gesellschaftsrecht 2008 (NZG 2008), pp. 81-86.

Krohn G., W. Gruver, The Complexities of the Financial Turmoil of 2007 and 2008 (2008), http://ssrn.com/abstract=1282250 <last visit: 15.07.2009>.

Lingemann S., D. Wasmann, Mehr Kontrolle und Transparenz im Aktienrecht: Das KonTraG tritt in Kraft, Betriebs Berater 1998 (BB 1998), pp. 853-862.

Lösler T., Das moderne Verständnis von Compliance im Finanzmarktrecht, Neue Zeitschrift für Gesellschaftsrecht 2005 (NZG 2005), pp. 104-108.

Mattheus D., P. Hommelhoff, Risikomanagementsystem im Entwurf des BilMoG als Funktionselement der Corporate Governance, Betriebs Berater 2007 (BB 2007), pp. 2787-2790.

Meyer C., Gesetz zur Modernisierung des Bilanzrechts (Bilanzrechtsmodernisierungsgesetz - BilMoG) - die wesentlichen Änderungen, Deutsches Steuerrecht 2009 (DStR 2009), pp. 762-768.

Murphy A., An Analysis of the Financial Crisis of 2008: Causes and Solutions (2008), http://ssrn.com/abstract=1295344 <last visit: 15.07.2009>.

Ostrup F., L. Oxelheim, C. Wihlborg, Origins and Resolution of Financial Crises; Lessons from the Current and Northern European Crises (2009), http://ssrn.com/abstract=1407613 <last visit: 15.07.2009>.

Pampel G., Die Bedeutung von Compliance-Programmen im Kartellordnungswidrigkeiten-recht, Betriebs Berater 2007 (BB 2007), pp. 1636-1639.

Schwarcz S., Understanding the subprime crises, South Carolina Law Review (Vol. 60/2009), pp. 549-570.

Simkovic M., Secret Liens and the Financial Crisis of 2008, American Bankruptcy Law Journal, Vol. 83 (2009), pp. 253-295.

Wall F., Komptabilität des betriebswirtschaftlichen Risikomanagements mit den gesetzlichen Anforderungen?, Die Wirtschaftsprüfung (WPg 2003), pp. 457-471.

Wolf K., Zur Anforderung eines internen Kontroll- und Risikomanagementsystems im Hinblick auf den (Konzern-) Rechnungslegungsprozess gemäß BilMoG, Deutsches Steuerrecht 2009 (DStR 2009), pp. 920-924.

Newspapers articles & other sources

A lifeline for AIG, The Economist on 17.08.2008, http://www.economist.com/businessfinance/ displayStory.cfm?story_id=12244993, <last visit: 15.07.2009>.

Anderson J., E. Dash, Struggling Lehman Plans to Lay Off 1,500, The New York Times from 29.08.2208, http://www.nytimes.com/2008/08/29/business/29wall.html?em <last visit: 15.07. 2009>.

Barr C., Fannie, Freddie: The biggest losers, CNNMoney.Com, 7.09.2008, http:// money.cnn.com/2008/09/07/news/economy/shareholder_wipeout.fortune/index.htm <last visit:

15.07.2009>.

68

Bogoslaw D., Fannie Mae and Freddie Mac: A Damage Report, BusinessWeek on 29.08.2008, http://www.businessweek.com/investor/content/aug2008/pi20080828_330540.htm <last visit:

15.07.2009>.

Boyd R., Another Swiss miss at UBS, CNNMoney.Com, 1.04.2008, http://money.cnn.com/ 2008/04/01/news/companies/boyd_ubs.fortune/ <last visit: 15.07.2009>.

Chang R., Entry barriers stifle U.S. credit ratings competition, Reuters on 24.06.2009. Available at: http://www.reuters.com/article/ousiv/idUSTRE55N4VU20090624 <last visit: 15.

07.2009>.

Compliance has greater role than before crisis, says ex-Lehman head of compliance, Complinet, http://www.complinet.com/connected/news-and-events/webcasts/great-crash/share/ great-crash-articleA.pdf <last visit: 15.07.2009>.

Crawford D., M. Walker, German Regulator Warned of Hypo Bank Problems Before Bailout, WSJ from 28.05.09, p. A6, http://209.85.135.132/search?q=cache:J5KpI11AKOAJ:online. wsj.com/article/SB12434608723259931.html <last visit: 15.07.2009>.

EU Court: ThyssenKrupp Must Pay EUR3 Million Cartel Fine, DowJones Deutschland on 01.07.2009. Available at: http://www.dowjones.de/site/2009/07/eu-court-thyssenkrupp-must-pay-eur3-million-cartel-fine.html.

EU executive to ease fair value on banks – document, Reuters on 10.10.2008, http:// www.reuters.com/article/governmentFilingsNews/idUSLA68354320081010.

Goldfarb Z., D. Cho, B. Appelbaum, Treasury to Rescue Fannie and Freddie: Regulators Seek to Keep Firms' Troubles From Setting Off Wave of Bank Failures, Washington Post on 7.09.2008, http://www.washingtonpost.com/wp-dyn/content/article/2008/09/06/AR20080906 02540.html?hpid=topnews <last visit: 15.07.2009>.

Höpner A., Siemens zahlt 800 Millionen Dollar, WirtschaftsWoche on 15.12.2008. Available at: http:// www.wiwo.de/unternehmer-maerkte/siemens-zahlt-800-millionen-dollar-381406/.

J. Anderson; E. Dash, Struggling Lehman Plans to Lay Off 1,500, The New York Times from 29.08.2208. http://www.nytimes.com/2008/08/29/business/29wall.html?em <last visit: 15.07. 2009>.

Lauren L., Northern Rock Nationalized, Forbes.Com, 17.02.2008, http://www.forbes.com/ 2008/02/17/northern-nationalize-bank-markets-cx_ll_0217northernrock.html <last visit: 15.07. 2009>.

Miller B., C. Kong Ho, Merrill Lynch Cut to `Sell' at Goldman on Writedowns, Bloomberg on 5.09.2008, http://www.bloomberg.com/apps/news?pid=20601087&sid=aDWTPYeHBS8g& refer=home <last visit: 15.07.2009>.

Singing the blues, The Economist on 27.11.2008, http://www.economist.com/businessfinance/ displayStory.cfm?story_id=12689930 <last visit: 15.07.2009>.

SocGen postmortem, Financial Times on 25.01.2008. Available at: http://www.ft.com/.

The downturn in facts and figures, BBC NEWS on 21.11.2007, http://news.bbc.co.uk/ 2/hi/business/7073131.stm <last visit: 15.07.2009>.

Timmermans C., Company Law as Ius Commune?: First Walter van Gerven Lecture (2002), http://www.law.kuleuven.ac.be/ccle/pdf/wvg1.pdf <last visit: 15.07.2009>.

Wolf M., After the storm comes a hard climb, Financial Times from 15.07.2009. Available at: http:// www.ft.com/cms/s/0/1f7ab9d4-70aa-11de-9717-00144feabdc0.html.

69

Katzensteiner M., A. Riedl, M. Boschen, Die Akte Porsche, WitrschaftsWoche from 8.06.2009.

Short-sellers target M&B and British Airways, Reuters on 3.06.2009, available at: http://www.reuters.com/ article/hedgeFundsNews/idUSLNE56200U20090703.

Stempel J., GMAC mortgage lender teeters toward bankruptcy, The New York Times from 6.10.2008, available at: http://www.nytimes.com/2008/11/06/business/worldbusiness/06iht-deal07.1.17579017.html.

Głogowski T., Pawlak wyrzuca prezesów za opcje, Gazeta Wyborcza from 22.06.2009, available at: http://gospodarka.gazeta.pl/Gielda/1,85951,6746110,Pawlak_wyrzuca_prezesow _za_opcje.html.

Court decisions

Decision of VG Frankfurt a.M. from 8 July 2004, 1 E 7363/03 (I), Zeitschrift für Wirtschafts- und Bankrecht (WM 2004).

Caremark International, Inc. Derivative Litigation, 698 A.2d 959 (Court of Chancery of Delaware – Newcastle County – September 25, 1996).

Stone v. Ritter, 911 A.2d 362 (Supreme Court of Delaware –November 6, 2006).

korus m. corporate risk management and …corporate risk management and compliance would a stricter...

Documents