Gupta and Leech argue for enhanced board attention to risk management. It's an interesting and detailed post, which I urge you to read. I am deeply skeptical, however, of their calls for greater regulatory attention to the issue. As I have written elsewhere (Stephen M. Bainbridge, Caremark and Enterprise Risk Management, 34 J. Corp. L. 967, 982-83 (2009)):
Just because a firm has the ability to reduce risk does not mean that it should. As the firm's residual claimants, shareholders do not get a return on their investment until all *983 other claims on the corporation have been satisfied.141 All else equal, shareholders therefore prefer high return projects.142 Because risk and return are directly proportional, however, implementing that preference necessarily entails choosing risky projects.143
Even though conventional finance theory assumes shareholders are risk averse,144 rational shareholders will still have a high tolerance for risky corporate projects. First, the basic corporate law principle of limited liability substantially insulates shareholders from the risks of corporate activity.145 The limited liability principle holds that shareholders of a corporation may not be held personally liable for debts incurred or torts committed by the firm.146 Because shareholders thus do not put their personal assets at jeopardy, other than the amount initially invested, they effectively externalize some portion of the business' total risk exposure to creditors.
Accordingly, as Chancellor Allen explained in Gagliardi v. Trifoods International, Inc.,147 shareholders will want managers and directors to take risk:
Shareholders can diversify the risks of their corporate investments. Thus, it is in their economic interest for the corporation to accept in rank order all positive net present value investment projects available to the corporation, starting with the highest risk adjusted rate of return first. Shareholders don't want (or shouldn't rationally want) directors to be risk averse. Shareholders' investment interests, across the full range of their diversifiable equity investments, will be maximized if corporate directors and managers honestly assess risk and reward and accept for the corporation the highest risk adjusted returns available that are above the firm's cost of capital.148 ,,,,
Just as the business judgment rule insulates risk taking from judicial review, so [In re Caremark Int'l Inc. Derivative Litg., 698 A.2d 959 (Del. Ch. 1996)] should insulate risk management from judicial review.
Risk management necessarily overlaps with risk taking because the former entails making choices about how to select the optimal level of risk to maximize firm value.151 Recall that there are only four basic ways of managing risk: avoiding it by avoiding risky activities, transferring it through insurance or hedging, mitigating it, and accepting it as unavoidable.152 All of these overlap with risk taking. Operational risk management, for example, frequently entails making decisions about whether to engage in risky lines of business and, more generally, determining whether specific risks can be justified on a cost-benefit analysis basis.153 As a result, it is becoming increasingly “difficult to draw a line between corporate governance and risk management.”154
The fuzzy line between risk-taking and risk management is nicely illustrated by how corporations use derivatives. On the one hand, they can be used to hedge risk. On the other hand, they can be used as speculative investments. In many cases, they can be used as both simultaneously.
As Chancellor Chandler correctly recognized in Citigroup, Caremark claims premised on risk management failures thus uniquely implicate the core concerns animating the business judgment rule in a way typical Caremark claims do not.155 Chancellor Chandler seemingly understood that risk management cannot be easily disentangled from risk taking, because it described plaintiffs' claim as “asking the Court to conclude . . . that the directors failed to see the extent of Citigroup's business risk and therefore made a ‘wrong’ business decision by allowing Citigroup to be exposed to the subprime mortgage market.”156 He declined to do so, explaining that “this kind of judicial second guessing is what the business judgment rule was designed to prevent, and even if a complaint is framed under a Caremark theory, this Court will not abandon such bedrock principles of Delaware fiduciary duty law.”157
It seems to me that regulators need to be cautious in this area for precisely the same reasons former Chancellor Chandler rightfully was cautious in Citigroup.