The risky business of regulating risk management in listed companies

Policymakers around the world, including in Europe, increasingly display a tendency to embed risk management into law, for example by mandating risk governance best practices or by requiring firms to have risk management functions in place. Most recently, the European Commission issued a proposal to increase disclosure by listed and large firms on their management of risks, which will indirectly imply greater attention to risk management procedures on their part. This paper, after documenting the phenomenon of Risk Management ‘Juridification’ (RMJ) with specific reference to developments in EU legislation, highlights the numerous shortcomings of such a policy: we first highlight the intrinsic limits of risk management and, even more, risk measurement techniques. Failure to understand such limits may lead to market participants’ over-reliance ex ante and to enforcers’ over-reaction ex post. Next we show how risk management can hardly be distinguished from management and argue that RMJ may well lead to courts’ excessive ex post-review of managerial decisions. We then focus on the intensified perils of standardization, proceduralization, and acritical box-ticking that RMJ implies. After clarifying that RMJ can do little to alleviate systemic risk, we further show that risk management requirements may serve managers’ interests vis-à-vis shareholders and are hard to justify for companies with controlling shareholders. Finally, we highlight their anticompetitive effects due to their higher relative burden on small companies. We conclude that absent special, industry-specific circumstances, RMJ is, if not an even dangerous exercise, a less effective and efficient regulatory tool than policymakers tend to think.