Doing right on governance: the core of corporate governance is the development of a risk-sensitive culture that enables the right people to do the right thing at the right time. (Life/Health: Underwriting Insight).

Shareholder, regulatory and analyst expectations for corporate behavior and governance have forever been changed in the wake of company failures and accounting scandals that will have far-reaching ramifications for insurance companies. These heightened expectations are reflected in the new Sarbanes-Oxley Act and Securities and Exchange Commission regulations requiring chief executive officers and/or chief financial officers to certify financial reporting and internal controls, as well as the broader corporate-governance issues raised by analysts and shareholders, and the intensified interest in risk management and controls.

These changes, all part of a call for improved corporate governance and accountability, are forcing organizations to develop new frameworks and approaches to ensuring the effectiveness of governance processes, the transparency of business activities and risk exposures, and more proactive management of financial and operational risks. As these efforts continue, the redefinition of corporate-governance processes increasingly is being shaped by the recognition that many corporate-governance structures never were designed for the size and complexity of today's corporations and the scope of their business activities.

While, by their nature, governance solutions should vary from company to company, any governance process should include these basic steps:

* Establishing an appropriate "tone from the top," by developing a risk-sensitive culture and setting clear management expectations for ethical business practices, accountability and tolerance for risk.

* Establishing a capable management team, board and audit committee, and oversight processes that will be effective in challenging the organization's activities.

* Linking corporate incentives with appropriate behavior.

* Designing shareholder communications to create greater transparency about performance and risk levels.

* Creating greater balance between the focus on quarterly profits and longer-term performance by improving the understanding of risk and risk-adjusted performance measurement.

* Developing effective risk-management processes to identify; monitor and communicate potential risk-control and disclosure issues.

* Designing internal and external audit activities that ensure the effectiveness of financial and disclosure controls and timely risk identification, measurement, reporting and management.

Clearly, effective governance processes require that management and the board establish a culture based on high ethical standards, open and frank communications, and accountability. Board composition and oversight processes are also essential. But the lifeblood of effective governance is high-quality, continuous information about the organization--information that confirms the effectiveness of its business processes and risk-management systems. Without meaningful information about business performance, risk exposures and the effectiveness of controls, governance systems will starve and atrophy--a condition all too common in the pre-Sarbanes world.

Appropriate accounting and transparent disclosures cannot be achieved without meaningful analysis of how business-unit results compare with prior-year results and plans' and against the results of principal competitors. Risk-adjusted measures of results, explanations of the drivers of variances (not just superficial descriptions of the source and degree of variation), source-of-earnings analyses and comparisons with peers are all important information for management and audit committees.

Similarly, effective governance is impossible without reliable information about the risks being faced by the company. Information quantifying the company's sensitivity to changing conditions--principally through risk capital measurement--is needed to understand and challenge its risk profile, risk-mitigation strategies, and even its business models and key processes. And underlying all sound governance systems are procedures that assure the effectiveness of controls over business activities, transactions, and disclosures.

The core of governance includes developing a risk-sensitive culture that enables the right people to do the right thing at the right time. This is reinforced by processes that link stakeholder value to the organizational fabric and by management systems that oversee its business processes. Strong performance-reporting processes, risk-management structures and a focus on the effectiveness of controls all are needed to turn the rhetoric about corporate governance into improvements.

Robert W. Stein, a Best's Review columnist, is chairman of Global Financial Services for Ernst & Young, New York. He can be reached at [e-mail].