The governance gap: governance improvements are incomplete without effective controls over all the business risks a life insurer faces.

In recent years, life insurance companies have joined the rest of the financial services sector in devoting significant time and attention to improving corporate governance. Strengthening board independence, expanding the authority of audit committees, and taking steps to rein in excessive executive compensation are just some of the actions life insurers have taken as they seek to comply with Sarbanes-Oxley and restore customer trust.

The focus on stronger governance is certainly appropriate. Widely publicized misdoings in the financial sector--from the mutual fund scandals of 2003 to the abuses in the commercial property/casualty brokerage and, finally, to the crisis in the finite reinsurance sector--demonstrate all too vividly what can happen when governance is insufficient or ineffective. And life insurance executives, wary of the fallout from these scandals, are keenly aware of the insurance industry's exposure to reputational risk. With state insurance commissioners considering requiring assessments of internal controls similar to those in Sarbanes-Oxley Section 404, even mutual life insurers are taking steps to shore up their governance practices.

But one area--possibly the single most important one--that continues to cry out for more attention is the need to make risk governance an integral part of corporate governance. Even though risk-taking is an essential aspect of the insurance business, insurance companies are still not where they need to be when it comes to measuring exposure to, and establishing controls over, the full array of business risks, both financial and nonfinancial, that an insurance company faces in the course of conducting its business.

Just what does risk governance entail? It encompasses the processes a company employs to ensure that it is adequately addressing all the risks that could prevent the company from achieving its stated business objectives. Identifying the company's risk appetite is just the first step. Risk tolerances and control objectives should be set by management and reviewed and approved by the board. And once the board and management have agreed on those broad principles, they must create a framework of policies, controls, monitoring, and reporting for all of the company's business processes. They must identify the risks to the effective operation of those processes, establish mitigation strategies to control them, and report on the effectiveness of the controls.

The risk governance process must give the board timely and complete information on how well the company's control systems are working. This information should include:

* Quantitative and qualitative assessments of key exposures on both an individual and aggregate basis. Undistilled, the volume of risk information a company produces can be overwhelming. Boards need to be provided with reports specifically designed for their use so they can better manage and analyze risk information.

* Recent changes in the company's risk profile and control policies or procedures. At a minimum, explicit changes by management to important policies should be communicated to the board. Of course, Section 302 of Sarbanes-Oxley suggests that the board should be made aware of changes in the control environment. But even if no policies have been modified, the company's risk profile will be affected as market and economic conditions change.

* Results of ongoing monitoring of controls over key business processes, financial reporting, and disclosures. In addition to being informed about annual assessments done in connection with Section 404 of Sarbanes-Oxley, the board should be notified about any interim work to improve controls and repair control deficiencies.

* The status of regulatory compliance processes and controls, including any regulatory inquiries or actions relating to compliance.

Oversight at the board level is critical to ensure that management fulfills its responsibilities for adhering to risk governance principles. This oversight should be carried out by independent members of the board with the resources and skills to evaluate the effectiveness of the risk governance framework and systems on a regular basis.

The board members chosen for this task must have a deep understanding of the risks associated with running the business and must be able to evaluate whether management is effectively implementing processes to mitigate and controls those risks.

Unquestionably, establishing effective risk governance processes and policies is a huge task for both boards and managements, but the benefits to the company are manifold. They include more effective execution of the company's strategy, more thorough compliance with company policies, and--perhaps most important--improved shareholder trust and enhanced credibility with rating agencies and regulators.

Robert W. Stein, a Best's Review columnist, is chairman of Global Financial Services for Ernst & Young. He male be reached at [e-mail].