Bit by bit, year by year, governance reporting is getting better. We’re getting a bit more insight into what boards are actually doing – and every bit helps. But there’s still a long way to go to get to the point where we understand why companies think their governance is good.

Let’s start with the good news. It’s still a curate’s egg with no company nailing all (or at least most) of what we’d like to see. Based on a review of the FTSE 100 governance reports, more companies have now recognised that simply restating the Reserved Matters of the committees’ terms of reference doesn’t give us any particular insight into how they actually work. Many are beginning to give an indication of what they’ve focused on to give us a flavour (see below for examples) – particularly for the audit committee. We’re now hearing more about the nature of induction programmes and how the board is briefed. There’s a lot more information on the approach to board effectiveness reviews – and companies are being more adventurous in giving a feel for the resulting changes. There’s progress from last year – and it seems to be more widespread as companies look at each others’ reports to see where things are heading.

But it’s all happening rather slowly. Companies still seem to be stuck in a groove of telling us a lot about what we already know. We know that FTSE 100 companies are going to be following standard governance processes, what boards and their committees do and that their members all have good business experience. We don’t want to hear all about the process. What we don’t know – and what we want to understand – is why the board thinks its governance approach worked well in helping position the company for the future, keeping an eye on the risks and knowing that things are under control. What was good about the way that it applied the processes that was effective? How did it manage to avoid the pitfalls that boards can fall into? How was the experience of the directors applied in a relevant way? What made the board work as a team which provided challenge and support to management? We’re still largely left in the dark.

This year – given the failures of business models and risk oversight structures – we looked particularly closely at risk management reporting. There are a few companies who stand out (see below) as good examples. Their reports are effective in explaining how the different bodies in the governance structure fit with risk oversight: understanding how the board builds a picture of the internal control and risk management structures helps given that it’s at the core of good governance. Clear explanations of the flow of risk information (up and down the organisation structure) also gives confidence that it is actually happening. Explanation of what the risks actually are, how the company defines them and how it deals with them in practical terms – not just a labelling or listing of risks with boiler-plate terminology – helps too. And discussion of emerging risks reassures the reader that the board’s looking ahead and not just relying on past experience or reacting to things that have already happened.

Sadly though, reports of this nature are very much the exception. On the whole, risk management reports are distinctly uninformative, reading like a litany of standard risks with the predictable descriptions of risk mitigants. Discussion of risk management is often text book in style – and, outside the financial services sector, largely absent.

Particularly in the light of events in the financial markets and the risks that it creates for all sectors, you’d like to think that reporting on governance and, in particular, risk management might shift to a more informative level over the next year. And for those struggling with the question of “how?”, keep it simple! Don’t just say what you do (although that’s a good start), explain why it succeeds in doing what it’s supposed to do.

By Richard Sheath, Co-founder, Independent Audit