I am trying not to spend too much time following the crisis on Wall Street and the world’s financial markets.  It’s not so much the precipitous drops in the market indices that I find hard to take, it’s the contact sport of pointing fingers.  While seemingly 3% of the interested parties are trying to find a solution to the mess, the other 97% are assigning blame.  The reality of the situation is that the blame can be distributed far and wide, from politicians and regulators that sought to ease credit restrictions, to corporate management who sought to profit from it, to the speculators and consumers who got in over their heads trying to benefit from it.  Your politicians and mine, all are culpable for either being involved from the beginning or failing to heed the warning signs.

What I want to know is, why did our controls fail us?  Wasn’t Sarbanes-Oxley intended to institutionalize the type of corporate governance that would allow us to steer clear of these lemming leaps into irresponsibility?  What about the GRC framework, that seeks to align Governance, Risk Management and Compliance objectives in a way that maximizes profits, but only a responsible way?  The ability for publicly traded financial institutions to accurately manage risks will properly be scrutinized for their role in this mess.  Why did risk management fail?  Risk management is not easy, but it should have been possible to do much better.  However, enterprise risk management breaks down when it is not comprehensive.  And it cannot be comprehensive if we do not have alignment between the risk to a financial institution and that financial institution’s officers.  That is a section I would like to see in every 10-K filing: what is the personal risk to the corporation’s directors and officers for a failure in their business?  If they have none, that should worry us all. If we cannot account for the risk to our corporate leaders pursuing dubious quarterly targets, what will we really have learned from this mess?