Regulatory prods for efficient management information systems and well-developed risk-assessment procedures should generally be welcomed by shareholders. Similarly, regulatory insistence on capable and independent oversight of risk management is consonant with shareholder interests, which might be damaged by employees who exercise poor judgment or whose compensation structures may incentivize them to take risks not desirable for the firm as a whole.
To a considerable extent, then, fostering sound risk-management practices serves the overlapping interests of both shareholders and regulators. The possible divergence of interests comes not in the architecture of risk management but in substantive decisions on risk appetite. How, then, might corporate governance be changed to incorporate risk considerations consistent with micro- and macroprudential regulatory objectives?