directors showed that directors are not focusing on risk management. forty - five percent of directors surveyed said their organization did not have a formal enterprise risk management process - or any other formal method of identifying risk. an additional 19 percent said that they were not sure whether their company had a formal process for identifying risks. sound corporate governance is an essential element of a strong risk management process. governance involves many players, each with specific assigned responsibilities to ensure that the system as a whole is sufficient to support the business strategy and ensure the effectiveness of the systems of internal control. after enron : a survey for corporate directors, institute of internal auditors and national association of corporate directors, directors are not expected to understand every nuance of every line of business or to oversee every transaction. they can look to management for that. they do, however, have the responsibility to set the tone regarding their corporations'risk - taking and to oversee the internal control processes so that they can reasonably expect that their directives will be followed. they also have the responsibility to hire individuals who they believe have integrity and can exercise a high level of judgment and competence. in the light of recent events, i might add that directors have the further responsibility to periodically determine whether their initial assessment of management's integrity was correct. indeed, beyond legal requirements, boards of directors and managers of all firms should periodically test where they stand on ethical business practices. they should ask, for example, " are we getting by on technicalities, adhering to the letter but not the spirit of the law? are we compensating ourselves and others on the basis of contribution, or are we taking advantage of our positions? " risk management and internal controls boards of directors are responsible for ensuring that their organizations have an effective audit process and that internal controls are adequate for the nature and scope of their businesses. the reporting lines of the internal audit function should be such that the information that directors receive is impartial and not unduly influenced by management. internal audit is a key element of management's responsibility to validate the strength of internal controls. internal controls are the responsibility of line management. line managers must determine the level of risks they need to accept to run their businesses and to assure themselves that the combination of earnings, capital, and internal controls is sufficient to compensate for the risk exposures. supporting functions such as accounting, internal audit, risk management, credit review, compliance, and legal should independently monitor the control processes to ensure that they are

circumstances. one tool for managing risk is securitization. many of the assets on a firm's balance sheet, such as receivables and customer leases, can now be securitized - - that is, grouped into pools and sold to outside investors. securitization helps a firm manage the risk of a concentrated exposure by transferring some of that exposure outside the firm. by pooling a diverse set of assets and issuing marketable securities, firms obtain liquidity and reduce funding costs. of course, moving assets off the balance sheet and into special - purpose entities, with the attendant creation of servicing rights and high - risk residual interests retained by firms, generates its own risks. derivatives are another important tool for managing risk exposures. in the ordinary course of business, firms are exposed to credit risk and the risk of price fluctuations in currency, commodity, energy, and interest rate markets. for example, when an airline sells tickets months before a flight, it becomes exposed to fluctuations in the price of jet fuel. a higher price of jet fuel translates directly into lower profits and, perhaps, a greater risk of bankruptcy. firms can now use derivatives - - options, futures, forwards, and so on - - to mitigate their exposure to some of these risks. the risk can be transferred to a counterparty that is more willing to bear it. in my example, the airline could buy a forward contract or a call option on jet fuel to hedge its risk and thereby increase its financial stability. another major category of risk is credit risk, which also has become much more quantified. models analyze a corporate customer's or borrower's probability of default, the loss in the case of default, and the borrower's likely exposure at the time of default, taking into consideration future draw - downs. the greater use of credit models in retail transactions provides a stronger framework to assess risk and ensure that pricing reflects credit quality. for consumer credit, however, models are less proven, since data collection and loss estimates generally evolved after the 1990 - 91 recession and so have not been proven under stress conditions or for subprime borrowers. because many of these borrowers did not have significant access to credit in previous recessions, their ultimate default rate in the current cycle should help to validate the strength of the new statistical models. for example, the health of financial institutions today reflects the improvement in the risk management process that has been ongoing at banks for many years.