The recent volatility in exchange rates caused by the U.S. economic crisis has exposed a new phenomenon in the Brazilian corporate world: relevant losses incurred with operations involving derivatives. Similar episodes have happened in the past in the United States, with the case of Procter & Gamble/Bankers Trust as one of the most discussed and covered by the media.

Due to their incomplete focus on the problem, the manner in which these losses are being handled by the press and by companies has led to misguided conclusions about their real cause and about companies’ financial management practices. Several studies have shown that corporate governance practices still do not include risk management as a major attribution of boards of directors and, therefore, this topic is not addressed with the knowledge, thoroughness and discipline that it deserves. Thus, some companies do not have risk management policies in place to explicitly and verifiably establish acceptable risks and their limits, while others fail to employ management mechanisms that will enable them to identify when their limits have been overstepped and how to act in these cases.

It is important to emphasize that managing risks does not mean eliminating them completely. It does mean incurring only those risks that the company is capable of managing in a manner that creates value, and for which they have protection or mitigation mechanisms available for when the admissible limits are exceeded. Evaluating how much capital must be allocated to address such risks is also necessary, as well as setting appropriate controls. The higher the risks, the more prepared the internal structure must be to acknowledge, measure, track and warn about actual exposure and potential loss.

But it’s important to note that it’s not enough for a company to have the best control systems and good technicians in place. A culture targeting this competency is required, with consequences for executives:

• Every top executive should have in mind that risks and results are always two dimensions of any decision and, therefore, they should be assessed jointly in terms of expected results and the possible impacts of varying scenarios.

• There must be an executive responsible for risk management, with independence and seniority compatible with those of the executives who take such risks (in the case in question, the financial executives), so that he or she may argue and compare scenarios and assessments while making relevant decisions, bar operations outside the established limits, suggest a reversal of positions, and report to the board or CEO the result of systematic monitoring of the risks to which the company is exposed.

• The board’s regular discussion agenda should include assessment of the company’s risks, and board members should have knowledge and good judgment about risk management topics.

The way to achieve this goal is to provide governance, management and control structures with professionals with seniority, experience and knowledge about modern practices in risk management. In this manner, one can expect a better balance of power among risk-taking areas and greater neutrality in the assessment of compliance with corporate policy and of incurred risks.