Risk

Finance

Future forecast

Strategy

Management

Turning the tide

Risky business

Ignorance not bliss

Sounding boards

How the financial crisis changed

Factors that could create problems

The cost of ineffective risk

Are board members doing enough

planning attitudes for good | Page 5

for your company | Page 8

management | Page 11

to assess danger? | Page 15

September 2011

Distributed within The Daily Telegraph, produced and published by Lyonsdown which takes sole responsibility for the contents

Bubble jeopardy Why ignoring risks could see your business go pop. A special report on risk management

Business Reporter · September 2011

an independent report from lyonsdown, distributed with the daily telegraph

Foreword

Risk management – in this issue

3

Mitigating circumstances Businesses can’t always prepare for disaster, but good management and planning can turn adversity into advantage

By Tom Nash It is poignant to note that this report on risk management is published four years after the start of the world’s greatest financial crisis since the 1930s – and ten years after the 9/11 terror attacks.

The financial crisis resulted from perhaps the greatest failure of risk management of the postwar era. The trigger for it, sub-prime lending in the US, saw dodgy loans being used to support securities that were bundled up and sold around the world in “special investment vehicles” (SIVs).

Few, if anyone, realised the vulnerability of SIVs – they offered good returns, were mortgage-backed and received high marks from the ratings agencies.

Banks and their regulators – in the UK and elsewhere – largely ignored the funding risk that SIVs posed. In the buoyant pre-crisis global economy, they focused primarily on credit risks.

As one non-executive director of a subsequently insolvent UK mortgage bank observes: “We did

a huge amount of risk analysis – indeed, that’s what was required by the FSA [Financial Services Authority].

“But all the emphasis was on our borrowers’ ability to repay if unemployment and interest rates were to rise. No-one ever questioned that the wholesale money markets could dry up and that the loans couldn’t be rolled over. Then the funding just stopped, virtually overnight. Our vulnerability to that simply hadn’t been understood. The regulators hadn’t been concerned about it and I doubt if any auditors ever raised it as an issue.”

There, in a nutshell, is the challenge of risk management. It is not that the process is overlooked, nor that identified risks are wrongly assessed (although they sometimes are). It is that, in most cases when disaster strikes, it is not the more obvious risk that bites, but the one missed altogether or dismissed as totally unlikely.

Could airlines and aircraft manufacturers have envisaged the impact of 9/11? As a result of the terror attacks, passenger numbers slumped, while plane makers were stuck with scores of

undeliverable new planes on their inventory.

What odds could you have got a few months ago on the News of the World disappearing because of phone hacking? And at the start of 2010 on BP’s existence being put at risk by a single oil spill?

And yet the difficulty in assessing and managing business risk only reinforces the importance of meeting the challenge it presents. As we highlight in the following pages, there are many areas that can unexpectedly endanger an organisation, from strategic threats which have been overlooked to flawed operational procedures.

We describe how every company – and every sizeable organisation in public and not-for-profit sectors – can carry out a structured process of risk analysis and mitigation. We look at the latest corporate governance requirements, as well as areas of emerging threat and real-life insights.

Above all, we argue that risk management is not only a process for avoiding and reducing the dangers of doing business, but it is a discipline that can uncover opportunity and create real competitive advantage.

Making risk work

5

Predicting the unpredictable

8

Lead from the top

11

On the chopping board

15

Companies that saw and conquered What should businesses be looking out for?

Getting managers involved Risk gets personal for directors Cover: Getty Images

Contributors Publisher Bradley Scheffer brad@lyonsdown.co.uk

Journal Assistant Natalie Luketic natalie@lyonsdown.co.uk

Managing Editor Lucie Carrington lucie@lyonsdown.co.uk

Project Managers Evelyn Wobil evelyn@lyonsdown.co.uk Emmanuel Arthur emmanuel@lyonsdown.co.uk

Editor Tom Nash Creative Director Martin Nolan studio@lyonsdown.co.uk Sub Editor Amy Dickson amy@lyonsdown.co.uk

For more information on any of our supplements please contact us: Telephone 020 8349 4363 Email info@lyonsdown.co.uk Online www.lyonsdown.co.uk

Tom Nash is a business writer and editor who has specialised in boardroom issues for more than 25 years. He is a former editor of Director magazine and publishing director of the Institute of Directors (IoD). Now freelance, he currently edits titles for the IoD, the Forum of Private Business and the Institute of Sales & Marketing Management.

Neville Bain is chairman of the Institute of Directors. He has served on the boards of some of the UK’s best-known businesses, including Cadbury Schweppes, Royal Mail, Hogg Robinson and Scottish & Newcastle. He is author of The Effective Board, published by the IoD and Kogan Page.

Paul Bray has written about almost every topic from business and technology to travel, education and food and drink, for many publications including The Daily Telegraph, The Sunday Telegraph, The Guardian, The Sunday Times, Britain’s Top Employers, Computing, Director and Nasdaq International.

Richard Anderson is principal author of Risk Appetite And Tolerance, published by the Institute of Risk Management, and managing director of Crowe Horwath Global Risk Consulting.

Nic Paton is an award-winning freelance business journalist. He is a regular contributor to national newspapers including The Mail on Sunday, The Guardian and The Independent, as well as many professional publications and websites.

Sponsors

Martin Webster is a partner at international law firm Pinsent Masons.

He advises companies and their boards on corporate governance, risk management and general compliance issues. He is author of The Director’s Handbook, published by Kogan Page.

Business Reporter · September 2011

4

an independent report from lyonsdown, distributed with the daily telegraph

Industry view

Risk management takes centre-stage

OpRisk

What was once written off as a middle-office function is now bringing sharp focus to the financial sector RISK MANAGEMENT is becoming essential for decision-making and an aid to improving profitability and stability in the financial sector.

For years risk management was regarded as a somewhat restrictive, but necessary evil in monitoring the trading and lending operations of the bank, required only for keeping the regulators at bay. Risk management is now being viewed as a critical element in setting strategies for optimising allocation of capital and managing market exposure, and also as a tool for assessing the profitability of individual deals and counterparties.

A major factor behind the breathtaking speed and severity of the financial crisis of 2008 was the lack of awareness of the aggregate, enterprise risk of the financial sector It is now viewed as a critical element in setting strategies for optimising capital requirements and market exposure, according to Neil Dodgson, vice-president of business development, banking and regulatory, at Algorithmics, Toronto-based specialists in risk management software.

“Before the crisis, the banks’ priority was not risk management – it was about revenue generation,” Dodgson says. “Risk management was seen as a middle-office function, there to satisfy the regulators and for inclusion in the annual report, but now it is much more closely scrutinised.”

Chief executives now have to understand risk and implement risk management policies, whereas before it was left largely to the Chief Risk Officer (CRO).

“CEOs are grilled by the regulators on risk in their so-called Arrow visits,” Dodgson points out.

“They have to be aware of the bank’s risk appetite and current performance both in total and at the business unit level because now they can’t bring along their CRO to the interview.”

This new awareness has had the advantage of putting risk management on the radar of chief executives, who now demand frequent updates on the current risk exposure and are no longer willing to accept incomplete or outdated information.

As risk management has moved up the agenda, Chief Information Officers (CIO) have had to confront one of the major obstacles to effective risk analysis – data that is spread round a large and disparate organisation in dozens of separate, non-communicating systems in a bewildering variety of formats.

“Systems were created in silos with their operational risks, credit risks, market risks and liquidity risks all managed by independent functions and never the twain shall meet, so banks couldn’t get a full view of their exposure in a timely manner,” Dodgson says.

“When Lehman Brothers defaulted it took many banks weeks to find out what their complete exposure was because it was all over the place in different systems.”

The data silo problem has become significantly more of a challenge in the fall-out from the crisis, because of the number of banks that have been restructured and their divisions distributed in the industry, presenting CIOs with yet more independent, incompatible systems to integrate.

“Algorithmics can break down those silos and provide risk management view across the

Credit Risk Market Risk Liquidity

ALM/FTP GL/Accounting

enterprise so banks can look at comparable data and see a view of the operation as a whole,” Dodgson says. “In the long term that will require many of them to re-architect risk management systems to bring together a single viewpoint of risk, but that can’t happen overnight. As with any major software project, you have to think big but start small.”

Once an institution has its disparate systems talking to each other, the ability to generate an upto-the-minute assessment of actual risk exposure against their risk appetite has several benefits.

As far as the CEO is concerned, a major benefit is that he will not have to take the full fury of the shareholders when they hear that he had not seen it coming, as happened to so many in 2008. But they will also find positive business benefits as well, says Dodgson.

“Managing that risk doesn’t necessarily mean a decrease in profitability – banks may be able to reduce the levels of capital reserves required by regulators and make better and more profitable use of the capital they have,” he explains. Recently an Algorithmics client reduced its regulatory capital

reserve by a significant amount thus allowing them to increase trading/lending in certain markets.

Several banks are already using risk management software as part of their decision making process for new business proposals, allowing them to calculate their exposure to a particular counter-party and more correctly measure the profitability of individual deals or counterparties.

“Knowing the risk impact of a specific transaction means you can decide whether you should make the deal and if so at what price,” Dodgson adds. “Risk management means setting a fairer price for the deal.”

The final benefit for all of us is that effective risk management should result in a more stable financial sector that will be able to support the economy as it recovers from current recession.

Neil Dodgson is VP of business development, banking and regulatory atAlgorithmics.

Call 020 7392 5700 or visit www.algorithmics.com

Make sense of the financial maze Help is at hand for companies wanting to keep track of the complex web of regulation and reform Financial firms already navigating a stuttering economic landscape are also facing the attention of increasingly demanding regulators.

Through initiatives including the global financial reforms of Basel III and Dodd-Frank, consumer reviews and changes in structures, financial institutions have to deal with issues such as an increase in capital quantity and quality, raising and holding more financially liquid assets, incurring higher capital charges, meeting new requirements to track individual client activity and trading through newly-formed central counterparties. In the meantime, the frequency and size of fines that firms have to pay due to lack of compliance or inadequate controls is growing quickly.

In addition, information requirements have dramatically increased. The governing body and senior management need to have tailored, up-to-date and consistent information about the risks, finances and issues of the whole enterprise.

There is also the requirement that firms have a comprehensive and appropriate stress testing framework.

The way firms are organised to meet these requirements means the providers of this information have an almost impossible task.

Firms organise their information production, not in terms of the requirements of the person who will be using it, but in terms of its organisational

function. Finance has some data stored according to financial principles. Credit also has some required data store according to credit definitions and concepts. The same goes for settlements, front office, lending departments, insurance, operations and so on.

The inevitable reconciliation processes often do not work as effectively as a firm needs. As a result there will be errors in preparation and interpretation and responsiveness to queries is compromised. Remember, the most important questions are usually the ones that haven’t been asked so it is unlikely there will be a prepared process for this.

Firms also need to keep abreast of the issues that will affect compliance. This means a mix of education and access to knowledgeable sources.

It is this input that will help drive the organisation

to ask the right questions. Financial firms need to have a single, clean, institution-wide data source, actively used by all the major functional areas.

The information must be normalised – that is each piece of information is entered just once. They need to have the advance reporting and analytical tools to use the data and construct appropriate answers to real business issues. Firms need to have regular and appropriate tailored access to business experts that understand the business of finance, insurance and banking, which can help them understand and interpret the rules and issues before they become a challenge.

Such a solution, with the expert support, will benefit firms in more than just solving the immediate problems. With regular and clean information analysis not only of past performance, but also of the future under the widest variety of

scenarios becomes possible – both at a customer or business line or even for an entire firm level.

A firm will have a clearer idea of the impact on the business in the event of a sovereign downgrade for example, taking into account first order and subsequent second order effects.

More time can be spent analysing than reporting and the key people in the organisation will have a better grasp of the big issues. Wolters Kluwer Financial Services has a framework to allow financial firms to address these issues.

Our customers can keep up to date with the risk, regulatory and compliance issues as they emerge through our compliance resource network (CRN). Here customers are given tailored news as it applies to them with expert analysis. Training is given through our e-learning platforms which supply both general and tailored programmes designed specifically for industry specialists.

Prudential regulation and risk analysis are provided from a single integrated platform, Data Foundation, which is designed to address the needs mentioned above. This platform is part of our industry leading risk and regulatory reporting offerings RiskPro and RegPro. Our offering also includes our ARC Logics solution which comprehensively addresses operational risk issues, tackling many of the systems and control issues firms wish to avoid.

Wolters Kluwer Financial Services cover more than 45 countries and 1,500 financial institutions of all sizes and sectors. You have more to gain than just avoiding a hefty fine www.frsglobal.com

Insight: navigate your way through financial reforms

Business Reporter · September 2011

an independent report from lyonsdown, distributed with the daily telegraph

Risk management

5

Risk – by default Being proactive on risk management can save smaller firms from the failures of others, says building firm Wates

Getty Images

Preparing for uncertainty Attitudes to risk have changed in the wake of the financial crisis and natural disasters

By Nick Paton

Back in 2009, the Queen was famously sent a letter by an august group of economists, led by Professor Tim Besley of the London School of Economics (LSE), attempting to explain why their profession – and so many other “expert” observers – had failed to see the financial crisis of 2007/08 coming.

The letter was a response to a stern question on the origins of the crisis – “Why did nobody notice it?” – during a visit to the LSE in 2008. It argued that, in essence, there had been “a failure of the collective imagination of many bright people”, a “psychology of denial” and “wishful thinking combined with hubris”. We may be four years on from that meltdown but, with markets collapsing over the summer, the US awash with debt and downgraded by rating agencies, the eurozone in crisis, Chinese growth slowing and the oil-rich Arab world

Far from discrediting risk management, the financial crisis appears to have reinforced the need for it in ferment, it remains the case that leaders of organisations of any size and in every sector can ill afford to fall into the traps of hubris, over-optimism or denial when it comes to risk management.

Far from discrediting risk management, the financial crisis appears to have reinforced the need for it – and the need to dispel any complacency surrounding it. As Richard Anderson, deputy chairman of the Institute of Risk Management (IRM) and managing director of Crowe Horwath Global Risk Consulting, points out: “We live in a world of uncertainties.

What is important is that people on boards and within organisations begin to identify the skill-sets that will give them the competencies to identify risk at an early stage. It is about spotting the signals that matter and monitoring them.”

Risk, of course, can take many forms. It can be as simple as a key client running into cash-flow problems, a planning decision going the wrong way, a loan suddenly being called in, or an acquisition or merger unravelling. It could equally be a customer complaint on a social media site going viral, or even “acts of God”, such as this year’s Japanese earthquake and tsunami, causing both immediate devastation and also knock-on problems – as happened with the fractures to the supply chains of automotive giants Toyota and General Motors.

Even apparently unpredictable or unforeseeable events such as the tsunami or BP’s disaster in the Gulf of Mexico can be exacerbated by a lack of risk management or conversely, mitigated by effective forward thinking and risk awareness, suggests Stephen Diacon, professor of insurance and risk management at Nottingham University Business School.

“With Japan, for example, at one level you could question how you could risk manage an act of nature like that,” he says.

“But it has become clear that there were many contributory factors, mismanagement and accidents waiting to happen.

Taylor: risk appetite is a mindset issue

“Risk management is a process implemented to make an organisation more robust. It is not about anticipating everything, it is about building an organisational structure that will make your organisation robust enough to deliver the outcomes according to your risk appetite,” says Diacon.

And it is this phrase – risk appetite – that is crucial to any understanding of risk management. However many tools or checks and balances are in place, if an organisation’s appetite for risk taking is ill judged, there will be greater potential for it to run into problems.

Paul Taylor, chairman of the risk management association Airmic and director of risk assurance at engineering firm Morgan Crucible, says: “It’s not rocket science, it is a mindset issue. I think there has been a change since the financial crisis.”

In July, the association brought out a report with Cass Business School entitled Roads To Ruin, which analysed 23 key corporate failures and argued one thing they often had in common was an information glass ceiling that kept nonexecutive directors (NEDs) in the dark and so increased the risk of corporate failure. The report found that risk failings were commonly down to boards having inadequate skills or expertise

Not amused: the Queen visits the London School of Economics

in place, NEDs failing to exercise proper control, blindness to inherent risks, defective internal communication and inappropriate incentives. Risk and internal audit professionals needed to develop better skills and tools, boards needed to become more alert to risks and there needed to be more reporting at board level by risk professionals, it concluded.

“Good risk management should improve the predictability and delivery of business plans, so when a board sets a direction, it’s sure that it’s going to get there within reasonable tolerances and with fewer surprises,” says Taylor.

One positive is that more business schools – after much soul-searching about their role in encouraging the short-termist mentality that contributed to the financial crisis – are now giving greater prominence to risk-management disciplines.

The corollary to this is that most senior executives had their training before there was so much focus on risk management.

“Do boards need more training? They do need reminding about current best practice,” says the IRM’s Anderson Whatever the risks an organisation faces, management of them remains essential, and it must be led from the top.

In difficult economic times, a key risk for construction company Wates has been subcontractor default, according to group commercial director Andrew Laird.

“The risk is not us but other people not paying them or causing problems. It can often be cash, or lack of cash, that is affecting them,” he explains.

As a result, Wates has pruned the number of subcontractors it works with, down from about 4,000 to 1,700 and – critically – invested in an innovative insurance protection plan called Subguard. The insurance, which is widely used in the US, kicks in when a contractor goes insolvent or breaches obligations.

Laird says: “It has helped to differentiate us with clients. The fact they know we have this insurance in place means they are more comfortable dealing with us. It also shows them we are being proactive when it comes to risk management.”

Risk management has to be a priority in his industry, adds Laird, and the company – which employs 2,400 people – appointed a group risk director at the end of last year and runs regular board-level risk reviews.

“Risk management is very important to us.

We are a family-run firm and the way the board thinks is a penny lost is a penny of your own money,” he says.

“We have really pushed risk management on the basis that it needs to be preventative as opposed to reactive.”

Laird: being proactive when it comes to risk

Negotiating choppy waters Steering a safe course among increasing and changing risks is about improving quality for shipping company Gearbulk Managing risk is a daily discipline for Gearbulk, an international shipping company operating a fleet of more than 70 vessels. Chief risk officer Jake Storey firmly believes that sound risk management has to be led from the top. “For us, risk and risk management is regularly discussed at board level. We then make a point of feeding it through the business. We try to push it out to ensure there are regular risk assessments taking place throughout the company,” he says.

For example, about two-thirds of the company’s 3,000 staff are employed at sea, presenting obvious health and safety risk management challenges. Further operational risks arise from the transport of unitised cargoes such as forest products, non-ferrous metals and steel. Such commodities have rigorous care requirements with respect to handling, stowage and ventilation, so specialist equipment, monitoring and inspection regimes are standard on Gearbulk’s vessels.

At a strategic level, Gearbulk has identified one of its biggest current risks as an imbalance in global supply and demand for vessels. “The period from 2003 to 2008 was fantastic for the shipping market so a lot of vessels were built, but now demand for shipping is lower and China is slowing down, so it is about trying to manage that exposure,” says Storey.

“Risk appetite can be subjective, so it is about quantifying it, addressing behavioural bias and standing back. It is about trying to formalise and improve quality rather than creating a bureaucratic process,” he adds.

Business Reporter · September 2011

6

an independent report from lyonsdown, distributed with the daily telegraph

Industry view

Finance learning lessons from science Automated due diligence model applies a factual testing approach to create a more transparent way of comparing banks WHEN THE VICTORIAN engineer David Kirkaldy built the world’s first specialist testing laboratory for materials in London as a service to engineers, he had carved in stone over the entrance the words ‘Facts Not Opinions’.

Kirkaldy tested parts of bridges, ships, railways and buildings. Today, the principles of scientific testing are beginning to be applied to the broken financial sector. The crisis of 2007/8 revealed fatal weaknesses in the system and exposed the frightening risks banks, hedge funds and mortgage lenders were taking without, in many cases, Woodall: there must be understanding

understanding them or realising their extent.

A major part of the problem is that systems are now interconnected in ways that were inconceivable just a few years ago, according to Ian Woodall, chief executive of investment management consultants Lonkal.

“The high water mark was when the Icelandic banks collapsed and people suddenly realised they had no idea what they were exposed to,” he says. “Treasurers and pension fund managers must have a broad understanding of what their real exposures are.” People began to realise that the risk of a deal with a particular bank is much more complex than the simple credit rating of the bank. What is needed is a wider rating that takes into account the whole picture and puts a figure on it. “What is measured gets monitored, and what gets monitored gets managed,” Woodall says.

Lonkal works in partnership with Your

Treasurer, a treasury risk management service, which has developed an automated due-diligence model that provides a much more comprehensive picture of counterparty risk. The model uses a wide range of figures to create an “ideal bank” as a datum. Donald Aiken, founding director

Credit ratings on their own are no longer considered sufficient for due diligence purposes of Your Treasurer, explains: “With publicly available information we create a model bank, with minimum benchmark ratios and so forth that we would like to see. We then test the data from each bank against that model bank.”

The advantage of this approach is that it creates common data which allows banks to be compared against each other to highlight differences for

investigation. Aiken says. “This enables treasurers and pension fund managers to reliably assess if the bank is suitable for their specific purpose.”

This more holistic approach helps lenders and investors meet the new, much tighter standards of ‘due diligence’ investigations. “Credit ratings on their own are no longer considered sufficient for due diligence purposes because they are based mainly on historical data and tend not to react quickly enough to changing economic circumstances,” Aiken says.

Back in 1879, David Kirkaldy famously investigated the causes of the Tay Bridge Disaster, helping to make bridges safe.

Now similar testing looks set to make the financial sector a less risky business, too.

Aiken: credit ratings alone are not enough

Separating the sheep from the goats

Taking the law into their own hands

In the past, risk managers’ training and experience have been somewhat limited – but now moves are afoot to change all that

Corporate lawyers need help managing the massive volume of data crossing their desks

Risk management has become a missioncritical function in financial institutions, but are risk managers up to the job? The evidence of the credit crisis – and the subsequent round of sackings among banks’ senior risk managers – clearly indicates that many are not, and that more needs to be done to ensure and assess their competence.

According to Keith Waitt, president and CEO of Consultancy Matters, a risk management training and consultancy firm, part of the problem is that the experience and training of the average risk manager are too limited.

“Chief risk officers (CROs) tend to have grown up in one of the bank’s ‘silos’ – credit, market, operational or regulatory – and lack the rounded experience to assess risk across the whole organisation, which may encompass the very different businesses of retail, corporate, commercial and investment banking,” says Waitt.

He advises that anyone interviewing a potential CRO should thoroughly test the candidate’s understanding of all areas of the business. And organisations looking to grow their own risk experts should design a career structure that ensures they build up experience right across the organisation.

Ideally this should include spells working within the business units as well as the risk management function. “Risk managers will have better judgment if they have direct experience of how the business works,” says Waitt.

Enabling risk professionals to escape from their silos requires a more holistic approach to training that deliberately crosses Waitt: tailored training is needed

departmental and functional boundaries, says Waitt. Training should morph as the individual becomes more senior, with increasing emphasis on leadership and influencing behaviours, and less on pure technical knowledge.

There is an art to assessing whether a risk manager’s confidence is built on firm foundations, says Waitt. “Those whose confidence outstrips

Those with high knowledge but low confidence are the little jewels you need to develop their knowledge are going to cause your next crisis, while those with high knowledge but low confidence are the little jewels you need to develop. Once you’ve assessed someone effectively you can give them the tailored training they need.”

A further problem, says Waitt, is that the financial services industry has had no universally recognised professional qualification for benchmarking risk managers.

However, this is about to change with the establishment this year of the Institute of Risk Standards and Qualification (iRSQ). Created specifically for the banking sector, iRSQ has already gained support from a number of global banks and several of the major financial regulators.

“Risk management should be treated as a profession, not merely a function, and the iRSQ qualification will enable risk managers to demonstrate their abilities, and enable potential employers to distinguish the sheep from the goats,” says Waitt. www.consultancymatters.com

In-house legal departments are at the epicentre of company risk management, but too often they lack clear information arising from multiple ongoing legal cases.

“Accessible and verified information is fundamental to effective risk management,” says Larry George, an experienced commercial lawyer and consultant at law firm Macfarlanes.

“Data can only be used effectively and intelligently in risk management if it’s deliverable in timely, readily available, secure and uniform formats that make information sharing and analysis efficient and controllable.”

The problem for many corporate lawyers is the sheer amount of data generated in handling multiple law firms in multiple jurisdictions. With dozens of firms each reporting progress on several cases – often in different formats – the overworked company lawyer has little hope of giving the board the clear, overall picture it needs.

One of George’s multinational clients was facing just such a problem. “They suffered a material and highly publicised incident,” says George.

“This, and the widespread and often inaccurate reporting, gave rise to civil and criminal actions in a multitude of jurisdictions against several different parties.” “In addition to instructing some 20 law firms, the board of the client’s parent company demanded that the in-house legal department create a critical path on a project management basis, to deal simultaneously with all the cases. No single software solution could be found that would handle this volume and complexity George: data must be timely and secure

of information. So George approached Jeffrey Coorsh, a former banker, publisher and enterprise software entrepreneur, and the pair founded Newlands Horizons to develop a suite of software to do exactly that. The result was Legal-Horizons Q (L-HQ), which the principals believe is the most advanced project, case and matter management tool on the market. As Isabelle Rouche of Gide Loyrette Nouel, Paris says: “With this system we have achieved excellent control , saved time and substantial costs for our client.

“Our intuitive, pay-as-you-go solution delivers control of hundreds of cases through various firms in different locations,” says Coorsh. “With modest amounts of training, lawyers across continents, and in multiple languages, can act rapidly and in concert under the direction of the in-house legal department while reducing overall costs to the

The problem for many corporate lawyers is the sheer amount of data generated in handling multiple law firms in multiple jurisdictions client. The cost and status of cases can be reported in a more timely, synthesised and precise fashion and the capabilities of the software can be applied for eDiscovery and Major Group litigation.”

“L-HQ has made reporting to clients much quicker, easier and more direct,” says one user Jeff Isaacs, Partner Hill Dickinson LLP. “It enables lawyers to update the current status and position on any number of cases instantly. The document management aspects of the system recently turned a disclosure exercise on a particular case from a logistical quagmire into a manageable exercise.” www.newlands-horizons.com

Business Reporter · September 2011

an independent report from lyonsdown, distributed with the daily telegraph

Industry view

7

Turning risks into opportunities Global survey explores the top business risks that can be turned to an advantage One person’s risk is another’s opportunity.

So this year, international consultancy firm Ernst & Young has broadened its annual global risk survey to include the major opportunities perceived by experts and business leaders.

“While risk continues to dominate the business agenda, competition is becoming just as dominant,” says the survey. “Market volatility, pricing pressure, variations in market performance and demanding stakeholders have all contributed to a global economy that encourages competitive drive. And with that drive comes opportunity.”

“In the last two years competitive advantage has come mostly from managing risks better than your competitors,” says Gerard Gallagher, head of markets for UK&I advisory at Ernst & Young. “There’s been a lot of focus on this, but it won’t be enough going forward. You also need to understand the opportunities resulting from the current business climate and execute these better than your competitors.”

Topping Ernst & Young’s opportunities list is improving the execution of an organisation’s strategy. “We’ve noticed that our clients who are doing really well are very focused on delivering their core strategy, rather than allowing themselves to be distracted by perceived risks or continuing with ‘deep recession’ tactics, even after the economy has started to recover,” says Gallagher. “Over the last two years another feature which is influencing confidence inside organisations, is what I call ‘Homeland Pessimism’,

sometimes it is hard to see the upside and opportunities around the globe if your home market is struggling.”

“Effectively communicating the strategy to employees is vital,” says Gallagher. For example, a temporary tactic of reducing prices to maintain sales volumes during the downturn could be disastrous if staff blindly continue it once the market has picked up. Investing in processes,

Top ten opportunities Ernst & Young’s recently released survey Turn risks and opportunities into results is based on opinions from leading industry-based and academic commentators across seven global sector groups, plus a largesample survey of companies and governments in 15 countries.

• Improving execution of strategy across business functions • Investing in process, tools and training to achieve greater productivity • Investing in IT • Innovating in products, services and operations • Emerging market demand growth • Investing in Cleantech • Excellence in investor relations • New marketing channels • Mergers and acquisitions • Public-private partnership For more information, visit www.ey.com/GL/en/Services/Advisory or call 020 7951 9759

tools and training to achieve greater productivity is another opportunity, the report found. “Many organisations cut such investment to make shortterm savings during the downturn, but in the longer term this will result in reduced productivity and increased labour costs,” says Gallagher.

Investing in staff training and development – especially in sectors with a ‘bulge’ of skilled staff coming up to retirement – was the most popular response, according to the survey.

Other opportunities range from implementing ERP (enterprise resource planning) systems to introducing a single global operating model.

Another classic casualty of recession is investment in innovation, whether in new products and services or new channels and markets. This could be particularly serious for the UK, since our expertise in R&D and blue-sky innovation – always one of the nation’s strengths – has become essential to our ability to remain competitive in global markets. Innovation in products, services and operations represents a major opportunity, the survey found. Key factors include the development of a coherent organisation-wide strategy for innovation, and well-established processes for managing new products and services. “The race to innovate is back on, and I would expect companies that invest in innovation now will be doing much better than their competitors in three or four years’ time,” says Gallagher.

Much of the demand in the post-recession world economy will come from emerging markets:

Business agenda: competition as dominant as risk

millions of newly-affluent people in China, India and Brazil can now afford branded fastmoving consumer goods, for example. “A lot of companies talk about moving into emerging markets, but nowhere near enough actually do it,” says Gallagher. “In many emerging markets, first-mover advantage is critical, so organisations should be developing and executing their expansion strategies now.”

The two key attributes are having the conviction to press ahead with an emerging markets strategy, while understanding and managing the risks – such as uneven regulation and political uncertainty – that go with it. “In the new economy it will be a case of ‘who dares, wins’ – but not at all costs,” says Gallagher.

Business Reporter · September 2011

8

an independent report from lyonSdown, diStributed with the daily telegraph

Risk management

Exposing the fault lines Whether it’s financial turmoil, security or social unrest, businesses are facing an increasing number of risks in the UK and overseas

By Paul Bray

1

Regulation

In THE WAKE of the worst financial crisis in living memory, it is no surprise that financial and market factors are top of the risk management agenda for many major businesses.

“With the fragile state of the markets, uncertainties about the eurozone, flat growth in the US and UK, and increased regulatory challenges, a whole pile of different issues are rapidly coming together,” says Lesley Jones, group chief credit officer at RBS. UK banks are starting to “think the unthinkable”, she says – what would happen to the weakest banks in the sector if the eurozone is broken up, and what impact would that have on the fragile economic recovery?

“People are starting to get very nervous that uncertainty over the euro zone will act as a damper on global stock market recovery.”

Prolonged economic woes pose risks for all businesses.

“The longer the economy bumps along the bottom, the longer there’s a heightened risk of highly leveraged companies going into insolvency, especially SMEs,” says Jones. “There’s also clear evidence that fraud increases during a down cycle.”

“The banking system could collapse again, as there’s no clear idea of how much toxic waste still exists in the system,” Jonathan Hopkin, senior lecturer in comparative politics at the LSE, told Ernst & Young’s recently published annual risks and opportunities survey. In that survey, six of the top ten identified risks relate to financial and market factors.

Many business owners – and even their banks – remain confused about what would happen if it did.

“The Financial Services Compensation Scheme is very unclear,” says Thomas Coles, managing director of MSM Risk Management, a medium-sized firm which develops risk engineering software. “Our bank had to ask eight different managers whether we were covered.”

Consumer and business confidence seem as depressed as the economy. If you add in market maturity, declining and ageing populations, volatility in commodity and real estate prices and the effect of government spending

BUSINESS RISKS FOR 2011

2Supplies 3 4

Cost cutting

Talent

Pricing

5

Technology

The move to put UK workers on short time when March’s earthquake and tsunami in Japan choked off component supplies brought home the fact that risk is no longer confined by geography.

But today’s super-efficient manufacturing practices can exacerbate a risk still further, says Richard Thomas, European head of risk management services at business insurance specialist QBE. “Supply chains can be so streamlined that there’s no duplication, so if anything goes wrong companies are very exposed,” he says. “Attenuated supply chains mean organisations may not even realise where or what the risks actually are.”

According to the 2010 Cross-Sector Risk Research programme of insurance risk analysts Mactavish, 85 per

1

Regulation

BUSINESS RISKS FOR 2011

2

Cost cutting

3

Talent

4

Pricing

cuts, organic growth for many companies is slowing or is even in retreat, observes Ernst & Young. This means firms seeking rapid growth must take market share from competitors, often through aggressive pricing.

“It’s difficult to envisage many business sectors where pricing pressure isn’t a major issue in the current financial situation,” says nicholas Brookes, chairman of security printer and papermaker De La Rue. “This is only likely to increase for UK plc as international competition is imported from emerging and developing markets.”

Competitive threats are often overlooked by business leaders and their risk managers, who are too ready to accept them as a natural part of doing business, says Mils Hills, senior lecturer in global strategy at Coventry University. “Any business that fails to regard competition as a risk may be in trouble –especially now that brand loyalty is low – and outsourcing and offshoring enable new ventures to be set up very quickly,” he warns.

Access to credit is less of an issue now than a year or two ago, according to Ernst & Young, but its survey still saw a third of companies reporting constraints on credit availability, with one in ten facing challenges in obtaining capital for major investment programmes.

“Finance remains one of the biggest risks for any business and is a major constraint on growth,” says Ajaz Ahmed, internet entrepreneur and founder of Freeserve, whose latest venture, legal365.com, offers legal services on the web. “Banks are so cautious they’ll turn away promising prospects: I think that will continue longer than many people realise.”

Supporting the company pension scheme is a top-ten risk for many organisations, according to Tim Archer, partner in enterprise risk services at Deloitte.

And Steve Culp, managing director for Accenture Risk Management, says companies that are overly eager to boost export sales may do so without adequately hedging their exposure to local market pressures or currency fluctuations.

5

Technology

cent of UK manufacturers are concerned about the supplychain risks resulting from single sourcing, elimination of buffer stocks and spare production capacity, and consolidation of production and distribution centres.

Outsourcing one’s operations does not mean outsourcing the risk – a fact often forgotten by businesses that do outsource – as Armoghan Mohammed, a risk partner at PwC, points out. “It increases complexity and make it more difficult to get a proper view of the risk,” he adds. “Often one or two major projects make it on to the board’s ‘top ten’ risks, such as a major outsourcing or offshoring, a shift in operations or a new IT system,” says Deloitte’s Archer.

While focusing on strategic risks is understandable, De La Rue’s Brookes says: “Companies also need to focus very carefully on operational risks, in particular deliverability of the company’s offering and the risks which could disrupt this. Look at BP where the failing [that caused the Gulf of Mexico oil spill] was essentially an operational, not a strategic one.”

All too often organisations take no action on operational risks until their hand is forced by legislation.

Yet regulation and compliance is itself Thomas: companies exposed by streamlining

perceived as a significant business risk, topping the risk rankings in the Ernst & Young survey for the second year running. “The inexorable rise of legislation and regulation is a major issue for all businesses and is likely to increase,” says Brookes. “The Bribery Act, for example, has already had a major impact on the compliance controls of international businesses.” Considering the whopping fines that can be

If something does go awry, there is an increasing likelihood that it will be all over the internet in no time handed down to both businesses and directors for bribery and other anti-competitive practices – not to mention the collateral damage to the company’s reputation – such concern is understandable.

Regulation does not only pose a risk for multinationals.

Recent research carried out by the Forum of Private Business has found that small firms are spending more time and money on complying with regulations – £16.8 billion per year to be exact. In all, 84 per cent of the organisation’s members reported an increase in time spent on compliance since 2009. Head of campaigns Jane Bennett says: “Despite several government initiatives, it is clear that we are heading in the wrong direction.”

t

an independent report from lyonSdown, diStributed with the daily telegraph

Business Reporter · September 2011

Risk management

9

Security “With any company of any size, my greatest initial concern would be its information security,” says Dick Andrews, a former army brigadier who is now executive director of security specialist Monitor Quest.

Too many boards fail to understand the true value of their intellectual property or to protect it properly, and even apparently watertight information security policies can leave dangerous loopholes, he argues. “I don’t know any company that’s advising its staff over voicemail security, even after everything that’s happened. People leave documents on their desks, and directors have confidential conversations in front of their chauffeurs or in their club.” According to the government’s Office of Cyber Security and Information Assurance, cyber crime costs the UK economy £27 billion a year, £21 billion of this affecting businesses.

“Conventional crime such as burglary remains a risk,” says MSM Risk Management’s Coles. “But if you’re burgled at least you know about it. If someone infiltrates

All too often organisations take no action on operational risks until their hand is forced by legislation

Getty Images

Technology Emerging technologies were placed in the top five in Ernst & Young’s survey of risks. Respondents particularly cited the difficulty of developing an innovation culture, combined with fear of adopting “bleeding edge” (too new) or “white elephant” (of no value) technologies.

“Almost all businesses will need to maintain a clear focus on the delivery of innovation, particularly to avoid being overtaken by more cost-effective processes coming out of the emerging economies,” says De la Rue’s Brookes.

And there are global issues to consider, too – when will the next domino topple in the Middle East, will there be democracy riots in China, will a new government in South Africa nationalise foreign investments, or a new one in Germany abandon the euro?

There are also one-off events, whether known (such as disruption from the London 2012 Olympics), or merely feared. Many observers believe the world is overdue for another disease pandemic, for example.

In the longer term, sustainability of vital commodities such as water and energy is a major concern, as are demographic changes such as declining or ageing populations in many developed countries. And various industries have the potential to inflict huge environmental impact if things go wrong – with increasingly stringent regulations to punish them if they do.

If something does go awry for a business, there Brookes: rise in regulation to continue

is an increasing likelihood that it will be all over the internet and social media in no time, rendering traditional damage limitation difficult or impossible. Whether it is a catastrophic oil spill, a spate of brake failures or an unpopular level of bonus payments, the reputational damage can be severe and long-lasting, especially now that consumers and trading partners are taking environmental and corporate social responsibility issues more seriously.

“The management of reputational risk is poor in the main,” says Monitor Quest’s Andrews. “Many companies are too eager to play down problems that later turn out to be serious, or to shunt the blame on to someone else.”

Top ten opportunities • Improving execution of strategy across business functions • Investing in process, tools and training to achieve greater productivity • Investing in IT • Innovating in products, services and operations • Emerging market demand growth • Investing in cleantech • Excellence in investor relations • New marketing channels • Mergers and acquisitions • Public-private partnership Ernst & Young’s annual risks and opportunities survey, Turn Risks And Opportunities into Results, July 2011

eavesdropping software into your system, it could lie hidden for months or years before it finds something of value and silently passes this to the criminal.”

Denial of service attacks can take down websites or networks for days or even weeks. Company and customer data may be stolen. And the runaway use of social media means staff may be posting and tweeting potentially sensitive information for anyone to read. Increasingly, staff use their own mobile phones and handheld computers for company business, often without adequate security, Coles says. And familiarity with online transactions such as shopping can breed contempt for the potential dangers – risky if the person is using a company account or credit card.

Coventry University’s Hills agrees that an organisation’s own employees pose various threats to its security, some calculated, others unwitting. Some threats are perennial, such as the possibility of sabotage or fraud by staff members, or unsavoury elements who have infiltrated the organisation’s ranks. Others may be exacerbated by the economic cycle, such as mass disaffection among workers who see their bosses receive generous salary rises while their own pay is frozen, or an upsurge of claims for industrial injury when a factory is about to close.

If staff leave, especially under a cloud or through redundancy, they may take confidential knowledge of the organisation or its intellectual property to a rival employer, warns Monitor Quest’s Andrews. This is compounded by the fact that most employers are too trusting and tell members of staff things they don’t need to know, from cash-flow problems to new product developments.

Conversely, the concentration of skills or knowledge in a few key individuals can create risk. “Is it wise to let your whole R&D team fly in the same plane?” he asks.

Less drastic events can still be serious. “If staff leave without a proper succession plan the consequences can be much more extreme than many organisations foresee,” says Accenture Risk Management’s Culp. This common problem is often compounded by a failure to “segment” the workforce in order to identify and retain key individuals, he adds.

The issue of talent management, especially skills availability, is perceived as a growing risk by global businesses, according to Ernst & Young’s survey. Ironically, says Culp, one of the skills currently in short supply is risk management.

Culp: talent management a risk

Business Reporter · September 2011

10

an independent report from lyonsdown, distributed with the daily telegraph

Xxxxxxxxx Industry view

Risk: a new world order With businesses making international links more than ever, how can firms best factor geographic, political and social trends into their strategic risk assessment?

We are all international now. Any corporation of any size will feel the waves from a revolution in the Middle East or an earthquake in China or a butterfly in Brazil, and risk management professionals are having to adapt to the new world order.

The challenge is that geopolitical and cultural trends do not fit well into the established processes and methods of risk management.

“It’s very difficult to do,” says John Abbott, head of corporate risk advisory services at professional services firm RSM Tenon.

“Because of the challenges of globalisation and the political risks that now affect the world, we need to supplement systemic methods with non-quantifiable risks.”

The good news is that company boards are aware that they may be exposed to risks in countries far away of which they know little, and the information is available if you know where to look. “Increasingly the board and non-execs are very interested in the type of risks associated with those trends and there are specialist advisers starting to operate in this area,” says Abbott.

“A lot of this is based around scenario planning – experienced people sitting in a room talking about social and political risk and how it might affect investment in another company, rather than systemic ways of

Global warning signs

Once seen as a cushy number, the role of nonexecutive directors is now critical if future corporate failures are to be averted

identifying risk.” The other good news is that the process does not cost a fortune. “It is not too expensive – it is more about organising the board and non-execs to have the right debate in the right way, not necessarily spending a lot of money on advisers and systems, but using them to create the right environment in the boardroom to have the debate.”

The issues that need to be debated in the boardroom are complex. “Geographic, political and social unrest need to be factored into the strategic risk assessment. What should I do if I do business in Libya or its near neighbours?

Will the potential new regime be more or less of a stable business partner? How do I deal with my Japanese supply chain partner in the wake of their natural disasters? Does the disruption to both Japanese supply and demand mean that I need to develop contingency plans in a ‘safer’ geographic area?

What are the longerterm impacts of climate change?” Abbott asks.

If that was not enoug h, reg u lat ion i s Abbott: regulation is becoming international

In business, as in life, it is optimists who make things happen. But when focusing on the positive means turning a blind eye to risks, things can go badly wrong for even the most successful companies.

The past decade has seen its share of spectacular corporate car crashes – Enron, AIG, Lehman Brothers, Northern Rock to name but a few. One common factor is a failure, obvious in hindsight, to recognise and manage specific risks with the potential to undermine an entire business.

A new report from the Cass Business School analyses 18 instances of major operational or corporate failure since 2000 and highlights what went wrong and why. A key factor is boards unable or unwilling to tune in to warning signals of impending trouble.

The Cass report’s lead author, Chris Parsons, notes that he and his co-authors found multiple “cases in which the board appeared not to be in full control of the business, including cases where the board or its non-executive directors (NEDs) did not fully understand the business model, the foundations and assumptions on which that model was based or the company’s reputation and the essential foundations of that reputation”.

Overbearing, dominant leaders whose minions dare not speak uncomfortable truths come in for criticism in the report but so do complacent non-executive directors who lack the skills or the inclination to fully understand the businesses on whose boards they serve. If being an NED was once an undemanding sinecure, the role now comes with significant duties and responsibilities that should not be undertaken lightly.

The detailed expectations set out for NEDs in the Companies Act 2006 will only become more onerous as future legal and regulatory developments come into force. The 2008

becoming an international matter as well, Abbott points out. “Regulation is becoming more global – the UK Briber y Act has international reach so it doesn’t just impact UK businesses doing businesses in the UK, but also foreign companies with UK interests, which is international regulation that has to be taken seriously,” he says. “Financial regulation will become more international in the future.”

And it is not just multinationals that are increasingly exposed to risks overseas. “Midmarket corporates have links abroad – mainly because of supply chain issues – and are exposed to risks in places such as India and China.”

International risks are often acquired almost accidentally, when a corporation makes a takeover. “We are advising a major New Yorkbased company that has never really stepped outside the US but has bought a very large European company,” Abbott says.

“Now they find that it has subsidiaries in places that are considered high risk investments such as China and Kazakhstan, so they have to be sure that those countries adopt the correct corporate governance processes and follow the various rules of a well-run company.”

A world of international regulation where companies don’t dare move without endless risk assessments and analyses must seem dull

to the old-fashioned entrepreneur, but risks are still there to be taken, albeit fully informed, Abbott believes.

“Does risk still equal opportunity? The debate reminds me of a presentation I did at the Toronto Stock Exchange on risk management in the mining industry. It focused on the old

Combined Code on Corporate Governance already clearly stipulates that NEDs should “satisfy themselves that financial controls and systems of risk management are robust and defensible.”

Risk management is a key phrase in all this but it’s one that has often been rather too narrowly defined. One of the main findings of the Cass

integrity of their supply chains and the experience of their customers, which matters more than ever in a web-enabled world where reputations can be shredded with a couple of keyboard strokes.

Implementing sound risk management practice at every level within your organisation is no longer a “nice to have” – it’s more like a basic licence to operate, something every firm needs if it hopes to satisfy its business partners, customers, staff, investors, and regulators.

Insurance and risk management specialist Lockton was a major sponsor of the Cass study and warmly welcomed the invitation from risk management industry body Airmic, who commissioned the report, to get involved in disseminating its important findings to the wider corporate community.

The report is not about insurance but the underlying risks that jeopardise the future success of today’s successful companies. Purchasing insurance or risk protection without first fully recognising and quantifying these risks makes as much sense as skipping diagnosis and going straight to treatment.

Lockton firmly believes in acting primarily as a consultant to its clients to help them understand the risks they face, proceeding to the insurance transaction only once the potential causes and consequences of those risks have been fully understood. Each transaction should reflect the best possible match between the potential liability and the various forms of insurance protection available.

Investing extra time and attention up front can significantly mitigate the scale of any future difficulties, equipping companies and their officers with the protection they need when challenges arise.

The reality is that global companies, under ever-greater scrutiny from regulators and shareholders, will not trade with firms whose risk management standards are not fit for purpose report was that corporate employees with the designation “risk manager” often lack the access or the authority to scrutinise risk factors at board level.

The report identifies a glass ceiling that prevents auditors and risk managers reporting on risks that originate above them in the corporate hierarchy. Glass ceilings or not, it is also questionable whether some risk managers have the background and the skills required to assess such risks effectively. This only serves to underline the critical role NEDs can and should be playing if future corporate failures are to be averted.

The stark reality is that global companies, under ever-greater scrutiny from regulators and shareholders alike, will simply not trade with firms whose risk management standards are not fit for purpose. It would risk jeopardising the

Because of the challenges of globalisation and the political risks that now affect the world you have got to supplement systemic methods with non-quantifiable risks world order of risk management before global strategic risks appeared to be so relevant. At the end of the session a very experienced mining company director gave his view: ‘I don’t really understand all this. We put a cross on a map, go to a hostile country, drill a hole, hope to find some oil and then work out how to make everyone some money’.

“I sincerely hope that this brave and entrepreneurial spirit can still prevail in our new world.”

www.lockton.com

Business Reporter · September 2011

an independent report from lyonsdown, distributed with the daily telegraph

Risk management

11

At the risk of sounding obvious... …ignoring the possible pitfalls companies face can be a costly business

By Neville Bain

In this complex and ever-changing world, none of us can be sure of what the future holds. But if we can’t claim to have a crystal ball, those in management should at least have plans and processes for dealing with the changes and challenges that do occur.

As chairman of the Institute of Directors, I firmly believe that risk management should always be a key item on the board’s agenda – and board appraisals over the past six years have shown me that there is a continuing focus on the role of risk assessment and management.

However, some of the feedback I’ve had is negative. For example, some people believe that the worst risks affecting an organisation are externally generated and cannot be controlled. Others believe risk management takes too much time – and in some organisations the process is seen as compliance-led rather than a discipline that adds value.

I have some sympathy with these views because in many organisations the process has become cumbersome and

risk, can be overlooked. Not only that, but while in many organisations this is addressed at board level, it’s not always applied further down at executive level. All major decisions should consider the impact of risk – whether it is for capital expenditure or significant revenue items.

The board must be satisfied that an effective process is in place to identify risks, evaluate high-level risks and specifies who is responsible for managing them. There needs to be a review at an appropriate time (that is often quarterly) to ensure that any new risks are evaluated and existing priorities are re-examined.

Non-executive directors often need to become more involved, especially if they chair the audit committee. One of the best ways to achieve this is through a risk workshop to review the risks that impact on the business. The risk workshop, which may well be led by an experienced outsider, may not be needed every year but it is a valuable exercise which is generally enhanced by the presence of some non-executive Getty Images

Heart of the matter How do you embed risk assessment and control in the organisation?

Here are a few pointers Risk control starts with, and should be aligned with, leadership and strategy. The direction the company has chosen must be assessed for risk – each risk must be identified and graded, and as the strands of the strategy unfold, they will need to be assessed in the same way.

The broader environment in which the company trades should be regularly assessed, too – companies are more resilient if they can act on early warning signs of increases to risk profiles.

The subject of risk should feature on the agenda of the management committee each quarter. This means high-level risks can be regularly reviewed and the impact of any newly discovered risks can also be regularly assessed.

The risks of capital projects should be routinely examined as well – project managers should be especially pragmatic about the risk of executing these projects.

Finally, the audit committee should be the champion of risk assessment and control.

New strategy pays dividends Pharmaceuticals group Biocon has transformed its risk management strategy, with the move being led from the very top

Reality check: there’s no hiding from risk in business

Areas of concern The top risks for global businesses fall into four categories: • financial risks • compliance issues • operational risks • strategic risks.

costly, but they do miss the point that when it is done well, risk management is beneficial for organisations of all sizes, and all types.

Risk is not always a bad thing – in fact, it can be a source of profits that the classical economists drew attention to. What is really important is that an organisation needs to understand what risks it is undertaking, and how it will deal with untoward events. That includes specifying which people who have identified responsibilities in the risk-management process.

An organisation’s audit committee has an important role to play, as both internal and external audit work will be based on the risk profile of the company. Larger businesses and those in the financial sector may well have a separate risk committee picking up the detail of the work.

So how can an organisation ensure that its risk management is simple and effective? In the first place, it will be ineffective unless it has the support of the board and the top executive team. That almost goes without saying.

What is slightly more controversial is that while some consultants advise companies to set down their risk policy, I have found this to be of limited value and quite time consuming.

For me, the process starts with the strategy creation. A business needs to understand what risks the strategy entails and, if an alternative is offered, the risks of that alternative.

Sometimes the fact that some of the risks in the key structure of the strategy may be interlinked, creating accumulated

directors, who can add real value to the process with their wider experience and view.

But risk management isn’t just important for commercial organisations – it is a key process for charities and other notfor-profit organisations. The principles are exactly the same, but the management of the process focuses on the benefits – as opposed to having the most comprehensive process.

For example, a number of NHS foundation trusts have been so busy meeting government targets that standards of care to patients have suffered – in some cases very seriously.

A well-publicised case occurred at the Mid Staffordshire NHS Foundation Trust in 2009, where unsafe practice was clearly identified and incorrect information included in the records.

This tragic case is an example where risk management, if it had been properly applied, would have highlighted the dangers of trying to meet objectives set down by government without looking at the impact on the primary purpose of the organisation – to care for patients.

The presence of risk management on a board’s agenda is critical, but it needs to be focused on providing value rather than box-ticking or as a defence against potential litigation.

The approach need not be a heavily bureaucratic – if it is, the business is in danger of being consumed by the process rather than deriving benefit from it.

And that’s a risk none of us can afford to take.

Biocon is based in India, has more than 1,000 employees, worldwide sales and a market capitalisation of $1.5 billion (£940m).

It already identified financial and internal risks and the audit committee reviewed these every six months, but determined to build on its success, the company has developed a new riskmanagement programme.

The move, which has the full support of the chairman and CEO the company, involves greater and more frequent emphasis on risk by the audit committee, a six-monthly review by the board and a better way of looking at external risk.

With the help of an outside adviser, a risk workshop was organised involving both executive and non-executive members of the board.

Activities included grading the severity of a risk, the probability of the event happening, and designating someone to manage the risk.

Biocon’s new risk management process is simple and effective and, as it is led by the chairman, everyone knows it has senior-level support. Strategy and big investment decisions are risk assessed and increasingly the management are examining risk as a regular part of their decision-making.

The process is easy to operate and the cost of it is not high. This already successful company has found the ideal formula for an even more profitable future. www.biocon.com

Business Reporter · September 2011

12

an independent report from lyonsdown, distributed with the daily telegraph

Industry view

Technology: maker and breaker of businesses

As the speed of change in the global economy dramatically alters the world of risk assessment, how can companies better prepare against emerging technologies?

Today’s ruthlessly competitive and fast-moving global economy is a place where corporations that fail to assess their exposure to all kinds of risk are punished harshly, but those that do can flourish in ways undreamed of just a few years ago.

In the 1930s, according to a study in the Economist magazine, the world’s largest corporations were almost immune to risk. They would feature in Standard & Poor’s 500 Index for, on average, 75 years before age, change and world events would finally sweep them away.

Now an S&P 500 company can expect to last just 15 years before it is overtaken by upstarts who have observed technical change or who have adapted to cultural or political shifts. And the life of an S&P 500 company is expected to shrink to just five years over the next fifteen years.

The revolving door is spinning at record speed in the technology sector. When the personal computer was introduced just 30 years ago, IBM was the industry giant, dominating IT globally.

Microsoft was a tiny software company. Bill Gates at Microsoft foresaw the day when there would be a personal computer in every home, and was widely mocked for his prediction, but Microsoft became the industry giant when his vision came into being. But today, Microsoft is in danger of being eclipsed by Apple and Google, and the personal computer looks like going the way of IBM’s mainframes as mobile devices take over.

“Technology advances create disruptive innovation,” says Adam Bates, UK head of risk consulting at KPMG. “Google, Facebook, Twitter and LinkedIn did not exist fifteen years ago, but they are changing the way society works and we communicate.

Amazon is destroying the profitability of large chunks of the high street, iTunes is doing the same for record shops and so on.”

Bates: technology changes society

The disruptive technology underpinning all these new business models is the 24/7 connection provided by the internet, which is being utilised by new business models that came out of leftfield, under the radars of the incumbent corporations. The internet was born in the US defence sector, created by the secretive research

The internet and other technologies have also changed the business landscape in less predictable and possibly even more dangerous ways arm of the Pentagon, the Defense Advanced Research Projects Agency (Darpa) to create a communications network that would be immune to nuclear attack. The world wide web was created at one of the bodies most despised by the American right wing – a European Union research body funded by taxpayers, CERN, the Alpine atomsmashing lab.

Given the unlikely origins of these groundbreaking innovations, perhaps it is not so surprising that incumbents such as Microsoft did not immediately appreciate the danger.

It famously took Gates’ personal intervention to turn Microsoft towards the new internetconnected world.

The speed of change in the new global economy has had a dramatic impact in the world of risk assessment, Bates says. “Boards have to set their strategy to grow their businesses by aligning it with these emerging risks and opportunities,” he says. “They have to make choices in accordance with their risk appetite.”

Senior executives brought up in a more certain world need advice and guidance to arm themselves to make the right decisions when new and disruptive technologies arrive. It has to be remembered that for every Facebook there

is a Myspace, and for every Apple there is a Commodore. “Technology is moving so quickly in terms of computing power, connectivity businesses such as Google or Facebook can quickly destroy businesses and I think it’s very hard for normal people to fully appreciate this rapidly changing world,” Bates says. “They need the right brains and the right advice or there is a danger some new technology can pop up and threaten your business model.”

The internet and other technologies have also changed the business landscape in less predictable and possibly even more dangerous ways, Bates believes. “Globalisation has made everything more connected and hence more reliant on each other,” he says. “So when a specialist European electronics company could not make enough of a type of chip, Hitachi could not put the chips into circuit boards and Nissan had to shut down some of its car production plants because it needed the circuits for the cars. Risk is global now.”

Alarmingly, innovations in apparently unrelated and distant sectors can have an immediate impact in your own business. Possibly the best example is the Apple iPad, greeted when it was first launched with a good deal of cynicism by people who did not believe that anyone wants to pay a lot of money for a screen

that was lousy at data entry and showed every finger mark. The iPad’s world-changing success has had an impact on many markets outside IT or even consumer electronics. “Apple’s iPad changed not just the computer market. I get all my newspapers, books, films and music on my iPad now, that changed 50 years of ingrained behaviour in a flash,” Bates says.

Steve Jobs’ mobile devices, from the iPod to the iPhone and iPad, have cannibalised the computer market (especially the market for cheap laptops) but have also shaken the fusty, legalistic worlds of music, film, newspapers and book publishing to their very foundations. Executives now have to consider not only how emerging technologies will impact their market, but they have to work out how they will disrupt their supply chains, distribution networks, financial structures and even how they manage their workforce.

“While boards may not predict all these events, the key is how well they react when one does happen,” Bates says. “Planning for the worst possible event can help them to prepare. Before, companies relied on what happened in the past.

Today they have got to be forward looking – the world of risk has to be linked to strategy.” Bates believes that sustainability is one of the issues that will drive risk management over the next few decades.

“Sustainability is becoming more important, even to things like transportation – if you sell paint, for example, will it continue to be acceptable to transport a product consisting mostly of water?

Perhaps paint will be sold in powder form in the future, so the consumer can just add water,” he says. “Power drills are another example – research shows that more than 50 per cent of power drills sold are used once a year – perhaps they could be rented for a few pounds for a day’s use.”

As they say, nobody ever bought a power drill – what they wanted was a hole.

One of the more direct impacts of sustainability will be the price of raw materials, Bates says.

“Water, wood and minerals are becoming more expensive and, in some cases, more difficult to obtain. Some things such as rare earths are critical to high-tech products such as mobile phones, but have leapt in price and in some cases are controlled by foreign powers that are not necessarily aligned to our interests.”

Increased concern about sustainability could be an opportunity, of course. “The successful businesses will be those that spot these trends and identify new business models that can become extraordinarily popular and successful and actually destroy old business models, such as Amazon,” Bates says.

The result of this speed and globalisation of threat is to up the profile of risk management.

“This is moving risk away from a dark room in the back of the office and into the boardroom,” Bates predicts. “Directors who cannot understand risk management are going to find themselves marginalised.”

Apple: devices have affected markets other than IT and electronics

Business Reporter · September 2011

an independent report from lyonsdown, distributed with the daily telegraph

Risk management

13

Developing new strategies What do risk appetite and risk tolerance really mean for directors? The Institute of Risk Management is attempting to bring clarity to the confusion

By Richard Anderson

When the Financial Reporting Council (FRC) published the latest UK Corporate Governance Code in May last year, it came with something of an Orwellian twist: it had removed all references to “risk appetite” and “risk tolerance”, even though these phrases had been present in the draft.

The consensus at the FRC seemed to be that the terms were unduly associated with financial services, which might make those in other sectors regard them with undue scepticism as many struggle to understand how those supposed exemplars of great risk management – the banks – got it just so wrong.

As a result of the financial crisis, we are now witnessing the birth of board risk committees (see panel), especially for banks but potentially for other sectors as well, together with a new responsibility in all listed companies “for determining the nature and extent of the significant risks [the board] is willing to take in achieving its objectives”.

While it was a stretch too far to import the language of financial services and call this risk appetite and tolerance, that is effectively what the FRC is inviting boards to consider in the new code.

In fact, risk appetite and tolerance are alive and well in other sectors, but research has shown that these phrases mean different things to different people. In response to the lack of clarity, the Institute of Risk Management (IRM) established a working party to develop guidance for directors and those who advise them as to just what this elusive set of words really means.

The underpinning precept in the guidance – published in September and supported by a number of other professional bodies – is that organisations of all descriptions can only progress by taking those risks that they need to embrace, and managing down those that they wish to avoid. This underlying idea led to three key strands in IRM thinking.

First, risk appetite can only be developed in the context of an organisation’s ability to manage risk. There is little point in developing a risk appetite that a board cannot pursue, so directors will need to understand their organisation’s risk capability.

Second, articulated risk management is needed. Whereas most organisations have looked at the dual concepts of risk and control (they go together like ham and eggs), they are rarely considered in terms of an organisational risk appetite.

Third, organisations need to create a risk appetite framework that is supported by data. This suggests that there may well be an investment need in data systems, which will need to enjoy the same level of data governance rigour as that applied to routine accounting data.

One word of caution: the word “appetite” brings connotations of food, hunger and satisfying one’s needs.

Our interpretation of risk appetite is that it represents a corporate version of exactly the same instincts and cognitive processes.

This can concern people who regard risk management merely as a series of processes, but for those who regard risk management as a cultural and social construct, it is a much more positive perspective.

But what is the point of all of this? At the end of the day, the issue is about helping boards to steer their organisations in achieving their objectives. In the corporate world this might result in more sustainable, long-term value creation, and in the public sector or not-for-profit world, it might result in better social outcomes.

In other words, a better sense of risk appetite should create more positive and informed risk- taking, which, after all, is where the banks fell down.

Risks under review Boards are being urged to take a stronger role in risk management – especially in the financial sector Before the financial crisis, the board’s responsibility for risk management in listed companies was routinely shared with the audit committee, which in some cases was labelled the “audit and risk committee”.

Four years on from the worst of the crisis, the UK Corporate Governance Code continues to require listed company boards to have just three committees: remuneration, nomination and audit.

However, a government-commissioned review by Sir David Walker has advocated that banks and other financial institutions should also set up a separate risk committee with responsibility for oversight and advice to the board on the current risk exposures of the entity and future risk strategy.

The 2009 Walker Review also made other recommendations, including that the board should be served by a chief risk officer (CRO), who should participate in the risk management and oversight process on an enterprise-wide basis and have a status of total independence from individual business units.

It also said the board risk committee should have access to external input as a means of taking full account of relevant experience elsewhere, and should oversee a due diligence appraisal of proposed acquisitions or disposals.

The board risk committee’s risk report should be included as a separate report within the annual report and accounts, it also said.

Although Walker’s recommendations are regarded as over-prescriptive by some, boards in all sectors have since come under increasing pressure to demonstrate that they are managing risk effectively.

A recent report by House of Lords’ economic affairs committee observes: “The assessment of risk, whether by separate risk committees or as part of the audit committee, is becoming a more prominent feature of corporate governance not only in the banks and financial institutions but also in other major companies.

“We strongly support the development of separate risk committees in banks and major financial institutions. Other large companies should institute them where appropriate.”

Tom Nash

Business Reporter · September 2011

14

an independent report from lyonsdown, distributed with the daily telegraph

Industry view

Risk management is everybody’s business A successful strategy is essential in business, but how can you ensure staff are singing from the same song sheet?

PICTURE THE FOLLOWING: a risk manager on the phone with a branch manager. The reason for the call? The branch’s quarterly risk assessment update is overdue. Again. The branch manager says all the right things and promises to complete the update quickly. After the conversation, both people have very different thoughts. The risk manager is thinking: “Why do I have to call these managers every quarter? They’re not taking this seriously.”The branch manager is thinking: “Why won’t these people leave me alone to do my job?

Haven’t we just done this? This process is a pain.”

Sound familiar? Chances are, no matter how strong your risk management program, improvements can be made to the process and the interdepartmental relationships.

Every business wants a successful risk management program, but not everyone has found the same level of success. Talk of removing silos and embedding governance, risk and compliance processes within the business lines is great, but making it a reality forces companies to face a major challenge – the relationship between the risk, audit and compliance professionals and the other business unit leaders and staff. Too often, the risk team believes that the field isn’t taking them seriously, and the field views the risk team as an annoyance at best, or an impediment at worst. How do you bridge that gap and develop the right levels of communication and trust?

Two-tiered approach Organisations that have developed successful risk management programs share two strategies:

firstly, the creation of a strong, risk-aware corporate culture and the ability to relate risk issues to everyday business through a straightforward and repeatable process. The cultural change has been discussed in many other forums, but that does not diminish the importance of both top-down and bottom-up buy-in. Executives need to lead by example, and business units need to realise that risk functions are a key part of their daily activity, not a nuisance to be set aside or hurried through.

The second strategy tends to be overlooked, in that many risk professionals view risk issues in and of themselves, rather than in the context of the organisation’s larger goals. On one level, this is understandable – a constantly evolving, relatively new discipline requires narrow focus to become established.

However, this narrow view has the unwanted effect of making the risk team appear to be aligned differently from the rest of the business. You need to bridge this gap. The benefit arises not only from ensuring that everyone is on the same page, but also by instilling a belief across the organisation that when circumstances change, teams are capable of adjusting to ensure continued understanding.

There are several ways to ensure that central risk teams are translating risk concepts to get better response from the business units. It can be very easy to focus risk management efforts solely on prevention or avoiding past mistakes – the trick is to learn those lessons and apply them to the present and the future. Ensuring

that individual business units understand their levels of risk tolerance will allow decisions to be made about pursuing opportunities that can help attain specific objectives.

One team, one goal Using assessment software that clearly and easily aligns processes with the organisation’s objectives is a must. To maximise the co-operation of the market-facing staff, the software should be easy to use and display only the information and tasks pertinent to a specific user. Providing a natural user experience will lead to more timely responses and less handholding, so everyone can focus on the data rather than the process.

The risk team can also help by quantifying not just the exposure but also the upside associated with a risk activity. Showing a business unit that there is limited or no upside to a risk helps the risk manager make a far more compelling case about changing behaviours or assigning resources to mitigate a risk.

Conversely, if the risk manager can quantify opportunities, risk functions will gain broader acceptance as a fundamental part of each business unit.

Either way, better information will be produced, analysed and acted on more efficiently.

Both sides will understand that they are working toward the same goal – the success of the company.

Goal: clear vision of strategy and planning is vital

Tom Bolger is VP at Methodware, a world-leading provider of risk, compliance and audit software headquartered in London

Protect yourself in the battlefield of business Inadequate or cumbersome risk management can be damaging to your business, so how can you find the right balance of control?

Buying a suit of armour was a difficult decision for knights of yore. It had to be strong enough to withstand attacks by anything from a poniard to a battleaxe but light enough for the knight to be able to fight back. Plus, of course, armour was cripplingly expensive and the knight had to leave some money over to pay for his horse, squire and all his retainers.

Today’s corporate warriors are discovering they face the same compromise when it comes to risk management. Failure to invest in adequate processes and systems will result in disaster sooner or later, but install an unnecessarily strong system of checks and the operation may become too slow and costly to be competitive.

It is essential for managers to understand the controls they are imposing on the company’s processes, and the impact each control has on the risk level. It is also important to set the risk level to an acceptable level, says Giles Triffitt, director of risk consulting at KPMG. “Unless you have a full understanding of the controls, you can’t be sure you are managing the risks,” he says. “You may not be managing the right risks anyway because that transparency just isn’t there.”

The problem is particularly acute in established systems where controls have been added piecemeal over the years. “We have seen – particularly in highly regulated businesses – a layering effect with control on control, which tends to mask whether the risk management is cost efficient,” Triffitt says.

“Unless you know how much you are spending in

proportion to the risk you are managing, it could be an extremely inefficient equation.”

Understanding the controls allows you to classify them into essential controls, which are often imposed by regulatory bodies, and nonessential or local controls that are there to provide

Effective process: slash costs and operation times

the company with the level of exposure to risk that it feels comfortable with. “If you do a proper analysis and understand the risk, some of these local controls can be entirely removed, many downsized” Triffitt points out. “You can also reduce costs by automating some of the expensive manual controls or changing where they are in the process.”

Analysis of the process flow should expose where the risks are and where the controls are applied, allowing them to be aligned. “Some checks might be done several times in the process – perhaps a thorough, automated check could be done upfront, but done once,” Triffitt says.

Once the controls have been placed so they manage risk effectively, the risk level itself can be adjusted with confidence. In many cases, Triffitt has found that risk levels have been set so conservatively that procedures that should be routine are bogged down in checks and counterchecks.

“Staff are often nervous to challenge the value a control might add because of the possible come back days, weeks and months later if a loss occurs on their watch. However, it is right to challenge a zero tolerance approach to control when it does not add value.”

Risk management is often seen as a drag on business, but correctly engineering a process can slash costs and create a more efficient operation at the same time, Triffitt believes. “You can design the controls for maximum effectiveness and to be more cost efficient. It is a process design thing

as much as a risk management thing. Bringing together the cost reduction challenge with the risk management challenge leads to great value,” he says.

Many repetitive procedures in the financial sector accrete controls that seemed a good idea at the time but now are either ineffective or outdated, but nobody wants to remove them because ‘they

Unless you know how much you are spending in proportion to the risk you are managing, it could be an extremely inefficient equation must be there for a purpose’. “In some of the processes I have looked at, some 40 to 50 per cent of the cost is broadly ‘control’, especially in the operations of financial services. This in itself may not be wrong,” Triffitt says, “but equally I have found that a case can be made to remove a large proportion of this cost (often up to half) based on proper analysis”.

Decision-making in life is often influenced by prejudices. Risk management is no different.

Recent losses often incur a disproportionate control response. Over time these prejudices fade with corporate memory and the decisions can be unpicked and challenged.

Business Reporter · September 2011

an independent report from lyonsdown, distributed with the daily telegraph

Risk management

15

Dangers of complacency

Getty Images

Recent corporate disasters suggest that traditional means of assessing and managing risk aren’t up to the mark. Board directors need to think more creatively

By Tom Nash

The starting point in looking to the future of risk management in the UK must be some assessment of how well the discipline is practised at the moment. The answer, according to many experts, is not encouraging.

Professor Jim Norton, president of the BCS (the chartered institute for IT) – and a risk management expert with extensive board experience in both the private and public sector – is highly critical of the majority of boards.

He says they are “remarkably bad at assessing risk” and easily slip into “the illusion of effectiveness” by carrying out box-ticking exercises – reassuring themselves that they have got known risks covered, rather than challenging themselves to spot new or emerging risks.

“Risk management is a genuinely difficult challenge and there is certainly not sufficient focus on it at board level,” he says. “People and organisations are great at reviewing familiar risks, but they’re not good at looking at areas of emerging or future risk.”

The problem with current practice, says Norton, is that established methodologies such as the Turnbull risk matrix (a simple dual-axis diagram used to display various risks in relation to their likelihood and potential impact) focus largely on risks that have already been identified.

Norton: focus on new and emerging risks

“The danger is that the board reviews this list of known risks, adjusts their score and considers the job done,” he says. “In fact, the world around them has changed and previously unknown – or zero-based – risks have emerged.”

John Mills, director of business continuity specialist ICM, says that businesses are also poor at assessing comparative risks. “Many organisations focus on the likelihood of a major disaster, such as terrorism, extreme weather events, or fire, but it is the ordinary and not the dramatic that has significant impact more often,” he says. In fact, in the first half of this year, 94 per cent of ICM’s customers who invoked their business continuity plan did so because of IT problems, with only 6 per cent accounting for more dramatic incidents such as fire or flood. “Organisations in the UK need to reprioritise what they consider a risk and plan for business disruption accordingly,” Mills adds.

Norton has little faith in businesses resolving such problems by the conventional means of managing risk through their internal and external audit functions, or through dedicated risk managers. These, like main boards, tend to be “locked in their own mindsets” he says (see panel).

His creative solution to the problem is that companies could approach the task more effectively “by introducing a shadow board of up-and-coming executives who will have fresh eyes”. By analysing the risks in each other’s operational areas – not their own – these functional or divisional directors will gain a better understanding of the wider business and have regular opportunities to

present their findings to the main board. Beyond the company’s internal resources and its retained auditors, there are numerous external specialists and tools available to businesses manage risk.

Risk consultants, for example, look set to play a bigger role, often at the invitation of dedicated risk committees.

“People and organisations are great at reviewing familiar risks, but they’re not good at looking at areas of emerging or future risk” – Norton And, as a safety net, there is always the option of insurance cover to ease financial pain in the event that certain risks cannot be contained.

But however good the tools or advice you buy in, Professor John Board, dean of Henley Business School, advises that risk management needs to start at home, at board level, and be cascaded downwards, raising key issues and bringing day-to-day benefits throughout the organisation.

“A lot of the time, the most effective form of risk mitigation is just active management,” he says. “It is a bit like house insurance – yes, it is a tool to mitigate the risk of your house being burgled, but you are still expected to lock your doors and windows.”

Your neck on the line As well as managing business risks, directors should consider the risks they face in a personal capacity

By Martin Webster A seat on the board may bring handsome rewards, but most directors appreciate the job carries risks as well.

Pitfalls come in a variety of shapes and forms. Simple administrative lapses, such as a failure to keep accounting records, can result in directors facing personal fines, disqualification or even imprisonment where they are at fault.

If health and safety laws are involved, managers can face personal liability

if they consented to a breach, turned a blind eye or neglected their duties.

Competition law is another area where responsible directors can face heavy fines or even imprisonment if price-fixing, market sharing or other anti-competitive agreements are entered into.

The Bribery Act, in force from this July, brings new liabilities for those who accept bribes or bribe others. Directors can be guilty if they consent to or ignore bribery on the company’s behalf by an employee or agent. Extradition to face justice in a less friendly jurisdiction is another risk

when crimes are committed abroad.

Perhaps surprisingly, under UK law directors do not owe duties direct to their shareholders. They may wreak havoc on their company but investors cannot sue them for the losses they suffer as a result.

Only the company may claim for breach of directors’ duties, and only to make good the harm it has suffered as a result.

The reality is that short of insolvency or a major falling out, companies rarely sue their own directors – RBS and Sir Fred Goodwin is a case in point. In practice,

an ignominious departure and loss of reputation are greater risks.

Directors’ and officers’ insurance is often seen as a necessary safeguard, but no policy will give complete protection: it won’t pay a criminal fine or serve a prison term for a director, and other exclusions may deny cover when a claim is made.

Protection is often arranged on a group basis and, where the parent is overseas, policy terms may be difficult to access and not adapted to suit a UK subsidiary. Companies can also grant

indemnities to directors in limited circumstances, so avoiding disputes with insurers and ensuring a faster pay out. But prevention is better than cure: training on where the risks lie and seeking timely advice are first steps in helping directors negotiate these bear traps of corporate life.

Webster: prevention better than cure