The second and less obvious way in which lawyers contribute to risk management strategy is through possession of that clearest of all 20:20 vision: hindsight. Of course, where a specific event has occurred in the past, the risk that it will happen again has in all likelihood been recognised and addressed. But detached from the immediate commercial pressures of the business, lawyers have greater freedom to think laterally and to use that vision to see how current circumstances might lead to a different hazard.
In one situation in which Beachcroft Wansbroughs was involved, the object was to assign acceptable degrees of risk to operating businesses and establish criteria for referring new potential risks to the corporate centre. During the analysis it became apparent that different business were each, independently, supplying the manufacturers of a particular product in a way that meant, potentially, the corporate exposure to risk was greater than any of the businesses could have recognised in isolation. The subsequent detailed analysis of rights and duties across the corporation and across jurisdictions allowed a proper risk assessment to be made. Experience of how innocent producers of components can be drawn into product litigation was an important element in that process.
Some substantive issues are also of a legal nature, for example managing contractual risk. The form and content of standard terms and conditions of business have always been a staple element of commercial legal services. Increasingly a lawyer’s most significant contribution lies in enhancing the number of occasions on which such terms are successfully incorporated.
Commercial sales forces, driven by targets and deadlines, often fail to draw up appropriate contracts, with little support from back-office systems. The problem is often compounded by verbal promises about what a product will do and how it will do it. Training which increases the comprehension of risk can pay rapid dividends. Reducing exposure to contractual claims for damages will have a direct impact on the bottom line. But this type of training can rarely be bought ‘off the peg’. It will only work effectively if it is adapted to suit the business’ individual needs and culture. Both the content of the training and its means of delivery must reflect the commercial environment in which those being trained are working.
Finally, lawyers must chart the history of retention and transfer of liabilities through mergers, acquisitions and divestments, together with any warranties, indemnities and insurance policies that relate to them.
Once the importance of risk management is accepted, the next challenge is to develop a successful strategy. At first sight this process seems to have more to do with product stewards and those responsible for safety, health and environment than it does with lawyers. In fact lawyers can contribute to the process in two significant ways.
First, there are obviously issues that are inherently legal in their nature. Involving lawyers in the process of defining risk can assist in preserving confidentiality. Whilst it would be imprudent to assume that, for all purposes and in all jurisdictions, legal professional privilege will protect documents created in the risk management process, the possibility should always be considered. Even where privilege cannot be guaranteed, lawyers can design protocols for creating, preserving and indexing documents in order to eliminate unnecessary risk. Lawyers can also help to reconcile the legal tensions that exist between the precautionary approach inherent in risk assessment and the tests for liability after the event. These vary between jurisdictions and, especially in common law systems, are based on significantly different principles.
Most significantly, it seems clear that policies on corporate governance will increasingly require the regulation of risk to be addressed at the highest level. Principles on corporate governance, set out by the Organisation for Economic Co-operation and Development (OECD), list the ‘..review and guidance of …risk policy…’ amongst the duties of the board. Notes to these principles state that: ‘Another important board responsibility is to implement systems designed to ensure that the corporation obeys applicable laws, including tax, competition, labour, environmental, equal opportunity, health and safety laws.’
Guidance by the Institute of Chartered Accountants in England and Wales (ICAEW) in its publication on Internal Control under the Combined Code (‘the Turnbull report’) brings these concepts firmly to the fore in the UK context. The language of risk management permeates the document. When this is added to the points discussed above, it would be disappointing if most businesses did not in future accept risk management as a key element in maximising shareholder value.
Over the last year concerns about penalties against directors and senior officers personally in respect of corporate killing and environmental liabilities have made this message easier to convey. However, the absence of proposals on the former in the Queen’s Speech in November (and thus their effective consignment to the next Parliament) may, quite wrongly, have quieted these worries.
To some extent these examples for demonstrating the need for risk management tend to bolster the negative image of the topic. Where companies have embraced effective programmes, someone has usually worked the alchemy of creating a positive desire to be better.
It is a reasonable proposition that most, if not all, managers of businesses would like to run their company in a way that causes the least possible harm to the smallest possible number. The difficulty lies in persuading them that acting on their personal scruples will not necessarily reduce profits. The most transparent way to do this would be to track the company’s share price but, with so many other influences on the Stock Market and share prices, this is not always possible. There is, however, at least one FTSE company which has suffered a substantial fall in value recently, apparently attributable to the sale of its holding by an investor on ethical grounds.
The first challenge for any business is always to establish that good risk management will in fact deliver value to investors. In some smaller businesses, this first step may simply be to convey the message that risk management means more than just buying the right insurance cover at the lowest possible premium.
By virtue of their experience of working alongside businesses in crisis when risk management has failed, lawyers can contribute significantly to the process. In one exercise in which Beachcroft Wansbroughs was involved, the outcome of an earlier problem was used to demonstrate to senior management how expectations and perceptions developed internally can be shattered by external, judicial analysis. By identifying direct and indirect costs arising from such an experience, it is possible to make a strong financial case for avoiding a repetition. Moreover, re-creating the experience through role-play can help to bring out the non-financial costs of a product or environmental crisis, in terms of both internal and external images of the company and its reputation for good corporate governance.