Risk Management in the Boardroom Presentation to Risk

Risk Management in the Boardroom Presentation to Risk Management Congress 2004 Jolly St. Ermins Hotel London 8 th July 2004 Prof. Jim Norton Senior Policy Adviser UK Institute of Directors www. profjimnorton. com

Issues to be covered • Setting the scene - risk is crucial to business. • Directors’ Dilemmas. • Does ‘Turnbull’ help or hinder? • Zero based approaches to risk management? • Some final thoughts.

Setting the scene - risk is crucial to business Risk is an essential element of business. The crux of business success is how that risk is identified, managed and controlled

Segmenting “risk” - PEST Economic Political Red tape, tax policy, excessive costs, national lack of competitiveness. Fluctuations in demand (both up and down!); Instability (e. g. in countries which represent sources of supply or demand). Aggressive action by competitors (loss of margin). Regulatory compliance, combined code, importation of Sarbanes-Oxley. Exchange rate instability. Failure to meet customer expectations. Technological Social Staff dissatisfaction, union action, pension issues. Substitution (e. g. new types of product or service based on new technologies…). Skill shortages, Poor perception as place to work. Insufficient investment in new, more efficient, processes. Health and safety regulation. R&D targeting and efficiency. Necessary but not sufficient….

More segments are needed… Operational Environmental Poor design or product development. EU chemicals Directive. Sales channel failure. Pollution controls. Supply chain vulnerability. Pollution arbitrage. Running out of cash. Emissions trading. Reliability of key processes and information. Corporate social responsibility. Fraud. …… Energy efficiency. Holistic security. We could add still more segments: legal, …

Issues to be covered • Setting the scene - risk is crucial to business. • Directors’ Dilemmas. • Does ‘Turnbull’ help or hinder? • Zero based approaches to risk management? • Some final thoughts.

Directors’ Dilemmas Daring but careful The board must be simultaneously entrepreneurial and drive the business forward while keeping it under prudent control. Combine intimate knowledge with a hands-off approach The board is required to be sufficiently knowledgeable about the workings of a company, to be answerable for its actions, yet able to stand back from the day-to-day management of the company and retain an objective, long-term view. Act local, think global The board must be knowledgeable about “local” issues and yet be aware of potential or actual non-local, increasingly international, competitive and other influences. Source: Io. D “Standards for the Board” 2001

Directors’ “Combined Code” duties. . Risk: Non-executive directors should satisfy themselves that the financial information is accurate and that financial controls and systems of risk management are robust and defensible. Source: Combined Code 2003

Issues to be covered • Setting the scene - risk is crucial to business. • Directors’ Dilemmas. • Does ‘Turnbull’ help or hinder? • Zero based approaches to risk management? • Some final thoughts.

Turnbull Risk Matrices Risk issue Control exercised Report or control at Board level relied upon by Board Unauthorised borrowings or breach of loan covenants Approval of gearing strategy and borrowing Weekly report to Board Members on borrowings and cash balances Impact Probability Risk H L L Source: Typical FTSE quoted company

Issues with “Turnbull” - a personal view l l Works very well initially… Can deteriorate simply into tweaking the existing, identified, risks on a quarterly basis. Likely to miss entirely new risks. Unlikely to pick up gradual changes that have an insidious effect on risk. Could deteriorate into simple box ticking giving the illusion of good process whilst being fundamentally flawed…

Issues to be covered • Setting the scene - risk is crucial to business. • Directors’ Dilemmas. • Does ‘Turnbull’ help or hinder? • Zero based approaches to risk management? • Some final thoughts.

A proposal for a zero based approach… 1 l l Bring together a risk assessment and control (RAC) team within the management staffed by direct reports to executive directors. Have the team meet monthly to review developments and their impact on the various categories of risk. For each meeting, commission an in-depth review of risk in a specific area. Have that review carried out by a RAC team member whose normal responsibility does not cover that area… This process not only brings fresh eyes to old problems but builds cross-functional contacts and trust.

A proposal for a zero based approach… 2 l l l Over the course of a year all the key areas of the business will have been reviewed in some depth. Have the RAC team report monthly, by exception, to the Board on key changes in the risk profile. Ensure that a different RAC team member carries out a formal risk presentation to the Board each quarter proposing amendments to the ‘Turnbull’ matrices and facilitating a more wide-ranging discussion… This process also gives Non-Executive Board Members improved visibility of key managers below Board level….

Issues to be covered • Setting the scene - risk is crucial to business. • Directors’ Dilemmas. • Does ‘Turnbull’ help or hinder? • Zero based approaches to risk management? • Some final thoughts.

Some final thoughts…. l l l The identification, management and control of risk is at the heart of all successful businesses. Businesses cannot survive, let alone prosper, without taking risks… Ensuring that proper risk assessment and control processes are in place and working is a key responsibility of the Board. The ‘Turnbull’ requirements, whilst initially useful can deteriorate into box ticking unless regularly refreshed. Some form of zero based approach to risk review is likely to be useful. Risk management can be a catalyst for wider business benefits.