Risk Management in the Boardroom

Presentation to Risk Management Congress 2004Jolly St. Ermins Hotel

London8th July 2004

Prof. Jim Norton

Senior Policy Adviser

UK Institute of Directors

www.profjimnorton.com

• Setting the scene - risk is crucial to business.

• Directors’ Dilemmas.

• Does ‘Turnbull’ help or hinder?

• Zero based approaches to risk management?

• Some final thoughts.

Issues to be covered

Setting the scene - risk is crucial to business

Risk is an essential element of business. The crux of business success is how that risk is identified, managed and controlled

Segmenting “risk” - PEST

Red tape, tax policy, excessive costs, national lack of competitiveness.

Instability (e.g. in countries which represent sources of supply or demand).

Regulatory compliance, combined code, importation of Sarbanes-Oxley.

Fluctuations in demand (both up and down!);

Exchange rate instability.

Aggressive action by competitors (loss of margin).

Failure to meet customer expectations.

Staff dissatisfaction, union action, pension issues.

Skill shortages, Poor perception as place to work.

Health and safety regulation.

Political

Social

Economic

Necessary but not sufficient….

Technological

Substitution (e.g. new types of product or service based on new technologies…).

Insufficient investment in new, more efficient, processes.

R&D targeting and efficiency.

More segments are needed…Operational Environmental

Poor design or product development.

Sales channel failure.

Supply chain vulnerability.

Running out of cash.

Reliability of key processes and information.

Fraud.

Holistic security.

EU chemicals Directive.

Pollution controls.

Pollution arbitrage.

Emissions trading.

Corporate social responsibility.

Energy efficiency.

……

We could add still more segments: legal, …

• Setting the scene - risk is crucial to business.

• Directors’ Dilemmas.

• Does ‘Turnbull’ help or hinder?

• Zero based approaches to risk management?

• Some final thoughts.

Issues to be covered

Directors’ Dilemmas

Daring but careful

The board must be simultaneously entrepreneurial and drive the business forward while keeping it under prudent control.

Combine intimate knowledge with a hands-off approach

The board is required to be sufficiently knowledgeable about the workings of a company, to be answerable for its actions, yet able to stand back from the day-to-day management of the company and retain an objective, long-term view.

Act local, think global

The board must be knowledgeable about “local” issues and yet be aware of potential or actual non-local, increasingly international, competitive and other influences.

Source: IoD “Standards for the Board” 2001

Directors’ “Combined Code” duties..

Risk: Non-executive directors should satisfy themselves that the financial information is accurate and that financial controls and systems of risk management are robust and defensible.

Source: Combined Code 2003

• Setting the scene - risk is crucial to business.

• Directors’ Dilemmas.

• Does ‘Turnbull’ help or hinder?

• Zero based approaches to risk management?

• Some final thoughts.

Issues to be covered

Turnbull Risk Matrices

Source: Typical FTSE quoted company

Risk issue Control exercised at Board level

Report or control relied upon by Board

Impact Probability Risk

Unauthorised borrowings or breach of loan covenants

Approval of gearing strategy and borrowing

Weekly report to Board Members on borrowings and cash balances

H L L

Issues with “Turnbull” - a personal view Works very well initially… Can deteriorate simply into tweaking the

existing, identified, risks on a quarterly basis.

Likely to miss entirely new risks. Unlikely to pick up gradual changes that

have an insidious effect on risk.

Could deteriorate into simple box ticking giving the illusion of good process whilst being fundamentally flawed…

• Setting the scene - risk is crucial to business.

• Directors’ Dilemmas.

• Does ‘Turnbull’ help or hinder?

• Zero based approaches to risk management?

• Some final thoughts.

Issues to be covered

A proposal for a zero based approach… 1 Bring together a risk assessment and control (RAC)

team within the management staffed by direct reports to executive directors.

Have the team meet monthly to review developments and their impact on the various categories of risk.

For each meeting, commission an in-depth review of risk in a specific area.

Have that review carried out by a RAC team member whose normal responsibility does not cover that area…

This process not only brings fresh eyes to old problems but builds cross-functional contacts and trust.

A proposal for a zero based approach… 2

Over the course of a year all the key areas of the business will have been reviewed in some depth.

Have the RAC team report monthly, by exception, to the Board on key changes in the risk profile.

Ensure that a different RAC team member carries out a formal risk presentation to the Board each quarter proposing amendments to the ‘Turnbull’ matrices and facilitating a more wide-ranging discussion…

This process also gives Non-Executive Board Members improved visibility of key managers below Board level….

• Setting the scene - risk is crucial to business.

• Directors’ Dilemmas.

• Does ‘Turnbull’ help or hinder?

• Zero based approaches to risk management?

• Some final thoughts.

Issues to be covered

Some final thoughts….

The identification, management and control of risk is at the heart of all successful businesses.

Businesses cannot survive, let alone prosper, without taking risks…

Ensuring that proper risk assessment and control processes are in place and working is a key responsibility of the Board.

The ‘Turnbull’ requirements, whilst initially useful can deteriorate into box ticking unless regularly refreshed.

Some form of zero based approach to risk review is likely to be useful.

Risk management can be a catalyst for wider business benefits.

But remember, the assessment

of risk is a continual battle. Don’t ever sit

back and believe that you have

won!

Oh dear…!

Questions?

Presentation can be downloaded from:

http://www.profjimnorton.com/IIRRiskV1.ppt