Effective Eterprise Risk Maagemet ad Crisis Maagemet Roles ad Resposibilities of the Board ad Maagemet August 16, 2012 It is essetial that compaies have a effective Eterprise-Wide Risk Maagemet Program (ERM Program) ad a Crisis Maagemet Pla i place so that maagemet ad Boards of Directors are prepared, as best they ca be, for both the expected ad the uexpected. Preset evets of the day bear this out. Such "headlie evets" as Ira's cotiued efforts to seek uclear weapos, the Europea fiacial crisis (icludig the impact of the collapse of the Greek ecoomy), political turmoil i Egypt, Libya, Syria ad the Arab Sprig, executive miscoduct, cyber attacks, ad eve the "fiscal cliff" that approaches i the Uited States if a agreemet caot be reached o taxes ad spedig by the ed of 2012 all clearly demostrate oe basic propositio: Chage is upredictable, its cosequeces ca be severe, ad its velocity rarely ca be aticipated. Cotacts Robert E. Bostrom Parter New York D +1 212 398 5833 robert.bostrom@srdeto.com Matthew Dyckma Parter Washigto, DC D +1 202 408 9123 matthew.dyckma@srdeto.com Gary L. Goldberg Pricipal Washigto, DC D +1 202 408 6396 M +1 412 337 3191 gary.goldberg@srdeto.com The cosequeces flowig from a headlie evet are particularly severe i the curret eviromet because of: 1. the politicizatio of headlie evets, 2. the crimializatio of corporate evets, 3. activist reactio of shareholders ad the public, ad 4. the extremely rapid pace at which cosequeces ofte mout. These cosequeces ca frequetly combie to create a expoetial multiplier effect of eve greater itesity ad, accordigly, eve greater risk. The recetly proposed ehaced supervisio regulatios of the Board of Goverors of the Federal Reserve System 1 reflect the Fed's recogitio that prevetative eterprise risk maagemet programs ad post-evet crisis maagemet programs are critical to maagig ad addressig risks i a dyamic ad ucertai eviromet. Likewise, a recet article reported that staff of the Securities ad Exchage Commissio have held meetigs about risk maagemet with directors at fiacial istitutios "to icrease acceptability at the Board level." 2 If federal bakig ad securities regulators are emphasizig Eterprise Risk Maagemet, Boards of Directors ad Maagemet would be well served to emphasize it as well or risk exposig their compaies to the examiatios, ivestigatios ad eforcemet actios which ofte follow ew poits of regulatory iterest. A ERM Program ad a Crisis Maagemet Pla at both the maagemet ad Board of Directors levels are essetial to: mitigate risks ad reduce a compay's litigatio exposure ad, i extreme cases, perhaps are eve critical to a compay's survival; ad improvig busiess operatios by forcig a risk-adjusted aalysis of profitability. The key i the process is to recogize ad assess the extet of a compay's likely iterdepedece across multiple lies of busiess, geographies, ad product mixes whe a crisis materializes i ay oe of these. ERM is a process to idetify, assess ad mitigate risk. This remaider of this article will briefly describe a model ERM program, discuss how compaies ca maage through the ukow, idetify the eed for a crisis maagemet
template ad a Crisis Maagemet Pla for evets that caot be aticipated, alog with those that are low probability ad high severity that might ot be possible to mitigate. Role of ERM ad Crisis Maagemet Scope of ERM Eterprise-wide Risk Maagemet ecompasses all of the risks that a compay faces icludig, i o particular order; Fiacial markets disruptio Credit Iterest rate Capital Huma Resources (HR) Trasactioal Data protectio ad privacy Legal Eforcemet actios by Federal or state crimial authorities FCPA Govermetal ivestigatios Regulatory ad compliace requiremets Cyber attacks Iformatio Techology (IT) Busiess Cotiuity ad Disaster Plaig Operatioal Supply chai Fiacial disclosure Documet retetio policies ad practices ad disclosure (obstructio of justice or civil cotempt) Executive miscoduct or egligece (Persoal ad/or Professioal) Brad Reputatioal Vedors Busiess parters Third party service providers Customers Evirometal Ethical ad Cultural Imperatives for Effective ERM There are may reasos why compaies should have a effective ERM Program ad compliace program. Provisios of the Sarbaes-Oxley Act of 2002 (the "Sarbaes-Oxley Act") ad disclosure requiremets regardig risk factors Federal setecig guidelies NYSE corporate goverace guidelies for its listed compaies require such compaies' Audit Committees to "discuss policies with respect to risk assessmet ad risk maagemet." 3
Credit ratig agecies' icorporatio of ERM D&O Liability ad litigatio (See e.g., Caremark, Stoe Ritter, Disey, etc.) Accoutig ad audit review stadards for iteral cotrols certificatios. (See, for example, Sarbaes-Oxley Sectio 404 which madates that all publicly-traded compaies must establish iteral cotrols ad procedures for fiacial reportig ad must documet, test ad maitai those cotrols ad procedures to esure their effectiveess Sectio 404 also requires U.S. publicly-traded compaies to use a cotrol framework i their iteral cotrol assessmets. Likewise, Public Compay Accoutig Oversight Board ("PCAOB") Auditig Stadard No. 5 emphasizes the importace of top-dow risk assessmet ad specifically requires covered compaies to perform a fraud risk assessmet.) 4 Provisios of Dodd-Frak Sigificatly, Sectios 165(b)(1) ad 165(h) of the Dodd-Frak Wall Street Reform ad Cosumer Protectio Act ("Dodd-Frak") to be implemeted by recetly proposed regulatios, require certai fiacial istitutios to, amog other thigs, (1) create a separate Risk Maagemet Committee at the Board level with specified resposibilities a (2) appoit a Chief Risk Officer with specified duties, powers ad reportig lies. O December 21, 2011, the Federal Reserve Board published for commet "Proposed Ehaced Prudetial Stadards ad Early Remediatio Requiremets for Covered Compaies." 5 The commet period origially eded March 31, 2012, but was exteded to April 30, 2012. The Fed is ow reviewig the commets received before issuig a fial rule. ERM is also a essetial busiess maagemet tool to: assess ad aalyze busiess ad activities o a risk-adjusted basis, i.e., higher risk busiesses should have higher rate of retur to justify ad pay for risk mitigatio efforts ad potetial liability egage i soud strategic plaig ad fiacial maagemet which requires that all risks of every lie of busiess ad activity be assessed ad balaced agaist profitability, ad recogize ad prepare for the iterdepedecy of evets. It is part of a soud busiess practice part of a proactive, prevetative compliace culture that seeks to: miimize or prevet risks mitigate loss from failure to prevet or mitigate risk, ad mitigate litigatio. The implemetatio of a proactive, prevetative approach to risk maagemet ad compliace at both the Board ad maagemet level is critical. It seds a clear message to the officers ad employees of the compay, ad to the public, that these issues are ot oly legal requiremets, but also ethical ad cultural imperatives, ad represet soud busiess practices which should be part of a compay's culture. I additio, the ature ad itesity of regulatory ad eforcemet resposes to problems has icreased sigificatly, ad, as discussed above, all idicatios are that this will cotiue. Give the foregoig, a proactive, prevetative approach to risk maagemet will help to miimize problems ad, where problems do occur, miimize the litigatio, regulatory, eforcemet, reputatioal ad fiacial cosequeces. Historically, a evet could lead to SEC, crimial ad civil actios. I this ew era, regulatory eforcemet actios, Cogressioal ivestigatios, Cogressioal hearigs, actios ad prosecutios by State Attoreys Geeral, public vilificatio, political ad govermetal reactio, ad shareholder ad popular backlash are all foreseeable cosequeces of iadequate or ieffective ERM Programs. It is imperative that maagemet ad Boards of Directors assume a leadig role i esurig that all risks facig a compay are idetified ad assessed, ad that a risk maagemet ad compliace system is i place to facilitate the proactive idetificatio, assessmet, maagemet ad mitigatio of those risks. The Board must make sure that it is fully apprised of risks faced by the compay, ad that it ca make a idepedet determiatio that maagemet has implemeted ad maitaied effective eterprise-wide itegrated risk maagemet policies ad procedures, icludig iteral cotrols ad compliace. Amog other thigs, the Board should cosider whether the compay's risk maagemet ad compliace system icorporates each of the followig actio items. Actio Items
Udertake a Risk Idetificatio ad Assessmet Program A eterprise-wide risk idetificatio ad assessmet program should be udertake. I may circumstaces, it may be appropriate that the assessmet be udertake by a idepedet third party ad that it be updated periodically. This risk assessmet is critical to establishig a appropriate risk maagemet process, as outlied below. Oce a risk assessmet has bee completed, a eterprise-wide risk maagemet process should be implemeted. Obviously, o process is appropriate for all compaies ad each process must be modified ad customized as required to reflect a compay's busiess eeds, operatig realities ad the ature of its regulatory eviromet. The goal of this process should be to have a holistic approach to risk prioritizatio, risk tolerace level ad mitigatio approach. Establish a ERM Committee A eterprise-wide risk maagemet committee ("ERM Committee") should be established, composed of seior executives from all o-lie areas (e.g., IT, fiace, audit, legal, compliace, huma resources, public/ivestor relatios), ad primary busiess lie areas (e.g., heads of maufacturig, operatios, geographic heads or busiess lies, depedig o how the compay is orgaized). This approach recogizes ad accouts for the iterdepedecy of products, geographies ad busiess lies. The ERM Committee should assure that all risks faced by the compay are idetified, aalyzed ad prioritized, ad that iteral cotrols ad procedures are i place to maage ad mitigate those risks based o frequecy ad severity. The ERM Committee should report directly to the audit committee of the Board or a special risk committee of the Board. The chairma of the ERM Committee should be the Chief Risk Officer ad the CEO should be a member. Risks should be assessed o a ogoig basis, ad should iclude ot oly busiess ad fiacial risks, but all risks the compay faces, icludig legal, regulatory, compliace, govermetal, operatioal, treasury, shareholder (activist), uios, commuities i which the busiess operates, vedor, customer, product, political, evirometal, iteratioal, supply, reputatioal, huma resources, techology, isurace ad audit. Mothly meetigs should be scheduled ad ru similar to the way i which meetigs of the Board of Directors are scheduled ad ru. At iitial meetigs, each member of the committee (or seior officers from the area) should make a formal presetatio assessig ad idetifyig risk i the particular area for which he is resposible, ad explaiig what processes ad cotrols are i place withi that area to mitigate ad maage risks idetified. This idetificatio ad assessmet process should be based upo a "bottom-up" iformatioal gatherig, review ad assessmet ad mitigatio recommedatios. Recommedatios regardig prioritizatio ad tolerace should be made as well. The Executives i the Divisios should egage i a Sarbaes-Oxley-like fiacial reportig certificatio process to assure that they ad their divisios take this process seriously. This decetralized bottom-up approach is desiged to esure that the process appropriately reflects, recogizes ad assesses risks as idetified at the operatig levels ad puts accoutability at these levels of the eterprise. However, by makig this presetatio to the cetralized risk maagemet committee, the members ca offer a assessmet of how the risk i a particular area iterrelates with risk i the various other lie ad o-lie areas of the compay. Oce the iitial meetigs have idetified, assessed ad discussed cotrols i place to maage ad mitigate risk, a risk prioritizatio should be udertake to determie the frequecy of subsequet presetatios. Most importatly, this should iclude stress testig ad operatioal war games to determie risks ad mitigatio i extreme fiacial, operatioal, IT, vedor, customer, ad supply chai circumstaces. A ogoig eterprise-wide risk assessmet should be prepared based o the presetatios so that a holistic, eterprise-wide approach to prioritizatio, tolerace ad mitigatio ca be adopted. The risk prioritizatio eables the risk maagemet committee to determie the frequecy ad scope of presetatios by each of the lie ad o-lie uits similar to the way i which a auditor udertakes a risk prioritizatio to determie the frequecy ad scope of audits withi a compay. This assessmet should reflect a "heat-mappig" of probability or likelihood ad severity. The obvious example is BP i the Gulf-a low probability evet but with very high severity if it happes. O a scheduled goig-forward basis, formal presetatios by each divisio of the compay to the ERM Committee should describe ad aalyze: All risk their areas face; What cotrols have bee or will be put i place to miimize these risks; Where loss has occurred or might occur;
What is the probability ad severity; What moitorig is beig doe; What stress testig has bee doe; ad How to assure proper accoutig ad reportig of fiacial data disclosure policies ad procedures. The ERM Committee should review ew products, geographic expasio or busiess iitiatives. I additio to regularly scheduled presetatios, ogoig meetigs should require each lie ad o-lie executive to discuss ay ew products, activities or sigificat ew relatioships, or geographic expasios ad assess the risk associated with them for group discussio ad icorporatio ito the ogoig risk assessmet, maagemet ad mitigatio program ad as part of a process of calculatig risk-adjusted profitability. I order to assure the oversight ad accoutability of the ERM process, there should be a risk self-assessmet process by each divisio ad a periodic audit or review by the risk maagemet divisio or by audit to idepedetly review the risk idetificatio, assessmet ad mitigatio results of each divisio. The results of this process should be evaluated as part of employee performace evaluatios. Implemet a ERM Committee Board Reportig Process The Board or a Committee of the Board should receive regular writte ad oral reports from the ERM Committee ad the Chief Risk Officer so that it ca idepedetly assess the approach of maagemet through the ERM Committee i idetifyig, assessig, prioritizig ad mitigatig risk. However, there are several Board models for ERM Reportig ad Oversight at the Board level: Audit Committee Audit ad aother Committee Busiess/Fiace Committee Risk Committee Full Board Establish a Crisis Maagemet Pla Crisis Maagemet is what to do whe a risk materializes - whether idetified or ot. A crisis maagemet pla is essetial to miimize loss ad litigatio ad,give the curret eviromet, must be multidiscipliary ad address: public relatios ad commuicatios Board ivolvemet ad role political regulatory eforcemet reputatioal legal strategy for simultaeous actios: SEC Departmet of Justice (DOJ) civil shareholder suits iteral ivestigatios cogressioal ivestigatios regulatory ivestigatios State attorey geeral actios maagemet's role
employees (How do you keep them goig? Tired, demoralized, ucertai, scared, agry) customers vedors suppliers reputatio ad brad A crisis maagemet pla properly developed ad implemeted will reduce the risk of litigatio ad the losses ad reputatioal risk if litigatio occurs. A crisis is like a iceberg you ca really oly see the little part stickig out of the water but it is the mass of ice udereath that ca do the most damage. Whe maagemet ad Boards thik about a crisis that might result i a ivestigatio or litigatio, it is critical to be prepared to get o top of the issue quickly. I this eviromet, a headlie-grabbig crisis the tip of the iceberg results i simultaeous or rapid sequetial civil litigatio, govermetal ivestigatios by the SEC, DOJ, primary regulatory agecy, cogressioal ivestigatios, cogressioal hearigs, political reactio or itervetio ad actios by state Attorey Geerals. The strategies for each are differet ad require a itegrated, coordiated, holistic respose. The key is to get the facts quickly most ofte a idepedet ivestigatio is ecessary to get the facts. I additio to legal issues, these evets geerate customer, vedor, supplier, local commuity, reputatioal, ad employee reactio. Misiformatio or bad iformatio ca ofte times create more problems tha the uderlyig acts. A immediate factual ivestigatio is imperative. Iformatio disclosure - advertet ad iadvertet. The impact of these ivestigatios ad the facts for the compay ad the employees ca be paralyzig ad distractig. The political ad public relatios issues are overwhelmig. But there is customer, cosumer, producer, shareholder ad public reactio as well. Compaies must proactively moitor social media ad blogs to gather itelligece o what is happeig ad what messagig is goig o, icludig allegatios or facts that may impact the ivestigative process. The failure of Boards ad compaies to respod quickly ad appropriately ca result i creditors, suppliers ad customers all actig irratioally. This, i tur ca quickly sed a compay ito a death spiral. What are the quick step actios for Boards that all crisis plas should iclude? A predetermied list of advisors who kow the compay, ad immediate fact-fidig a careful, truthful, deliberate respose is ecessary o matter how paiful. The Board should decide ahead of time what its role will be how ivolved it will be. I this eviromet, ad this is ot a widely-held view, a Board, or a committee, must be itimately ad actively ivolved with maagemet. Commuicatios ad iformatio flow to the Board is critical. There should be o surprises. What should the level of ivolvemet be - what, how much ad how: Chair/Lead Director/Audit Committee Chair/ Special Committee Chair Updates, Special meetigs Iformatio flow Key decisios, alteratives, implicatios Adopt a Commuicatio Pla A commuicatios pla to all stakeholders ad costituecies icludig employees, vedors, customers, suppliers, regulators is critical. Agai, there must be cofirmed, fact-based, ope ad hoest commuicatio. Immediate actio ad govermet cooperatio is critical i mitigatig puishmet uder the Setecig Guidelies. It is critical to get the facts:
must be cofirmed ad irrefutable to maitai credibility ad trust as soo as possible. o premature or false or misleadig statemets. What Are the Loomig Risks That Seem to be o the Up-ad-Comig That Will Threate Compaies ad Quickly Chage Board Agedas? Whistleblowers creatig trasparecy ad the impact of these evets o reputatio; Cyber attacks; Evirometal evets; Idustrial espioage, labor evets strikes, stoppages; Govermet eforcemet actio; Actios of busiess parters or third party service providers; Shareholder activism; Fiacial markets disruptio; Political urest; Cloud computig. But i a recessioary ecoomic eviromet, problems are also created or exacerbated, for example, by public reactio, witess the Occupy Wall Street movemet or ear riots i Lodo. But the biggest worry is that a compay caot aticipate all the high severity/low probability evets. It is critical to have a crisis maagemet process that eables a compay to react to a evet that it caot predict, prevet or where the probability of occurrece is so low that the compay caot direct sufficiet resources to seek to mitigate. Advice to Maagemet ad Board's of Directors o Mitigatig Risks ad Reducig Litigatio Exposure First Prevetio, Prevetio, Prevetio. May crises could be preveted or mitigated by a effective toe at the top, ad by ethics ad compliace programs that detect a crisis before it materializes. May crises are the result of log-stadig busiess behavior that has bee tolerated or ratioalized by maagemet. A effective ERM Program is a critical compoet of prevetio by idetifyig, assessig ad implemetig risk mitigatio efforts some evets ca be preveted ad others mitigated. Secod Carefully establish effective ERM systems that: ca idetify ad assess risks ad put risk mitigatio programs i place, icludig busiess cotiuity plas, ad that esure there is a adequate level of stress testig; ad provide risk-adjusted aalysis of a compay's existig ad proposed busiess lies, products, activities ad geographic operatios. Third Be prepared for what you caot aticipate, have a crisis maagemet process i place. I the U.S., uder the COSO framework the Board has the ultimate resposibility for risk maagemet. Part of risk maagemet is crisis maagemet ad part of crisis maagemet is busiess cotiuity plaig. The Role of I-House Cousel Executive Maagemet ERM Process
Persuade Executive Maagemet ad the Board of Directors to create a holistic, empowered substative Eterprise Risk Maagemet process at the executive maagemet level as described i this article reportig directly to the Board of Directors to mitigate liability ad risk exposure, ad Aalyze best practices ad advise ad cousel executive maagemet how ERM should be structured ad the busiess beefits of risk idetificatio ad assessmet of busiess expasio ad activities so that they ca be assessed for profitability o a risk adjusted basis. Legal Risk ad the ERM Process As part of the executive maagemet ERM process, i-house cousel should idetify assess, prioritize ad take steps to prevet or mitigate legal risk ad liability. Board of Directors ERM Process Aalyze ad advise the Board of Directors with respect to its roles of oversight ad resposibility for ERM. Advise the Board of Directors as to a corporate goverace structure at the Board level to oversee ad assess the executive maagemet ERM process ad the establishmet of appropriate idepedet reportig lies from the chief risk officer ad executive maagemet ERM committee to the Board or a Board Committee. * * * I the curret eviromet of polarizatio, crimializatio, ad the rapid pace at which cosequeces mout, there are a umber of legal ad busiess reasos that make it critical to have a effective ERM Program ad Crisis Maagemet Pla i place i order to miimize liability ad loss. Likewise, i a eviromet where the SEC, DOJ, state attorey geerals, a compay's primary regulator, Cogress, the Admiistratio ad the press may all be ivolved, the eed for a multi-discipliary maagemet pla ad team is essetial. 1 See Ehaced Prudetial Stadards ad Early Remediatio Requiremets for Covered Compaies, 77 FR 594 (Ja. 5, 2012). 2 Scaell ad Braithwaite, SEC's risk moitors hoe i o Boards, Fiacial Times, April 2, 2012. 3 NYSE Listig Stadards Part 7d 4 Auditig Stadard No. 5 5 See Ehaced Prudetial Stadards ad Early Remediatio Requiremets for Covered Compaies, 77 FR 594 (Ja. 5, 2012).