Dr Richard Leblanc

I am speaking tomorrow to directors and officers about oversight of risk management by boards of directors. I prepared a list of 25 reasons that risk management failure happens, based on my experience assisting boards, including boards that have failed and boards that cannot afford to fail. Almost all of what follows below is based on real examples. I have never encountered a risk management failure where the board was not at fault, based on what the board said or did, or failed to say or do.

Here are 25 reasons for risk management failure:

1. Lack of enterprise risk management expertise on the board.
2. Governance gaps over a material risk(s) within the board or across committees.
3. Directors incapable of identifying and fully understanding the risks, or worse yet, don’t want to understand. Committees show no interest when they should be shocked.
4. Internal oversight functions reporting to management instead of the board. A complacent board does not correct.
5. Directors do not insist on a real-time line of sight over material risks and their mitigation/treatment.
6. Not upgrading information systems to track, monitor, integrate risks.
7. Lack of oversight of the process by which management identifies, assesses and actions the risks.
8. Lack of conversations, common vocabulary and prioritization of the risks.
9. Lack of internal audit, or not listening to internal audit.
10. Internal controls that are weak, even non-existent, or capable of management override.
11. Not addressing interaction of risks, their speed, and exogenous shocks in modeling and scenario planning.
12. Not considering impact on reputation, which can be greater than the primary impact considered.
13. Immature controls over non-financial material risks, especially safety, operations, reputation, terrorism, bribery, technology.
14. Risk appetite frameworks do not result in known thresholds, beyond which senior management and when necessary the board is notified.
15. Lack of independent, coordinated assurance of internal controls provided directly to the board.
16. Risk culture defective (toxicity, bullying, risk-taking behaviors) and not remedied.
17. Whistle-blowing defective (not anonymous, no independent channel, no proper investigation).
18. Risk not based on the strategy, business model and key performance indicators.
19. Key performance indicators, and pay incentives and vesting of equity, not risk-adjusted.
20. Board or committee cannot direct a third party review of risk governance, a specific risk, or a set of controls.
21. Failure to anticipate and integrate risks. Pockets of acute, unknown catastrophic risk. (This item equals 13 + 6.)
22. Enterprise risk management not really implemented but everyone thinks it is. False sense of reality.
23. Tone at the top tolerates exceptions, complacency, and unequal treatment. Limited downside for excessive or imprudent risk taking. Encouragement, enabling or dependence upon high performing risk-takers.
24. No sense of urgency to remedy the foregoing.
25. The board does not know how bad it is.

The author thanks an anonymous senior risk executive for review of the foregoing items.

In a board meeting, the military general asked the airline’s CEO, “Why is the pilot’s food being labeled?” “Because that’s the way we always do it,” the CEO responded. “Well then stop doing it,” the military director said. “If I’m a terrorist, I might have trouble getting through the cockpit door, but you’re putting a red flag for me on how to poison the pilot and take down the plane.”

In that exchange, the new military director on the airline’s board of directors I was advising proved his value.

I am currently advising another board whose company is a target for a terrorist attack. Many other companies in transportation, utilities, defense, property development and financial services could take a page from below.

Here are six areas for boards to focus on to prepare for a possible terrorist attack.

1. Military experience on the Board. Military leaders have logistics, supply chain, tactical and international theatre experience civilian directors lack. Their contacts include the intelligence community. They think differently and understand evil.

2. Intelligence gathering. Boards should commission multi-lingual analytics from terrorist websites and chat-rooms, where the company, industry or executive is mentioned. There should be governmental relations on the board’s competency matrix. Boards want to know about unknown unknowns, or emerging risks that can be catastrophic (the black swan), or interdependent risks that rapidly interact. Risk registers don’t capture this dynamism yet. Proper intelligence gives boards and management teams a heads up.

3. Scenario planning. Good boards in sensitive industries are insisting on disaster recovery, catastrophic event planning, mock dry runs, and schedules so if or when it happens, the company is ready. There is even off-site functioning if the office is blown up.

4. CEO compensation. In a disaster that happened involving property destruction and death (another board), I was called in to recut the CEO’s compensation. It went from financial short-term to include risk, relations, internal controls, and crisis management metrics. The compensation committee has enormous often unused control over behaviours and you reward what you pay for.

5. Communication. The CEO should have media training to prepare for scenarios, and respond to journalist questions. When the event happens, it is too late if you don’t have this. Opinion crystallizes in days if not hours. The CEO profile for succession planning should include communication, intelligence gathering, and political linkages.

6. Invest in enterprise risk management (ERM) and information technology (IT). Risk management is often immature, cyber threats are significant, and good ERM is bottom up to include focus groups and integrated real-time IT. There are vulnerabilities that are missed without good ERM. Without being explicit, there are vulnerabilities at universities, cities, shopping malls and events that will surface in good ERM.

The bombers in Boston capitalized on police that were not there, inadequate crowd control at the finish line, and unattended unchecked bags. New York is much better at this now. Cameras, K-9 dogs, screening, monitoring, crowd control and escorts are all about choices. Management can choose not to do something. Boards can DIRECT that they do. This deters potential targets.

I interviewed an independent director of Canadian food retailer Loblaws about risk and he told me the most important risk for Loblaws that could cause a ‘run on the bank’ (his words) was food safety. Food safety was front and center in his mind, and each of the other independent directors and management. It seems the management of XL Foods Inc., which is owned by Nilsson Brothers Inc., has not figured this out. “Governance” does not even appear on their sparse website. Safety does, in a general way, here. Neither company appears to have any independent directors.

Contrast this with the other major beef processor in Canada, Cargill Ltd., which is owned by Cargill, Inc. in the U.S. See Cargill’s commitment to food safety here; their “ethics open line” here; their core competencies that include supply chain and risk management here; and that their board has six independent directors and five managers, according to Wikipedia. (Their 2008 accountability report stated a third of the board were independent directors.) Cargill claims to be the largest private company in the U.S. in terms of revenue. Although private companies like Nilsson Brothers and Cargill are not required to have independent directors, forward-thinking ones do. See McCain Foods here. Independent directors bring objectivity and an external perspective into the boardroom. They are honest brokers to keep an eye on management. A good independent board will not prevent a disaster but almost always will lessen its likelihood.

According to the Mayo Clinic, the most common way to acquire an E. coli infection is by eating contaminated food such as ground beef: “When cattle are slaughtered and processed, E. coli bacteria in their intestines can get on the meat. Ground beef combines meat from many different animals, increasing the risk of contamination.”

The way you mitigate food safety risk is through internal controls, including segregation of duties, restricted areas, approval, records and reconciliations – and a culture of food safety and not cutting corners. Management is inherently conflicted in assuring such controls, and internal controls cost money. This is the reason for government inspectors and, most importantly, a competent and independent board of directors to approve the control regime to begin with.

I am heading to Calgary next week to give speeches to the directors of Livestock Identification Services Ltd., as well as directors of a few additional beef industry groups and one being a newly formed national beef agency called Canada Beef Inc., on internal controls and risk. I have given speeches to farmers in the U.S. and am going again to Colorado in November to talk to CEOs and director-farmers on the latest trends in corporate governance, risk management and internal controls. Good agri-businesses take governance very seriously.

Risk management and internal controls are not profit producing activities per se. No one likes to be controlled, least of which entrepreneurial employees. However, ask yourself if defective internal controls are worth the price, reputationally and financially? Do you think XL Foods has taken a financial and reputational hit because of the tainted beef? What about the farmers coping with a price decline? What about Maple Leaf Foods? Most importantly, what about the health and safety of customers? It can indeed be a run on the bank if consumers don’t have confidence, and it can get worse unless governance checks are put in place.

See the long list of beef recalled here from the Canadian Food Inspection Agency, and the update from the USDA Food Safety and Inspection Service, here. Recall that the American inspectors detected the tainted beef before Canadian inspectors did. Rather than prioritizing the federal agency to re-open XL Foods, the premier of Alberta, Alison Redford, should insist that food safety for all Canadians (and consumers in America and other countries too) is number one. Then, and only then, should XL Foods be re-opened. Tainted beef from Alberta seems to be a pattern. And the Prime Minister should reform the governance of the Canadian Food Inspection Agency to require independent directors and an independent chair (it appears not to have either on its website here and here) like many other federal or provincial agencies. Maybe it’s also time that some private companies that affect a broad swath of the population should have a requirement for independent directors too.