Boardexpert

I am speaking tomorrow to directors and officers about oversight of risk management by boards of directors. I prepared a list of 25 reasons that risk management failure happens, based on my experience assisting boards, including boards that have failed and boards that cannot afford to fail. Almost all of what follows below is based on real examples. I have never encountered a risk management failure where the board was not at fault, based on what the board said or did, or failed to say or do.

Here are 25 reasons for risk management failure:

1. Lack of enterprise risk management expertise on the board.
2. Governance gaps over a material risk(s) within the board or across committees.
3. Directors incapable of identifying and fully understanding the risks, or worse yet, don’t want to understand. Committees show no interest when they should be shocked.
4. Internal oversight functions reporting to management instead of the board. A complacent board does not correct.
5. Directors do not insist on a real-time line of sight over material risks and their mitigation/treatment.
6. Not upgrading information systems to track, monitor, integrate risks.
7. Lack of oversight of the process by which management identifies, assesses and actions the risks.
8. Lack of conversations, common vocabulary and prioritization of the risks.
9. Lack of internal audit, or not listening to internal audit.
10. Internal controls that are weak, even non-existent, or capable of management override.
11. Not addressing interaction of risks, their speed, and exogenous shocks in modeling and scenario planning.
12. Not considering impact on reputation, which can be greater than the primary impact considered.
13. Immature controls over non-financial material risks, especially safety, operations, reputation, terrorism, bribery, technology.
14. Risk appetite frameworks do not result in known thresholds, beyond which senior management and when necessary the board is notified.
15. Lack of independent, coordinated assurance of internal controls provided directly to the board.
16. Risk culture defective (toxicity, bullying, risk-taking behaviors) and not remedied.
17. Whistle-blowing defective (not anonymous, no independent channel, no proper investigation).
18. Risk not based on the strategy, business model and key performance indicators.
19. Key performance indicators, and pay incentives and vesting of equity, not risk-adjusted.
20. Board or committee cannot direct a third party review of risk governance, a specific risk, or a set of controls.
21. Failure to anticipate and integrate risks. Pockets of acute, unknown catastrophic risk. (This item equals 13 + 6.)
22. Enterprise risk management not really implemented but everyone thinks it is. False sense of reality.
23. Tone at the top tolerates exceptions, complacency, and unequal treatment. Limited downside for excessive or imprudent risk taking. Encouragement, enabling or dependence upon high performing risk-takers.
24. No sense of urgency to remedy the foregoing.
25. The board does not know how bad it is.

The author thanks an anonymous senior risk executive for review of the foregoing items.

In a board meeting, the military general asked the airline’s CEO, “Why is the pilot’s food being labeled?” “Because that’s the way we always do it,” the CEO responded. “Well then stop doing it,” the military director said. “If I’m a terrorist, I might have trouble getting through the cockpit door, but you’re putting a red flag for me on how to poison the pilot and take down the plane.”

In that exchange, the new military director on the airline’s board of directors I was advising proved his value.

I am currently advising another board whose company is a target for a terrorist attack. Many other companies in transportation, utilities, defense, property development and financial services could take a page from below.

Here are six areas for boards to focus on to prepare for a possible terrorist attack.

1. Military experience on the Board. Military leaders have logistics, supply chain, tactical and international theatre experience civilian directors lack. Their contacts include the intelligence community. They think differently and understand evil.

2. Intelligence gathering. Boards should commission multi-lingual analytics from terrorist websites and chat-rooms, where the company, industry or executive is mentioned. There should be governmental relations on the board’s competency matrix. Boards want to know about unknown unknowns, or emerging risks that can be catastrophic (the black swan), or interdependent risks that rapidly interact. Risk registers don’t capture this dynamism yet. Proper intelligence gives boards and management teams a heads up.

3. Scenario planning. Good boards in sensitive industries are insisting on disaster recovery, catastrophic event planning, mock dry runs, and schedules so if or when it happens, the company is ready. There is even off-site functioning if the office is blown up.

4. CEO compensation. In a disaster that happened involving property destruction and death (another board), I was called in to recut the CEO’s compensation. It went from financial short-term to include risk, relations, internal controls, and crisis management metrics. The compensation committee has enormous often unused control over behaviours and you reward what you pay for.

5. Communication. The CEO should have media training to prepare for scenarios, and respond to journalist questions. When the event happens, it is too late if you don’t have this. Opinion crystallizes in days if not hours. The CEO profile for succession planning should include communication, intelligence gathering, and political linkages.

6. Invest in enterprise risk management (ERM) and information technology (IT). Risk management is often immature, cyber threats are significant, and good ERM is bottom up to include focus groups and integrated real-time IT. There are vulnerabilities that are missed without good ERM. Without being explicit, there are vulnerabilities at universities, cities, shopping malls and events that will surface in good ERM.

The bombers in Boston capitalized on police that were not there, inadequate crowd control at the finish line, and unattended unchecked bags. New York is much better at this now. Cameras, K-9 dogs, screening, monitoring, crowd control and escorts are all about choices. Management can choose not to do something. Boards can DIRECT that they do. This deters potential targets.

I interviewed an independent director of Canadian food retailer Loblaws about risk and he told me the most important risk for Loblaws that could cause a ‘run on the bank’ (his words) was food safety. Food safety was front and center in his mind, and each of the other independent directors and management. It seems the management of XL Foods Inc., which is owned by Nilsson Brothers Inc., has not figured this out. “Governance” does not even appear on their sparse website. Safety does, in a general way, here. Neither company appears to have any independent directors.

Contrast this with the other major beef processor in Canada, Cargill Ltd., which is owned by Cargill, Inc. in the U.S. See Cargill’s commitment to food safety here; their “ethics open line” here; their core competencies that include supply chain and risk management here; and that their board has six independent directors and five managers, according to Wikipedia. (Their 2008 accountability report stated a third of the board were independent directors.) Cargill claims to be the largest private company in the U.S. in terms of revenue. Although private companies like Nilsson Brothers and Cargill are not required to have independent directors, forward-thinking ones do. See McCain Foods here. Independent directors bring objectivity and an external perspective into the boardroom. They are honest brokers to keep an eye on management. A good independent board will not prevent a disaster but almost always will lessen its likelihood.

According to the Mayo Clinic, the most common way to acquire an E. coli infection is by eating contaminated food such as ground beef: “When cattle are slaughtered and processed, E. coli bacteria in their intestines can get on the meat. Ground beef combines meat from many different animals, increasing the risk of contamination.”

The way you mitigate food safety risk is through internal controls, including segregation of duties, restricted areas, approval, records and reconciliations – and a culture of food safety and not cutting corners. Management is inherently conflicted in assuring such controls, and internal controls cost money. This is the reason for government inspectors and, most importantly, a competent and independent board of directors to approve the control regime to begin with.

I am heading to Calgary next week to give speeches to the directors of Livestock Identification Services Ltd., as well as directors of a few additional beef industry groups and one being a newly formed national beef agency called Canada Beef Inc., on internal controls and risk. I have given speeches to farmers in the U.S. and am going again to Colorado in November to talk to CEOs and director-farmers on the latest trends in corporate governance, risk management and internal controls. Good agri-businesses take governance very seriously.

Risk management and internal controls are not profit producing activities per se. No one likes to be controlled, least of which entrepreneurial employees. However, ask yourself if defective internal controls are worth the price, reputationally and financially? Do you think XL Foods has taken a financial and reputational hit because of the tainted beef? What about the farmers coping with a price decline? What about Maple Leaf Foods? Most importantly, what about the health and safety of customers? It can indeed be a run on the bank if consumers don’t have confidence, and it can get worse unless governance checks are put in place.

See the long list of beef recalled here from the Canadian Food Inspection Agency, and the update from the USDA Food Safety and Inspection Service, here. Recall that the American inspectors detected the tainted beef before Canadian inspectors did. Rather than prioritizing the federal agency to re-open XL Foods, the premier of Alberta, Alison Redford, should insist that food safety for all Canadians (and consumers in America and other countries too) is number one. Then, and only then, should XL Foods be re-opened. Tainted beef from Alberta seems to be a pattern. And the Prime Minister should reform the governance of the Canadian Food Inspection Agency to require independent directors and an independent chair (it appears not to have either on its website here and here) like many other federal or provincial agencies. Maybe it’s also time that some private companies that affect a broad swath of the population should have a requirement for independent directors too.

 

In a scathing report by the National Transportation Safety Board (“NTSB”), Canadian company Enbridge Inc. was rebuked for its pipeline rupture on July 25, 2010, and subsequent environmental damage. The pipeline ruptured due to corrosion fatigue cracks that grew and coalesced from multiple stress cracks.

The oil flow continued for 17 hours, according to the report. The oil saturated the wetlands in Michigan. Clean up continues with costs exceeding $767 million. The total release was estimated to be 843,444 gallons.

Enbridge CEO, Patrick Daniel, said on the news on that evening that Enbridge complied with all regulations.

If this is the case, then the regulations were defective or not enforced. They were, and the NTSB is addressing this.

Some of the highlights of the NTSB’s report, so far as Enbridge is concerned, include:

–       Enbridge’s integrity management program was inadequate.

–       Enbridge failed to train staff and failed to ensure staff had adequate knowledge, skills and abilities to address pipeline leaks.

–       Enbridge’s staff placed inadequate reliance on indications of a leak, including zero pressure.

–       Enbridge had a culture that accepted not adhering to procedures, including requiring a pipeline shutdown after 10 minutes of uncertain operational status. [This is perhaps the most damning conclusion from the report.]

–       Enbridge’s review of its public awareness program was ineffective.

–       Enbridge’s emergency response demonstrated a lack of training in the use of effective containment methods.

–       Enbridge’s facility response plan did not identify and ensure resources were available to the pipeline release in this accident.

–       Enbridge’s failure in respect of the above items were organizational failures that resulted in the accident and increased its severity.

What can we learn from Enbridge, from a governance, research and risk perspective?

–       The Board Chair, Mr. David Arledge, has served on the Enbridge board for 10 years.

–       The Chair of the Corporate Social Responsibility Committee, whose mandate includes oversight of Enbridge’s risk management guidelines applicable to the environment and health and safety, Mr. James Blanchard, has served on the Enbridge board for 12 years.

–       Mr. George Petty, also a member of the CSR committee, has served on the Enbridge board for 11 years.

–       Other countries are moving towards tenure limits for directors of 9 years, because of the effect that prolonged tenure could have on director independence.

–       Mr. Dan Tutcher, also a member of the CSR committee, was formerly an employee of a subsidiary of Enbridge.

–       The final CSR committee member, Ms. Maureen Kempston Darkes, has served on the Enbridge board for almost 2 years.

–       A majority of CSR committee members (three of four members) would be regarded as “busy” directors (generally 3 or more boards).

–       Enbridge would be regarded as a “busy” board, with a majority of directors (11 of 13 directors) holding multiple board seats (generally 3 or more), including the CEO, Patrick Daniels.

–       Enbridge’s CEO, Patrick Daniels, appears to be serving on seven other private and public boards. More than half of S&P 500 companies limit outside directorships for their CEO, a policy not widely in effect a few years ago, according to Stanford researchers.

–       Companies with busy boards tend to have worst long-term performance and oversight, according to the research.

–       Enbridge is a large board (13 directors). Larger boards tend to provide worst oversight (when company size is held constant), according to the research.

–       For the Enbridge directors serving on the CSR committee who have not worked at Enbridge, environment and health and safety (or related competencies such as sustainability) are not listed as areas of expertise within their website bios, or in in regards to committee membership, it would appear. Other natural resource companies and boards in Canada are addressing director competencies specifically. For example, “Sustainable Business Practices” and “Corporate Social Responsibility” are forming main areas of expertise or are on a skills and experience matrix.

Good boards, after the BP spill, pressed management to demonstrate how BP could not happen to them, and correct any deficiencies whatsoever, such as several of the above-mentioned items as applicable (training, resources, fatigue of equipment, crisis response, etc). Good boards insist on stress testing, crisis planning, and a comprehensive and robust risk management system. And, most importantly, there is no tolerance whatsoever for deviating from a culture of integrity, health and safety.

I taught a case last week to my corporate governance class based on Hydro One’s Enterprise Risk Management program. The role of the board and CEO is critical – if not essential – to risk culture and effectiveness. Hydro One specifically mentioned in a video I showed to my students how the company factors in transmission line aging and fatigue within a comprehensive risk management system. Workshops and stress testing occurs, within a comprehensive reporting and assurance system, right up to the board of directors.