1. Risk Management in the Boardroom Presentation to Risk Management Congress 2004 Jolly St. Ermins Hotel London 8th July 2004 Prof. Jim Norton Senior Policy Adviser UK Institute of Directors www.profjimnorton.com

2. Setting the scene - risk is crucial to business. Directors’ Dilemmas. Does ‘Turnbull’ help or hinder? Zero based approaches to risk management? Some final thoughts. Issues to be covered

3. Setting the scene - risk is crucial to business Risk is an essential element of business. The crux of business success is how that risk is identified, managed and controlled

4. Segmenting “risk” - PEST Red tape, tax policy, excessive costs, national lack of competitiveness. Instability (e.g. in countries which represent sources of supply or demand). Regulatory compliance, combined code, importation of Sarbanes- Oxley. Fluctuations in demand (both up and down!); Exchange rate instability. Aggressive action by competitors (loss of margin). Failure to meet customer expectations. Staff dissatisfaction, union action, pension issues. Skill shortages, Poor perception as place to work. Health and safety regulation. Political Social Economic Necessary but not sufficient…. Technological Substitution (e.g. new types of product or service based on new technologies…). Insufficient investment in new, more efficient, processes. R&D targeting and efficiency.

5. More segments are needed… Operational Environmental Poor design or product development. Sales channel failure. Supply chain vulnerability. Running out of cash. Reliability of key processes and information. Fraud. Holistic security. EU chemicals Directive. Pollution controls. Pollution arbitrage. Emissions trading. Corporate social responsibility. Energy efficiency. …… We could add still more segments: legal, …

6. Setting the scene - risk is crucial to business. Directors’ Dilemmas. Does ‘Turnbull’ help or hinder? Zero based approaches to risk management? Some final thoughts. Issues to be covered

7. Directors’ Dilemmas Daring but careful The board must be simultaneously entrepreneurial and drive the business forward while keeping it under prudent control. Combine intimate knowledge with a hands-off approach The board is required to be sufficiently knowledgeable about the workings of a company, to be answerable for its actions, yet able to stand back from the day-to-day management of the company and retain an objective, long-term view. Act local, think global The board must be knowledgeable about “local” issues and yet be aware of potential or actual non-local, increasingly international, competitive and other influences. Source: IoD “Standards for the Board” 2001

8. Directors’ “Combined Code” duties.. Risk: Non-executive directors should satisfy themselves that the financial information is accurate and that financial controls and systems of risk management are robust and defensible. Source: Combined Code 2003

9. Setting the scene - risk is crucial to business. Directors’ Dilemmas. Does ‘Turnbull’ help or hinder? Zero based approaches to risk management? Some final thoughts. Issues to be covered

10. Turnbull Risk Matrices Source: Typical FTSE quoted company Risk issue Control exercised at Board level Report or control relied upon by Board ImpactProbability Risk Unauthorised borrowings or breach of loan covenants Approval of gearing strategy and borrowing Weekly report to Board Members on borrowings and cash balances H L L

11. Issues with “Turnbull” - a personal view l Works very well initially… l Can deteriorate simply into tweaking the existing, identified, risks on a quarterly basis. l Likely to miss entirely new risks. l Unlikely to pick up gradual changes that have an insidious effect on risk. Could deteriorate into simple box ticking giving the illusion of good process whilst being fundamentally flawed…

12. Setting the scene - risk is crucial to business. Directors’ Dilemmas. Does ‘Turnbull’ help or hinder? Zero based approaches to risk management? Some final thoughts. Issues to be covered

13. A proposal for a zero based approach… 1 l Bring together a risk assessment and control (RAC) team within the management staffed by direct reports to executive directors. l Have the team meet monthly to review developments and their impact on the various categories of risk. l For each meeting, commission an in-depth review of risk in a specific area. l Have that review carried out by a RAC team member whose normal responsibility does not cover that area… This process not only brings fresh eyes to old problems but builds cross-functional contacts and trust.

14. A proposal for a zero based approach… 2 l Over the course of a year all the key areas of the business will have been reviewed in some depth. l Have the RAC team report monthly, by exception, to the Board on key changes in the risk profile. l Ensure that a different RAC team member carries out a formal risk presentation to the Board each quarter proposing amendments to the ‘Turnbull’ matrices and facilitating a more wide-ranging discussion… This process also gives Non-Executive Board Members improved visibility of key managers below Board level….

15. Setting the scene - risk is crucial to business. Directors’ Dilemmas. Does ‘Turnbull’ help or hinder? Zero based approaches to risk management? Some final thoughts. Issues to be covered

16. Some final thoughts…. l The identification, management and control of risk is at the heart of all successful businesses. l Businesses cannot survive, let alone prosper, without taking risks… l Ensuring that proper risk assessment and control processes are in place and working is a key responsibility of the Board. l The ‘Turnbull’ requirements, whilst initially useful can deteriorate into box ticking unless regularly refreshed. l Some form of zero based approach to risk review is likely to be useful. l Risk management can be a catalyst for wider business benefits.

17. But remember, the assessment of risk is a continual battle. Don’t ever sit back and believe that you have won! Oh dear…!

18. Questions? Presentation can be downloaded from: http://www.profjimnorton.com/IIRRiskV1.ppt