Risk Governance and The Board Ian Canham and Andrew Cornish Tuesday 17 th June 2014

1. Risk Governance and The BoardIan Canham and Andrew CornishTuesday 17th June 2014

2. Roads to Ruin – The Project • 18 case studies (events) • 23 companies involved • 7 event categories • 14 industries All based on information already in the public domain

3. Consequences of the failures • 7 company collapses (3 subsequently rescued by Governments) • 11 departures of Chairman / CEO’s • 4 prison sentences • 16 fines, penalties and regulatory interventions • Incalculable damage to corporate reputations (and market capitalisation)

4. Seven key points of failure • Board experience, skill and lack of NED control • Board risk blindness • Inadequate leadership on ethos and culture • Defective internal communication • Organisational complexity • Risks from remuneration structures • Risk Glass Ceiling

5. Roads to Resilience Case study research into what does ‘good’ look like - Cranfield Business School 2013 • In depth case studies of; • AIG ODA • Drax Power TTP • IHG Virgin Atlantic • JLR Zurich Insurance • How do resilient organisations oversee and manage their risk management strategy? • What are the enablers, drivers and risk management practices in place? • How do they measure the results and impact of risk management activities? • What are their governance (and empowerment) controls and strategies? • What are the critical leadership and business structure issues?

6. Findings • Resilient companies have exceptional risk radar to detect changes in the external and internal situation • Resilient companies have diversified resources and assets to facilitate alternative approaches • Resilient companies build strong relationships and networks, both internally and externally • Resilient companies have the ability to respond rapidly and decisively to an emerging crisis • Resilient companies review and adapt based on experience and changing circumstances

7. Findings Enablers: • People and culture • Business structure • Strategy, tactics and operations • Leadership and governance

8. Risk Radar • Everyone is responsible • Constant vigilance • Complacency engineered out • Constant questioning and challenge • Communication critical

9. Resources and Assets • Actively managed dependencies • Active networks with ability to switch rapidly • Availability of crisis management expertise

10. Relationships and Network • Shared common purpose • No blame culture – (“fix the problem” culture) • Flatter structures • Engaged leaders

11. Rapid Response • Quick and appropriate action • Defined processes and teams • Ability to identify appropriate resources quickly • Rehearsing and practising

12. Review and Adapt • Active investigation through scenario planning • Learning is a core value • Near misses must be communicated • Active and transparent responses

13. Roads to Resilience

14. Respond, Recover, Review Roads to Resilience Risk Responsive Risk Compliant Roads to Ruin Prevent, Protect & Prepare

28. Final Observations from Roads to Resilience • Effective risk management is not just about compliance • Risk is at the heart of strategy and effective risk management should be an enabler and a potential differentiator • Growth in a flat market can only be achieved by taking risks – these must be calculated and transparent • Reputation is critical and reputation risk management should be prioritised • The tone is set at the top • The information required to take risk aware decisions is most likely to exist already inside the company