Simplifying legal risk management, via punk

November 2015

You gotta learn to listen, listen to learn

You gotta learn to listen, before you get burned

The Ramones – Learn to Listen[1]

In my experience, two types of advice are available to those tasked to manage organisational and legal risk. Type 1 is the macho, thrusting type – for example, KPMG concluded in a recent report that to help “companies transform their culture to make it more compliant without being risk averse” General Counsels should “add a mastery of business to their portfolio”. ‘Master of business’ insufficiently aspirational for you? Perhaps the Forbes article The Clairvoyant Corporation: General Counsel as Supermen may be a little more to your taste? Type 2 falls at the drier, more practical end of the spectrum. It’s all about the documentary architecture of risk management – the endless registers, the ‘heat maps’ showing likelihood vs impact, the mitigation plans, and so on. Mmm, spreadsheets.

Uninspired? Well, before you rush off to business school (and/or instruct your tailor to rustle up a cape to go with your next suit), can I suggest you first read a long-published study which provides a much simpler perspective on risk management? It’s by Cass Business School, and it’s called Roads to Ruin.

The study investigates the origins and impact of over twenty major corporate crises. The study concludes that the companies affected most badly suffered from one or more of seven fundamental weaknesses. These include defective communication, limitations on board skill, risks arising from inappropriate incentives, poor leadership on ethos and culture and risk ‘glass ceilings’ (where risks originating from higher levels of an organisation’s hierarchy go unreported).

Of the case studies covered, the manifestation of one or more of these seven weaknesses was often lethal to the subject organisation’s business model – sometimes because the weakness(es) turned a manageable crisis into a public catastrophe. The losses which resulted were usually uninsurable. Cass notes that “Most of these risks are both beyond the reach of current risk analysis techniques and beyond the remit and expertise of typical risk managers”. In other words, plan all you want, complete your MBA with flying colours, but you still might miss the risks that are most likely to floor your employer.

For me, the weakness identified by Cass which most stands out is defective communication. All other weaknesses feature a lack of (or would be mitigated by greater transparency in) communication between the stakeholders in risk. Take, for example, risks arising from inappropriate incentives: at AIG and Enron, the bullying nature of the firms’ senior personnel disincentivised staff from speaking out about problems.

If Cass is right, then the start point for risk management is simple. Forget extrasensory perception and eighteen months of distinguishing between cows, dogs and stars at business school; the reality is that the facilitation of clear and effective communication is both the start point and the most critical element of organisational risk management. Good news – right?

Well, sort of. Transforming the communication culture in an organisation requires process management and leadership skills, as well as emotional intelligence – i.e. the dreaded ‘soft skills’. As noted risk management specialists the Ramones put it: “You gotta learn to listen, listen to learn/ You gotta learn to listen, before you get burned”. Are lawyers prepared to ‘listen to learn’? Many lawyers seem to be drawn to lead – but how strong are our management and leadership skills in practice, compared with our senior peers? If leadership in communication is at the core of risk management, and lawyers are ineffective leaders and managers, how effective can lawyers be at managing existential risks?

Over the next few months I’ll be considering these questions, focusing on the current state of leadership and management within our industry. If you have a view on these subjects, please do get in touch.

Columnist