Rims strategic risk management implementation guide

What Are The Main Drivers For Successful ERM Implementations In Organizations?

CHAPTER 30 Alleged Corruption at Chessfield: Corporate Governance and the Risk Oversight Role of the Board of Directors

RICHARD LEBLANC

Associate Professor of Law, Governance, and Ethics at York University

The police and the regulator contacted the author early in the author's governance review process. When the author attended his first meeting with the chairman of the board of directors for Chessfield Inc. and the regulator, the regulator mentioned the word corruption explicitly. Now the New York Police Department was also investigating the conduct of some of Chessfield's directors, by interviewing them and collecting evidence. The author's role was to conduct a thorough governance review, with a specific focus on risk management, and report his findings and recommendations to the regulator and board of directors. Chessfield is a fictional company; however, this case is based in part on actual situations that have been modified and disguised.

CHESSFIELD INC. AND ITS BOARD OF DIRECTORS

Chessfield is a well-known American company in the sports and entertainment industry. It is headquartered in New York, and is led and governed by an outspoken and successful CEO and a blue-chip board of directors. Several directors are household names and have been on the board for many years, knowing each other in social and professional circles. One director had been on the board for 28 years, the second-longest-serving director had been on the board for 24 years, and so on. The shortest-serving director's tenure was seven years. It was an all-male board, known fondly among a few directors as “the good ol' boys.”

Governance and decision making were informal, and almost always by consensus. By externally viewing Chessfield, it would be difficult to glean that it had any governance shortcomings whatsoever. It had a majority of directors who were current or former CEOs, a separate chair, and other independent directors from prestigious New York professional services firms. It had three committees that were all composed of independent directors. The size of the board was 10 members. Chessfield appeared to comply at least in letter with all applicable governance regulations in place at the time.

WHISTLE-BLOWER COMPLAINT

A credible and anonymous whistle-blowing complaint had recently reached the regulator, from a possible former director or officer.

Chessfield was not a publicly traded company, but was in an industry that was highly regulated, given the potential for misuse of information and cash receipts, as well as the potential for harm (of patrons) and for organized crime.

The regulator had concerns about the compensation awarded to the CEO being approximately four times that of comparable industry peers, and potentially creating an incentive for undue risk taking; the apparent lack of internal controls over material risks, including operational risks; and possible impropriety by certain directors in using their positions for self-gain.

MESSAGE FROM THE CEO REQUESTING TO MEET THE AUTHOR

Chessfield's CEO e-mailed the author when the author was in Dallas, Texas, at a conference, asking for a meeting within 24 hours if possible. At that meeting in New York, with the CEO and Chessfield's legal counsel, the author was told that the company had just been put under regulatory investigation.

The author was asked whether he could assist by reviewing Chessfield's overall governance, and, in particular, risk management and compliance practices. The board chair had recommended the author to the regulator because the author had assessed a previous board on which the chair served at the time, and the author was independent.

The author agreed to conduct the governance review of Chessfield for a mutually agreed fee under two conditions. He made it clear to the board chair, CEO, and general counsel that:

1. He would be entitled to any document or access to any personnel he requested.

2. He must have a direct reporting line to the regulator, including separate meetings without the presence of any director or officer.

All parties agreed, including the regulator. The author was to have separate meetings with both the regulator and the New York Police Department official conducting the investigation.

GOVERNANCE DOCUMENTS, INTERVIEWS, AND ON-SITE OBSERVATION REQUESTED BY THE AUTHOR

As a starting point, the author asked for the following: any and all governance documents, including recent board minutes and meeting materials, bylaws, relevant correspondence, board and committee charters, risk registers, compensation plans, and financial statements (in no particular order).

The author, as part of his methodology and data collection, would also interview each director, each member of senior management, the internal audit function, and possibly other assurance staff. The author would also tour Chessfield's facilities and have access to the cash room1 so he could see operations firsthand. All requests were acceded to, and the author began his work. This work took about 30 days on a part-time basis, and a report was generated to the board and endorsed by the regulator.

DOCUMENT REVIEW

It soon became apparent that governance documentation at Chessfield was minimal. The board did not have guidelines; committees did not have charters; position descriptions for board leadership roles, directors, and the CEO did not exist; and meeting agendas and minutes were very sparse, with the average meeting agenda being one page with key headings only. There was no documented, board-approved strategic plan or risk appetite framework. Indeed, many material risks were not reported to the board at all.

Documentation for key board decisions, including evidence of review, reporting, assurance, due diligence, and deliberation, appeared to be either lacking meaningful content or nonexistent.

INTERVIEW DATA

Many noncompensation committee directors neither knew nor approved what or how the CEO and the former CEO (who was also on the board as the longest-serving director) were paid. The nonexecutive board chair had a consulting stream paid to him by Chessfield, which certain other directors did not know about. The internal auditor was junior, inexperienced, and unqualified; had operational and revenue generation responsibilities; and had little exposure to, or oversight by, the audit committee. Audit committee members did not possess adequate financial literacy or relevant qualifications. The compensation committee chair rarely attended meetings in person for health reasons, and did not possess compensation expertise. His tenure as committee chair exceeded 11 years. He was a former service provider (now retired) of a large New York law firm.

CEO COMPENSATION ISSUE

There was little correspondence evidencing the basis on which total compensation was awarded to the CEO. There was a spreadsheet with a password that was provided to the author by the CEO's assistant. When the author interviewed the chair of the compensation committee about the lack of either supporting documentation or independent assurance by a compensation consultant, the compensation committee chair told the author that the compensation committee was composed of experienced businessmen who were of the view that the CEO's compensation was appropriate given the CEO's performance.

The author was not provided with any CEO goals and objectives, key performance indicators, or trigger and target requirements for short-term or long-term incentives to be awarded or to vest. The foregoing items were asked for but, to the author's knowledge, did not exist. The compensation committee chair had friendships and social relationships with a number of directors, including the CEO. The basis for the quantum of compensation awarded to the CEO (1) relative to peers or (2) relative to company performance was not explicit.

The board chair and compensation committee chair said to the author that the regulator did not have the business judgment to opine on the quantum of CEO compensation. The author responded by saying that (1) the quantum of total compensation was very high compared to industry peers of a similar size and complexity, but, more importantly and particularly given this fact, (2) there should be a visible, diligent process to employ such business judgment of directors and to explicitly link pay to performance, which appeared to be what was lacking in any event.

RISK MANAGEMENT

There were very few explicit risk management protocols or systems to identify and mitigate material risks, including operational risk in particular. In the cash room, the controls were all manual (i.e., paper, with greater capability for management override or weaker controls, it would appear), as information technology was not used. Risk identification and assessment were not documented explicitly. There was no risk function reporting directly to the board or to a committee. Indeed, there was no risk function.

There was little evidence that internal controls over operational and compliance risks were designed and/or effective, regularly tested by the internal audit function, and reported to the board or a committee. A number of directors appeared blindingly ignorant of their obligation to oversee risk management.

SELF-DEALING ISSUE

There was not a conflict of interest policy that applied to directors. Board guidelines did not exist to address confidentiality, the use of corporate opportunity, the treatment of inside information, related-party transactions, or identifying and adequately addressing perceived conflicts of interest. The author was unable to ascertain self-dealing, but robust policies and controls did not exist to deter, detect, monitor, or enforce anticorruption, in any event.

BOARD COMPOSITION

As mentioned previously, several directors were long-serving. Independent directors were selected originally (and to the author's observation, still) on the basis of personal knowledge and prior working relationships. All directors, however, were believed to comply with formal independence standards in place. There was little if any documentation of such independence, of the expertise directors possessed, or of collective expertise that the board needed.

PREPARATION OF THE AUTHOR'S REPORT AND COMMUNICATION WITH THE REGULATOR

Given the foregoing, the author prepared 43 recommendations for the review of the regulator and the board of directors.

The regulator endorsed the 43 recommendations that the author provided, with minor modifications and with two additional recommendations to establish a compliance committee of the board and to have a board-approved strategic plan, which the regulator suggested and which the author incorporated into his report. There were 45 recommendations in the author's final report, which he was now to present to the board of directors of Chessfield. The report was 14 pages long.

CHESSFIELD BOARD MEETING TO DISCUSS THE AUTHOR'S RECOMMENDATIONS

The author was invited to present his report and 45 recommendations to the full board of directors of Chessfield Inc. in New York City at 10 A.M. on a Friday morning in December. This was a special board meeting, and the author's report was the only item on the agenda.

The author had 15 minutes to present a summary of his recommendations. (Note: The board had a full week prior to the board meeting to read the author's report.) There was to be a 45-minute period of dialogue and questions and answers, after which the author would leave the room and the board would discuss the report in closed session.

The author was told by the general counsel that the regulator had requested to the chair of the board that the board approve a resolution adopting the author's report in whole, supported by a commitment to implement the recommendations within the time frame prescribed in the report. The chairman of the board was to telephone the regulator shortly after the meeting to report whether this requested approval had occurred. (The regulator had told the chair early in the process that Chessfield was close to having its license to operate revoked because of the governance and risk shortcomings.)

When the author was invited into the boardroom, he saw that it was very formal. There were portraits of past directors on the walls, large mahogany chairs, and dark wood. The author did not observe any use of technology, such as laptops or tablet computers, which is typical in most boardrooms now.

At the board meeting, the author presented 45 recommendations based on his review and discussions with the regulator. A time frame for each recommendation was set out (up to eight months, eight to 12 months, and 12 to 18 months) within the report, along with independent validation and reporting back to the regulator, to ensure execution of the recommendations.

TWO CONTENTIOUS RECOMMENDATIONS

Directors accepted all of the recommendations initially except for two, which were: (1) that the three longest-serving directors (28, 24, and 23 years, respectively) resign, and (2) that a woman be selected for directorship and serve on the compensation committee in particular.

As far as the three longest-serving directors resigning was concerned, one director (28-year tenure) had, during the data collection phase, invited the author to his estate in Boston prior to the final report to tell the author how important the board was to him, and how he should be allowed to continue to serve so long as he is able. The author indicated politely that regulators are moving toward term limits of nine or 10 years to guard against entrenchment and compromising of independence over time. The author said that one of his recommendations was not only that he and two other directors should resign, but also that term limits be in place at 15 years for all incumbent directors and nine years for all new directors.

RECOMMENDING A WOMAN TO SERVE ON THE BOARD

The second issue was more contentious and surfaced at the board meeting itself. It was the author's recommendation that a woman be added to the board.

One director remarked, “Dr. Leblanc, you want us to put a lady on the board?” (Emphasis in original remark.) Another director remarked, “Perhaps we can have a lady in a wheelchair who is a lesbian.” Many of the directors laughed at this comment.

The author indicated that evidence existed that CEO turnover is more sensitive to stock return performance in firms with a greater proportion of women; that women are more likely to join committees that perform monitoring-performing tasks; and that male directors have fewer attendance problems, the greater the number of women on the board.2 The author also indicated that the regulator had agreed to all of his recommendations, including this one, and that there was a need for the skill set of compensation and information technology literacy on the board, given prior concerns and the transformation of the industry.

CONCLUSION

This case concluded one month after the author's presentation to the board, when the regulator asked the author to black-line, with suggested improvements, forthcoming regulations to apply to all companies under the regulator's purview, adopting many of the recommendations the author had provided for Chessfield.

QUESTIONS

1. What is your assessment of the situation at Chessfield?

2. What recommendations would you provide to the regulator?

3. What is your opinion of the governance regulation of Chessfield? In what ways should governance regulation improve, given the above?

4. What are the learnings and broader implications of this case?

NOTES

1 Part of this company's business operation involved receiving cash directly from consumers, which was assembled, tallied, and reconciled in what is known in the industry as the “cash room.”2 R. B. Adams and D. Ferreira, “Women in the Boardroom and Their Impact on Governance and Performance,” Journal of Financial Economics 94 (2009): 291–309.

REFERENCES

1. Adams, R. B., and D. Ferreira. 2009. “Women in the Boardroom and Their Impact on Governance and Performance.” Journal of Financial Economics 94, 291–309.

2. Basel Committee on Banking Supervision. 2010. “Principles for Enhancing Corporate Governance.” Bank for International Settlements Communications, October.

3. Canadian Securities Administrators. 2008. “Request for Comment: Proposed Repeal and Replacement of NP 58-201 Corporate Governance Guidelines, NI 58-101 Disclosure of Corporate Governance Practices, and NI 52-110 Audit Committees and Companion Policy 52-110CP Audit Committees, 31 OSCB 12158.”

4. Canadian Securities Administrators. 2010. “Staff Notice 58-306 2010 Corporate Governance Disclosure Compliance Review,” December.

5. Caplan, G. R., and A. A. Markus. 2009. “Independent Boards, but Ineffective Directors.” Corporate Board, March/April, 1–4.

6. Carter, D. A., F. D'Souza, B. J. Simkins, and W. G. Simpson. 2010. “The Diversity of Corporate Board Committees and Financial Performance.” Corporate Governance: An International Review 18:5 (September), 396–414.

7. Carter, D. A., B. J. Simkins, and W. G. Simpson. 2003. “Corporate Governance, Board Diversity, and Firm Value.” Financial Review 38, 33–53.

8. Elson, C. F., and C. K. Ferrere. 2012. “Executive Superstars, Peer Groups and Over-Compensation—Cause, Effect and Solution,” August 7. Available on SSRN website at http://irrcinstitute.org/pdf/Executive-Superstars-Peer-Benchmarking-Study.pdf.

9. Financial Reporting Council. 2011. “Guidance on Board Effectiveness.” Financial Reporting Council Limited, March.

10. Financial Reporting Council. 2012. “The UK Corporate Governance Code,” September. Available online at www.frc.org.uk/Our-Work/Publications/Corporate-Governance/UK-Corporate-Governance-Code-September-2012.pdf.

11. Fraser, J., and B. J. Simkins, eds. 2010. Enterprise Risk Management: Today's Leading Research and Best Practices for Tomorrow's Executives. Hoboken, NJ: John Wiley & Sons.

12. Group of 30. 2012. “Toward Effective Governance of Financial Institutions.” Washington, DC, 1–96.

13. House Committee on Financial Services. 2010. “Dodd-Frank Wall Street Reform and Consumer Protection Act.” H.R. 4173, June 25.

14. Institute of Chartered Secretaries and Administrators. 2009. “Boardroom Behaviours—A Report Prepared for Sir David Walker by the Institute of Chartered Secretaries and Administrators.” Report, June.

15. Institute of Corporate Directors. 2006. “ICD Key Competencies for Director Effectiveness.” Competency list issued, Toronto.

16. Leblanc, Richard. 2011. “A Fact-Based Approach to Boardroom Diversity.” Director Journal, Institute of Corporate Directors 154, March: 6–8.

17. Leblanc, Richard. 2012. “Discussion Notes for: OSC Dialogue.” Toronto, October 30.

18. Leblanc, Richard. 2013. “Forty Proposals to Strengthen the Public Company Board of Directors' Role in Value Creation, Management Accountability to the Board, and Board Accountability to Shareholders.” International Journal of Disclosure and Governance 10:4, 1–16.

19. Leblanc, Richard. 2013. “Review of the Regulatory Guideline for [a Regulator], Black-Lined Report,” March 19.

20. Leblanc, Richard, 2013. “Review of the Regulatory Standard for [a Regulator], Black-Lined Report,” March 6.

21. Leblanc, Richard, et al. 2012. “General Commentary on European Union Corporate Governance Proposals.” International Journal of Disclosure and Governance 9:1, 1–35.

22. Leblanc, Richard, and James Gillies. Inside the Boardroom: How Boards Really Work and the Coming Revolution in Corporate Governance. Toronto: John Wiley & Sons, 2005.

23. Leblanc, Richard, and Katharina Pick. 2011. “Separation of Chair and CEO Roles: Importance of Industry Knowledge, Leadership Skills & Attention to Board Process.” Director Notes: Conference Board. New York, August.

24. Lorsch, Jay, ed. 2012. The Future of Corporate Boards. Boston: Harvard Business Review Press.

25. Monks, R. A. G., and N. Minow. 2011. Corporate Governance. 5th ed. Chichester, UK: John Wiley & Sons.

26. National Association of Corporate Directors. 2010. “Template for Disclosure of Director Skills and Attributes,” August. Resources@nacdonline.org.

27. National Commission on the Causes of the Financial and Economic Crisis in the United States. 2011. “The Financial Crisis Inquiry Report.” U.S. Government Printing Office. Washington, DC, January.

28. Neill, D., and V. Dulewicz. 2010. “Inside the ‘Black Box’: The Performance of Boards of Directors of Unlisted Companies.” Corporate Governance: An International Review 10:3, 293–306.

29. Trautman, Lawrence J. 2012. “The Matrix: The Board's Responsibility for Director Selection and Recruitment.” Florida State University Business Review 11, 1–66. Available at http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1998489.

30. U.S. Senate Permanent Subcommittee on Investigations. 2011. “Wall Street and the Financial Crisis: Anatomy of a Financial Collapse.” U.S. Government Printing Office. Washington, DC, April 13.

31. Useem, M. 2006. “How Well-Run Boards Make Decisions.” Harvard Business Review 84:11, 130–138.

ABOUT THE CONTRIBUTOR

Richard Leblanc is a governance lawyer, certified management consultant, and Associate Professor of Law, Governance & Ethics at York University. He holds a PhD focusing on board of director effectiveness. He has published in leading academic and practitioner journals, has advised regulators on corporate governance guidelines, and, as part of his external professional activities, has served as an external board evaluator and governance adviser for Australian Securities Exchange (ASX), London Stock Exchange (LSE), New York Stock Exchange (NYSE), NASDAQ, New Zealand Stock Exchange (NZX), and Toronto Stock Exchange (TSX) listed companies, as well as in an expert witness capacity in litigation concerning corporate governance reforms.

CHAPTER 31 Operational Risk Management Case Study Bon Boulangerie

DIANA DEL BEL BELLUZ

President, Risk Wise Inc.

Bon Boulangerie is a bakery business located in Oakville, Ontario. When the owner, Ray Pane, purchased the business three years ago, it consisted of a single site with baking facilities and a retail store and café. Based on market research with the bakery's retail and café clientele, Ray began to change and expand the product offerings to increase the volume of sales and margins. He also began a new line of business, wholesaling to local restaurants and high-end grocery stores within a 20-kilometer radius of the bakery.

Based on the success over the past three years (see Exhibit 31.1), Ray has made a strategic decision to expand his wholesale business, with the goal of tripling profits over the next three years (see Exhibit 31.2). He expects to accomplish this by: (1) covering a larger territory (i.e., expanding to a 120 km radius) for wholesaling to local restaurants and independent grocery stores across the entire Greater Toronto Area, and (2) introducing a new business line, white label products that he can supply to major supermarket chains.

(Actuals)

(all figures in $000's)

Year 3

Year 2

Year 1

Income

 Café

  300

  273

246

 Retail Bakery

  718

  624

562

 Wholesale—Restaurants

  410

  234

  0

 Wholesale—Other Retailers

  359

  312

  0

 Total Revenue

1,786

1,443

807

Operating Expenses

 Cost of Inventories Sold

1,349

1,090

610

 Marketing, General, and Administrative

  361

  291

163

 Total Expenses

1,710

1,381

773

Net Income

   76

   62

 35

Exhibit 31.1 Financials for Past Three Years

(Projections)

(all figures in $000's)

Year 6

Year 5

Year 4

Income

 Café

  348

  331

  315

 Retail Bakery

  831

  791

  753

 Wholesale—Restaurants

  960

  768

  614

 Wholesale—Other Retailers

4,306

2,153

1,076

 Total Revenue

6,444

4,043

2,759

Operating Expenses

 Cost of Inventories Sold

4,926

3,105

2,175

 Marketing, General, and Administrative

1,301

  816

  557

 Total Expenses

6,227

3,921

2,732

Net Income

  217

  121

   27

Exhibit 31.2 Projections for Next Three Years

To realize this strategy, Ray has leased and outfitted a separate baking facility to be primarily dedicated to supplying the wholesale business. Ray also hired a full-time vice president of sales and marketing (see Exhibit 31.3 for a summary of the Bon Boulangerie management team) to take over from him on the wholesale side. Finally, he purchased a second previously owned delivery truck and hired a full-time distribution manager.

Growth in the first three years is attributable to enhancement of product offerings and continual drive to find efficiencies in operations. In year 4, the new baking facility will open. It is expected that it will take several years to add new wholesale customers and wholesale products. Therefore, there will be unutilized capacity in the new facility. It is anticipated that expanding the wholesale business will, at least initially, require an increased level of product development, marketing, sales, and distribution.

Exhibit 31.3 The Bon Boulangerie Team

· Ray Pane, President and CEO. After a successful legal career, Ray decided to pursue his dream of being an entrepreneur. He has a passion for fine food and is committed to providing his customers with high-quality, wholesome, and artisanal products.

· Janice Sweet, Manager, Accounting. Janice is a Chartered Professional Accountant who came to Bon Boulangerie with five years' experience in several finance roles at a furniture retailer. She joined Bon Boulangerie halfway through its third year of business. She is the company's first in-house accountant. Prior to her joining, the accounting was done by an external bookkeeper on a contract basis. Janice has begun to introduce more systematic accounting processes. She is also working with Ray to develop more forward-looking reporting, including projections and forecasts of revenues and costs.

· Joe Silkwood, Vice President, Sales and Marketing. Joe was hired near the end of year 3 when Ray decided to expand the wholesale business. Joe is a classic salesman; he's outgoing and optimistic. He has nearly 10 years' experience in the grocery business.

· Rick Kneader, Manager, Baking Operations. Ray hired Rick as the head baker for the retail bakery at the beginning of year 1. Rick is a true artisan who successfully developed the new products that have been responsible for the increases in sales in the café and retail bakery in its first three years of business. He also runs a tight ship and has managed costs well, despite shifting to products with higher-cost ingredients. With the opening of the new commercial baking facility in year 4, Ray has received a promotion to Manager of Baking Operations for both the retail and the commercial facilities. He will now spend less time working with his hands and more time overseeing junior bakers while managing the expenses at the commercial baking facility.

· Mohammed Sharif, Manager, Distribution. Mohammed has been hired by Ray to manage distribution to the expanding roster of wholesale customers—both restaurants and other retailers. He has worked in the trucking field for 15 years. He will expand and supervise the existing team of drivers who were hired in year 2 to distribute product to wholesale customers. Ray has also made it clear that he expects Mohammed to find efficiencies and reduce shipping costs.

· Jelena Zarinovic, Manager, Retail Operations. Jelena has been with the company since it started. In fact, she worked for the previous owners. She is the only full-time retail sales employee. She is friendly and adored by customers and the many part-time sales associates. However, she is less interested in paperwork and is finding it challenging to learn the new accounting procedures that Janice is implementing.

QUESTIONS

1. How does Ray's strategic objective translate to the operational level, that is, what is his key operational objective(s) for the wholesale business line?

2. What performance drivers, that is, the internal capabilities (e.g., people, processes, and systems), and external factors need to be present to achieve operational success?

3. What are the risk factors that drive the uncertainty around achieving operational objectives?

4. Which risk drivers are most likely to impact operational objectives?

5. How large of an impact might those key risk factors have? Hint: Use scenario analysis to explore the full range of potential outcomes.

6. Based on your analysis, what are the “significant few” factors on which Ray should focus his attention to manage the operational risks associated with the new facility?

7. What underlying assumptions underpin your analysis and conclusions?

ABOUT THE CONTRIBUTOR

Diana Del Bel Belluz is the President and Founder of Risk Wise Inc., a risk management consulting firm that provides advice and support to executive leadership teams and boards who want to achieve more effective, proactive, and strategic management and oversight of risk. Her forte is helping leaders to solve the people issues associated with bringing enterprise risk management (ERM) to life in their organizations. Diana advances the practice of ERM through her thought leadership as an educator, conference organizer, speaker, and author of ERM resources, including numerous articles, book chapters, and the Risk Management Made Simple Advisory, a quarterly publication of ERM implementation tips and resources available at www.riskwise.ca. She also wrote Chapter 16, “Operational Risk Management,” of the book Enterprise Risk Management: Today's Leading Research and Best Practices for Tomorrow's Executives, edited by John Fraser and Betty J. Simkins (John Wiley & Sons, 2010). She holds bachelor's and master's degrees in systems design engineering from the University of Waterloo and is a professional engineer.

CHAPTER 34 Turning Crisis into Opportunity Building an ERM Program at General Motors

MARC S. ROBINSON

Assistant Director, Enterprise Risk Management, GM

LISA M. SMITH

Assistant Director, Enterprise Risk Management, GM

BRIAN D. THELEN

General Auditor, GM

This case study chronicles the ground-up implementation of enterprise risk management (ERM) at General Motors Company (GM), starting in 2010 through the first four years of implementation. Discussion topics include lessons learned during implementation and some of the unique approaches, tools, and techniques that GM has employed. Examples of senior management reporting are also included.

I think risk management is an element of all good executive management teams and boards. It will ensure viability in downturns and high-risk periods. I think if that is done not only within the automotive industry, but on a global and specifically on a national scale, economies will be in better shape because it is additive. If everybody is doing their job in assessing and understanding risk, the ultimate outcome will be much more positive for our national economy and society, and it is incumbent that corporate leadership understands that responsibility.

—Daniel F. Akerson, Chairman and Chief Executive Officer, General Motors, October 2012

BACKGROUND AND IMPLEMENTATION

The enterprise risk management (ERM) program at General Motors was founded in late 2010 at the direction of GM's then newly appointed chief executive officer (CEO), Daniel F. Akerson, who sought to leverage the program as another means to achieve a competitive advantage in the industry. Having gone through bankruptcy in 2009 as a new board member, Akerson felt that a more robust risk management program would help guide the organization around the drivers of killer risks1 going forward. His goal was to help the company ensure that it was prepared, agile, and fast to respond in an ever-changing world. Perhaps most importantly, Akerson wanted an ERM program that would focus not only on risks but on opportunities as well.

A chief risk officer (CRO) was selected and appointed from within, and the Finance and Risk Policy Committee of the board of directors was chartered to oversee risk management as well as financial strategies and policies. In support of the program, a senior manager and director joined the team. Risk officers were also identified and aligned to all direct reports of the CEO; this helped to ensure that all aspects of the business were covered. The CEO is the ultimate chief risk officer, and his direct reports are the ultimate risk owners. Members of the risk officer team were carefully selected by senior leadership based on their strong business experience, financial acumen, and most of all their ability to lead in the identification and discussion of risk in an objective and transparent manner. These representatives were expected to actively participate in the evolving ERM program while still handling their existing responsibilities.

In 2011, the general auditor and CRO roles were combined, and in support of this change, the Audit Committee assumed oversight of risk management. The Finance and Risk Policy Committee continued its focus on financial policy and decision making.

GENERAL MOTORS' APPROACH TO ENTERPRISE RISK MANAGEMENT

The ERM process was built with GM's vision in mind: to design, build, and sell the world's best vehicles (see Exhibit 34.1). The process itself was geared toward the identification and management of key (potential “killer”) risks. The ERM team assisted line management in developing a list of top company risks, identifying risk owners, assisting management in the development of risk mitigation plans in conjunction with the management teams, providing ongoing monitoring, and reporting results to senior management and the board.

images

Exhibit 34.1 GM Risk Management Process

The scope of GM's initial ERM program intentionally did not fit the typical ERM definition of an all-encompassing, holistic approach. As a bottom-up implementation, senior leadership wanted ERM to focus on those elements of risk and opportunity that were most important to the company. We at GM have since enhanced our program with additional high-impact features, which are detailed later in this chapter.

Overall, however, our approach was to move away from the typical ERM view, which focuses on “what can go wrong.” We took a more actionable view of “what can go right,” placing emphasis on both opportunities and risks, to ensure that we were leveraging our ERM program to be well-positioned in the industry.

LESSONS LEARNED: IDENTIFYING RISKS

A critical success factor that has been a part of our program since inception has been to continually seek out several views, including views from sources outside the company, of risks that the industry and company may face. In addition to regular meetings with our risk officers, we conducted a number of focus groups and workshops to gain insight into potential blind spots that may exist, and to capture various views on emerging risks. To solicit this information, we reached out to deep thinkers and those with broad business experience both within and outside of our organization and sought input across demographic groups, including Generation Ys or recent college graduates and young professionals.

The careful attention devoted to capturing several perspectives from various demographics, both inside and outside of the organization, has led to some great successes and has consistently influenced the composition of our top risks list. Our commitment to seeking out diverse views has helped us to avoid confirmation bias,2 and helped us to ensure that we are not seeing our world through rose-colored glasses.

LESSONS LEARNED: DEVELOPING TOP RISKS LISTS AND REPORTING TO SENIOR MANAGEMENT

There is a tendency to underestimate risks. If you go back and look at the problems we ran into over the last four to five years, everybody knew there was a housing bubble there. Everybody knew the banks and others were stretched out. But rather than face up to the fact that you had this huge risk and understand what the consequences were of the risk materializing, it was relatively easy to say, “Well, it is a low-probability risk, so let's go on—things look good.” It may be a low-probability event, but those low-probability events have a way of materializing, and therefore we need to better understand what happens.

—Mustafa Mohatarem, Chief Economist, General Motors, October 2012

While we understand the value of assessing probability and impact for risks, we have made additional improvements to our process for ranking and prioritizing risks. In the past, we facilitated meetings at which our risk officers were asked to score proposed risks individually along defined impact and probability scales. The output of the session was a typical “heat map” with risks that were ranked or plotted based on probability and impact scores.

However, we quickly learned that not only was this a very tedious process, but it injected a great deal of subjectivity since many of the participants did not really have specific knowledge of these parts of the business. We have also learned from various world events, such as the Fukushima disaster in Japan, that there may be a tendency to dismiss risks with the potential for very high impact because they have a very low probability of occurring. These low-probability events are often risks that companies cannot afford to miss. As we looked back on what has worked well or needed improvement, we thought there was a better way to provide our board and other stakeholders with more meaningful and actionable information. This prompted us to make a number of changes to improve the program.