 By Heyrick Bond Gunning, the Managing Director of Salamanca Group
Corporate thinking about risk frequently stops at the financial and legal pitfalls of a project. Consideration of wider concerns – emerging or operational risks – can be left too late or even left out. Operational risks broadly fall into two categories – those risks that a company can do something about whilst continuing to operate and those that are insurmountable and best avoided. Having stated the blindingly obvious, it is time to look into the crystal ball.
Risk is multi-layered and takes many forms. A cyber-attack on an Oil & Gas company, such as that experienced by Saudi Aramco, a terrorist as seen at In Amenas, an investigation into an organisation that has flouted FCPA / UK Bribery Act requirements or the seizure of an asset by a desperate government, as seen throughout South America and Africa are but a number of the potential and emerging risks that corporations are faced with today.
The key question is how are these dealt with effectively and more importantly how can they be avoided in the first place? A rough guide to tackling some of the risks that companies are often faced with is outlined below:
• Define what success or failure looks like, provide a clear vision and mission to your employees and work out what assets you need to protect in order achieve your mission. These are likely to be your people, information, reputation, brand and physical assets. Some of these risks can be overcome by training and educating staff at all levels, not just at Board level, especially regarding crisis response. For example, Mohamed Lamine Lahmar, a smart and cool headed employee at In Almenas quickly closed down the plant, by de-pressurising systems, when the attack began.
• The different levels and types of risk must be understood – and critically reputational risks not underestimated. An organisation or board has a focused and at times blinkered determination to achieve a goal. As a project is developed, there needs to be regular review of changing risks whether geo-political or of key relationships. Reviews of high risk relationships are a key element of compliance with the US FCPA and the UK Bribery Act.
• At a strategic level, take time to understand the political landscape of the country of interest and avoid the temptation to rush into a geography, partnership or relationship. Pause for breath. If an election is due or a regime is unstable try to avoid plunging in head first.
• Undertake early due diligence. Even a short public record report may be enough to flag up significant early risk and save huge amounts of time and money. Opportunities in new markets not only bring the chance of greater gains but also the exposure to unfamiliar risks such as a lack of transparency, corruption and bribery which are all too often a pre-requisite to ‘oil the wheels of commerce’. Even as the US Foreign Corrupt Practices Act (FCPA) and UK Bribery Act become the de facto anti-bribery standards worldwide, it is clear that many executives know little to nothing of their key provisions. It is worth remembering that under the UK Bribery Act company directors can be held responsible for the actions of employees and even contractors with the possibility of not just financial penalties but jail time. However, the present trend (70%) is for retrospective actions by companies following deals that have gone sour, with service providers instructed to investigate wrongdoings and help in the subsequent attempts at reputation management, asset recovery and evidence gathering. Understanding risks early and having the mitigation tools to hand can transform adversity into opportunity.
• Re-visit your decision, plan and relationships on an ongoing basis. This will bring a dynamism that will adapt to change whilst ensuring the good parts of the plan are being executed properly.
• There is no substitute for on-the-ground intelligence that can be fed into a cycle of assessment and re-assessment. Part of this task will involve contingency and crisis management planning, cyber security and reputational management.
• The emerging cyber threat. The protection of information has become a notoriously difficult area to manage for corporations and individuals alike, with the difference in threats faced by both becoming increasingly blurred. This threat is manifesting itself in a variety of forms be it physical or technical with the impact causing at worst physical harm and financial loss and at best personal embarrassment and reputational damage. It is clear that the theft of information from individuals, companies and governments will continue to be a huge challenge in the future. Whilst there is no panacea, there are certainly some practical and technical solutions that can be put in place to mitigate the risks and limit the damage that is caused by these attacks. The burden of implementation lies with employees, companies and specialist support which is increasingly important as the legal process around prosecution is at best tortuous and often with limited success.
In summary the key is to have a clear and well communicated vision, which is supported by some early due diligence rather than blind faith, around which is wrapped robust policies, procedures and technical solutions to ensure crises are avoided or at worst managed well throughout the organisation. The more that everyone in the business understands the complex, multi-layered nature of the local and regional tapestry of the area they are operating in, the more likely that crises will be prevented, people and reputations protected and business continuity ensured.
|
