Managing legal risk

Strategic or market-based risks

Strategic or market-based risks originate from decisions concerning, and implementation of, the organisation’s strategy, long-term objectives and positioning. Examples include acquisition, sale or merger strategy, seeking to obtain listing or accreditation, or a drive for profitability / scale-up. Different types and extents of risk exposure are likely to be impacted by the organisation’s strategy, objectives and positioning in relevant markets.

Examples for Legal Professionals include novel or aggressive business strategies which may require legal clearance and potentially engage ethical issues, or a need to be seen as a ‘disruptor’ or conversely as ‘safe and trusted’ which may drive particular organisational behaviours and actions which generate risk.

Operational risks

Operational Risks are those which have their source in the day-to-day functioning of the business: the work on the shop floor and with suppliers and customers, the implementation of internal policies, processes and procedures.

Examples for Legal Professionals include risks in the use of contractual terms, or conversely the lack of standardisation in operational practices or contracting. Another example is the health & safety risk or financial regulatory risks exposures which may exist as a result of operational practices: the way things are done in practice (i.e. in operational reality) as opposed to ‘compliance on paper’.

Compliance or regulatory risks

Compliance or regulatory risks flow from non-compliance with laws, regulations, and industry standards. It includes consideration of interaction with Regulatory bodies and their promulgation of ‘best practice’ (even if it does not represent ‘the law’). Regulatory risks are dynamic (for example evolving in light of strategic decisions) and often specific to jurisdiction and/or markets of operation. It is often (sometimes unhelpfully narrowly) seen as the risk-type with which Legal Professionals are most closely associated.

Examples for Legal Professionals are plentiful but in England & Wales some common Regulatory Risks exist in relation to Cybersecurity, Data Privacy, Anti-Bribery, the new ‘failure to prevent’ offence under the Economic Crime and Corporate Transparency Act, and aspects of Health & Safety law.

Financial risk

Financial risk relates to the fiscal health of the organisation including elements of market risk (share price, interest rates), credit risk (borrowing, debt exposure and default risk), and liquidity risk (the ability to generate liquidity and/or to realise assets), market volatility, and exposure to fraud. Financial risk is often (not always helpfully) seen as the specialism of accountants and the CFO.

Examples where Legal Professionals may interact with financial risk are most obviously in relation to the financial presentation of litigation and disputed issues, advising on compliance with Listing Rules, UK Market Abuse Regulations (MAR), advising on Directors’ Duties including on the approach to insolvency, and in respect of wrongful trading.

A note on ‘Legal risk’

It is important to note that – to fit with standard corporate conceptions of risk – we have not included ‘Legal Risk’ as its own independent nexus. In our view, that is a debatable position. The law and regulation may be viewed as a separate (albeit overlapping) nexus of risk in comparison to those five listed sources. Conversely, as shown by the examples in the explanations below, each of those sources can give rise to distinct ‘Legal Risks’. Our omission of ‘Legal Risk’ as its own heading is mainly to align with the UK Corporate Governance Code in which FRC have expressly stated that it considers Legal Risk to be adequately captured under other heads.

Risk ecosystem contributors

Whilst legal risks may emerge from any one or more of the Nexuses of Risk summarised in the first quadrant, each risk will necessarily be shaped by, and will need to be considered in the context of, what we have called “Risk Ecosystem Contributors”.

For ease of analysis, we have broken these down into the factors listed below which can be expanded by clicking them.

Organisation-specific

Relevant Organisation-specific factors commonly include organisational (and departmental) scales, resources / resourcing decisions, internal corporate structures, risk appetite and culture. These have implications for the existence of risks, the nature of the risks faced, the scale of those risks, how they are managed and mitigated, how they are communicated, and (for example) the agility of the organisation (or parts of it) to react to new, emergent or evolving risks. We have provided some (non-exhaustive) examples below:

Resource and Scale:

• SMEs (Small and Medium Sized Enterprises) may lack the human resources and/or finances to drive dedicated risk functions or contract for external expertise. Risk management activities may sit across multiple roles as a part-time allocation. However, small organisations may be more agile in responding to emerging or evolving risks.
• Large organisations may have the benefit of specialism (in-house and with established contractors) but face a greater diversity of risks and be less agile.
• Rapid scaling up or down may also impact on risk management.

Structural:

• Organisations or Groups adopt a wide variety of structures which impact their risks exposures, their ability to identify risks and manage them.
• Organisations with a decentralised structure may find it harder to promulgate risk management messages and training and may suffer from inconsistent practices between units / departments.
• Organisation structures affect the flow of information, including information necessary to effectively manage risk.
• Organisations may or may not have internal structures holding a risk management remit: most commonly this may sit with an Audit and Risk Committee, but some risks may sit with the Financial function and others with Legal.

Risk Appetite:

• ‘Risk Appetite’ is a way of articulating what risks and the level of risk an organisation is willing to take in order to achieve strategic objectives.
• Cultural elements aside, an organisation’s risk appetite is usually driven by strategic decision-making at Board level, but levels of risk appetite may differ within parts of the same organisation, for example, depending on their sectors of operation (which may drive a need to be more ‘aggressive’ or ‘safe’).

Organisational Culture:

• ‘Culture’ is frequently cited as a vital and overarching component in risk management.
• In some areas of operation the linkage to risk has gained common parlance, the most obvious examples being “safety culture” and “speak up culture”.
• Prevailing wisdom is that organisations which genuinely engrain values of transparency, individual and collective accountability & responsibility, and ethical thinking into the culture tend to achieve better risk management outcomes.
• Other cultural factors such as risk aversion or aggression, cultural approbation or disapproval of risk-informed behaviours, and a culture of challenge, acceptance or defensiveness may all play a role.

Industry-specific

It is obvious that the risks to be navigated by a financial institution are not the same as a transport operator or a nuclear engineering organisation. The industries / sectors within which a business operates necessarily augment the types of risk to which it is exposed and the likelihood and severity of those risks.

Many of the factors listed above as ‘organisational specific’ can also be present at industry level (such as risk culture). Different industries / sectors are subject to different law, regulation, industry practices, and regulators.

The approach of the industry regulator may have a particular impact on approach to risk within an industry and on areas of focus. For example, part of the Prudential Regulation Authority’s 2024/25 plan was a focus on promoting “a strong risk culture among regulated firms”.

Normal external

There are many ‘everyday’ factors which may (consciously or otherwise) affect an organisation’s approach to risk. To give some examples:

• Media coverage may amplify awareness (as well as perception) of risks. It might alter public perception, regulatory focus, and/or stakeholder confidence. A number of high-profile cases in recent years have also brought focus on the role that may be played by trade press.
• Societal Culture & Attitudes shift over time in ways which influence the approach to risk. A recent example is attitudes towards the role and value of ESG.
• The Political and Regulatory Climate are not always aligned. However, changes in Government and/or regulatory policies or priorities can impact an organisation’s approach to different risks, as well as societal attitudes. A particularly high profile, although now quite historic, large-scale example was the Coalition Government Red Tape Challenge: “challenging the public to help cut unnecessary regulations… burdening businesses, hurting our economy and damaging our society”. More recent examples include the current Government’s decision to abolish the Payment Systems Regulator and its decision to replace OFWAT with a new Water Systems Regulator.
• Short term environmental factors: Few businesses are immune to the weather, but some industries (agriculture and certain utilities) are particularly exposed. There are also ‘seasonal’ risks which may impact both an organisation (including its people and the operation of various components) and its customers.
• Current and anticipated state of technology: Technology plays a vital role in the management of risk, including in the implementation of systems and processes which mitigate risk and enable critical organisational functionalities. New technologies pose risks, but so does obsolescence.

Macro / exceptional

Organisations may be subject to ‘macro’ / global / geo-political / large-scale exceptional risks, which may include:

• Force-majeure-style factors such as the outbreak of war (and related trade or other sanctions regimes), pandemic or natural disasters. Such large-scale and often unpredictable events can have major impacts. Organisations may seek to manage the resulting risks through contractual resilience (contractual clauses and supply chain), insurance coverage, and crisis response capabilities.
• Macro-Environmental factors including the impact of global warming may be relevant. These may be organisationally considered and managed as part of wider ESG and Sustainability initiatives.
• ‘Groundbreaking’ factors include technological leaps or breakthroughs, and novel approaches or structures with disruptive impacts on affected industries / sectors. Organisations seek to monitor such developments in order to be able to adapt (or not).

Risk management

An essential step to understanding an organisation’s risk exposure is to identify the potential Hazards to which it is exposed (see previous Quadrants). However, it is then necessary to convert that initial identification of the Hazard into an analysis of the Risk; to agree how that Risk will be managed; implement this in practice; and keep it under monitoring and review.

For ease of analysis, we have broken the topic of Risk Management down into common risk management processes, risk management structures, and common ‘tools’ used in risk management. Each of these concepts can be expanded by clicking the links below.

Processes

The diagram shown here is our formulation of a risk management cycle; a process for the management of risk. However, there is no definitive formulation of this cycle. Examples include:

• Health & Safety Executive’s ‘Identify, Assess, Control, Record, Review’ model (H&S Regimes)
• ORR’s ‘Establish & Maintain model (Rail Safety)
• The Charity Commission ‘Identify, Mitigate, Implement, Monitor’ model Charity sector risks)

All are built on essentially the same foundational pillars.

Risk monitoring, tracking and reviewing

Risk monitoring involves keeping an eye on risk indicators and control measures to detect changes in risk exposure or effectiveness of mitigation strategies. This could be done on a scheduled periodic basis, at certain project milestones and/or in response to specific triggers (e.g. a ‘near miss’ or a material change in law / key assumptions).

As seen in earlier Quadrants of this tool, the trigger for review may be a material change in any of the Risk Ecosystem Contributors (Organisation-Specific, Industry Specific, ‘Normal’ or ‘Macro’ / ‘Exceptional’ Contributors).

As indicated by the ‘Risk Management Cycle’, monitoring, tracking and reviewing is not the final step but part of an iterative cycle.

Structures

Organisation structures for risk management may differ significantly depending on sector(s) of operation, level of regulation, size, scale and resources.

As a generalisation:

• In smaller organisations risk management may be more informal with responsibilities allocated to a small number of individuals balancing risk management with operational and/or management duties. Whilst these organisations may lack dedicated resources and more sophisticated risk management tools, there will nevertheless be proportionate measures they can implement to effectively manage their risk. An advantage of smaller organisations may be their ability to share relevant information more easily and react to emerging or changing risks more quickly.
• Larger organisations are more likely to have formalised risk management frameworks / risk management systems, dedicated Directors (potentially with a team), dedicated forums, and access to greater technology. In theory this may allow for more proactive identification, assessment, mitigation and tracking of risks across global operations. They are more likely to align with international standards such as ISO 31000 or COSO ERM and integrate risk management into formal compliance and governance structures. In the converse position to smaller organisations, larger entities may find it harder in some respects to disseminate relevant risk messages, gather relevant risk data, and react to emerging or changing risks.

Whatever risk management structures your organisation has, the key objective is, of course, to have effective structures. In particular, it is not uncommon to set up ‘working groups’ or ‘subcommittees’ tasked with ensuring and/or monitoring the implementation of the measures within the organisation. Sometimes this role is assigned to the designated Compliance Function within the organisation. Legal professionals are sometimes involved in such sub-committees, or are asked to advise on setting up such structures to see that changes are implemented. Legal professionals are also sometimes asked to prepare Board (or Committee) reports reporting on progress towards implementation and assessed ongoing risk exposures (legal or otherwise).

Whilst such committees can be effective, there are also inherent risks in ‘hiving off’ the crucial task of delivering change and monitoring effective implementation. Of particular note, there is a risk that top level management adopt the view that these actions are ‘all in hand’ because they are now delegated to a specialist committee. There is also a risk that the committee itself will have a diffused sense of responsibility (in comparison to a specific individual who can be held accountable and responsible).

Toolkit

Potentially useful tools for legal risk management include:

• Establishment of a Helpdesk / Portal as an advertised contact point for escalation of legal risks.
• Ensuring periodic contact with relevant projects for greater insight into project risks. At the most involved end this might mean embedding a legal advisor within a project team on a whole or part-time basis; at the other end it might simply involve periodic or ad-hoc ‘catch-ups’.
• Training management (where available, supported by use of appropriate training platforms) to ensure awareness of legal risks and adherence to relevant organisational processes, practices and procedures.
• Document and knowledge management systems, including for legal precedents and the tracking of legal risks.
• Commissioning expert advice where needed to address specific legal risks and giving decision-makers the opportunity to directly access to hear from and question such experts.
• Commissioning of internal or external audit or investigation.
• Seeking to implement Legal Project Management within aspects of work or particular projects, including the use of trackers and dashboards.

‘Legal Privilege’ is a further (potentially particularly useful) tool which can be used in collaboration with a number of the above options. However, legal professionals will be aware that misuse of privilege is currently an issue under the spotlight. It is important that both lawyers and those whom they advise have a sufficient understanding of the potential uses and limitations of privilege. One area which needs careful consideration (but can often be achieved) is the sharing of privileged information with third parties (such as other stakeholders). There is a risk that a misunderstanding of available options may lead to an avoidable lack of transparency and information flow for fear of losing privilege.

Risk communication

The correct flow of relevant information within an organisation (and potentially also to relevant stakeholders insofar as they play a relevant role in the organisation’s management of that risk, e.g., availability of funding) is vital to ensure that the right people have the right information (right data) in the right level of detail at the right decision-making junctures.

Internal risk communication

Internal risk communication could be a book in its own right. We have limited ourselves to the following brief observations:

• Upwards escalation of risk can be a fraught issue. One common pitfall is having an uncertain escalation path leaving individuals second guessing. Does this go straight to the Audit & Risk Committee, or does it need to be notified first to ‘Heads of’ or C-Suite, and if so who? Another issue is managing the trade-off between conciseness and message dilution (or active or unconscious ‘glossing’ of message which might be worse). Does the message provide fair presentation of the risk to drive a sufficiently informed decision? Do you have a culture that promotes this kind of honest escalation? Conversely, if you are the senior person receiving such information, there is a need to be aware of these risks and try to stay curious: looking for the risk signals if reports reach you in a diluted format. See quote below. .
• Horizontal sharing of risks is likewise difficult. Many large organisations suffer from compartmentalisation and/or siloing. This may be structural (different buildings or floors) and/or cultural (teams stick together). However, it is sometimes the case that sharing of information between these ‘units’ is essential for identifying a risk properly. As an example, an IT Team implementing new software may measure risk in terms of lack of errors and minimised system downtime; the People/HR Team might measure risk in terms of likelihood of user error (or inability to use). By sharing information about how the system works (IT Team) and how people are interacting with it in reality (People/HR) the teams can look to mitigate these interfacing risks.
• Downwards sharing of information also has an important role. Organisational strategy and risk appetite at set from the top and cascaded downwards. Leadership risk culture, how it is messaged, and how it is modelled in action, will also impact the overall organisational risk culture, including for example, whether people feel they can ‘raise the red flag’ or whether they develop a view that it would be better for them to ‘keep their head down’.

“These people are closer to the action. They’re the ones standing on the deck, feeling the vibration in their shoes….Whatever it happens to be, they’re closer to the problem. They know something you don’t know, and your job at that point is to make it easy for them to tell you what that is. …If you want a resilient system where errors don’t get propagated through the system, you really need to create an environment where it’s okay for people to tell you you’re wrong.”

– David Marquet (US Nuclear Submarine Command)

External risk communication and articulation

External risk communication and articulation is a very large topic. At a basic level:

• Outwards: It is understandable that organisations feel the need to think carefully about their external risk communications. Common areas of complexity include:
  • Insurance, in particular in respect of the Duty of Fair Presentation and around notification of the potential for claims against the company or its officers.
  • Major shareholders, including in a JV scenario or where the subsidiary has a high level of autonomy from its owner-parent.
  • The sharing of privileged information in both of the above (and many other scenarios). This issue is currently in the spotlight as a result of renewed regulatory scrutiny (see for example the SRA’s November 2024 notice on in-house use of privilege) and recent high-profile examples (such as from the Horizon Inquiry hearings) where examples of non-sharing or use of privilege as a ‘cloak’ are seen to be at the heart of some of the issues.
• Inwards: A separate aspect of this is considering the systems your organisation has for detecting and assimilating the risk signals being received from external sources:
  • External communications is an area which is often subject to tension between the desire of some quarters to control and shape public relations and messaging and, on the other hand, the need to ensure communications are clear, accurate and substantiated. At worst, such tensions create risks in their own right including the risk of misleading public statements or shutting down proper investigation of risks in the face of an instinctive need to rebut criticism or ‘hold a line’ in the face of perceived hostile external attack. In an era of rapid 24/7 news and demand for instant responses, this risk becomes even more acute.
  • It is worth considering whether and how your organisation’s ‘external risk radar’ could be strengthened, drawing on sources like trade publications, industry leaders, relevant thought-leaders, professional websites and subscriptions, and regulatory publications in your sector.

For an interesting case study highlighting the perils of ineffective internal risk communication, see our article on Governance and Legal Risk Management: OFWAT’s report into Thames Water’s wastewater treatment work breaches