Managing the Risk Of CSR

Risk Analysis, Vol. 36, No. 5, 2016 DOI: 10.1111/risa.12643

Current Topics

Risk Management Should Play a Stronger Role in Developing and Implementing Social Responsibility Policies for Organizations

Shital A. Thekdi∗

In late 2015, it was discovered that a leading vehi- cle manufacturer had intentionally programmed en- gines to underreport nitrogen oxide emissions during laboratory testing. This practice resulted in billions of dollars in fines and lawsuits. The nonmonetary reper- cussions were even more serious as these emissions are associated with pollution and health issues. As the resulting public perception of the product is dam- aged, it is unknown whether sales and reputation will fully recover.

In addition to legal violations, these practices conflicted with internal corporate social responsibil- ity (CSR) policies developed by the manufacturer. In recent years, such policies are increasingly being used in organizations, but are these policies more than decorative words? Are they really able to guide the decision making for protecting the social, political, and environmental footprint of the organizations? The above vehicle manufacturer example seems to indicate that this is not the case. In this article, we discuss this topic. We argue that current thinking about and approaches to CSR policies suffer from some severe weaknesses related to risk and uncer- tainty treatment, and that there is a large potential for improvements by incorporating ideas and meth- ods from the field of risk analysis and risk manage- ment. This article presents challenges and opportuni- ties to adapt the risk discipline to the study of CSR.

1. THE CHALLENGES

Firms are increasingly investing in CSR policies to address ethical, sustainable, and social commit- ments, such as waste and pollution reduction, fair la-

∗Robins School of Business, University of Richmond, 1 Gate- way Rd., Richmond, VA 23173, USA; tel: 804.289.1763; sthekdi@ richmond.edu.

bor practices, social programs, and philanthropy.(1)

These policies are often pursued to promote long- term profit or react to past wrongdoings. For ex- ample, consider investments in reaction to nega- tive publicity assumed by BP after environmental incidents.(2) Companies have invested as much as bil- lions of dollars toward developing, advertising, and implementing these policies, yet these CSR efforts have varying effectiveness in improving reputation(3)

or financial performance.(4) One explanation for this variability is that these organizations did not effec- tively manage risk in policy adoption and implemen- tation. They did not sufficiently consider uncertainty or consequences such as damaged reputation, health and safety issues, increased regulation, or ecosys- tem damage. Although conflict with CSR policies can cause irreversible harm to organizations, these poli- cies are adopted with few guidelines and are not en- forced by external regulation.

Policy selection for CSR is challenging for sev- eral reasons. First, processes for developing and im- plementing CSR policies have historically been non- standardized and unique for each organization. The recently published ISO 26000 standards(5) provide very general guidance, but there remains a lack of consensus on specific tools and practices. Second, there are limited guidelines for policy selection that consider risk and uncertainty associated with policy adoption and implementation. Third, as CSR policies are often developed at the strategic level, changes in executive leadership can lead to inconsistent commit- ments.

Implementation of CSR initiatives can also be challenging. Similar to common risk applications, the outcome of implemented CSR policies can be difficult to measure and track using suitable metrics. For example, gathering the sparse data representing

870 0272-4332/16/0100-0870$22.00/1 C© 2016 Society for Risk Analysis

Current Topics 871

corporate culture, biodiversity, or pollutants can be costly and time intensive. Additionally, the ability to comply with CSR policies can be influenced by factors that are uncontrollable and uncertain. For example, organizational culture may be dynamic, environmental conditions may be influenced by cli- mate change or natural disasters, political conditions may be variable, and other influential factors may be unforeseen. Additionally, organizational procedures may not currently exist for accountability in meeting commitments.

CSR policies serve as a public announcement of goals, which may simply be designed to improve cur- rent reputation and shareholder value. There may be little incentive for leadership to follow through with CSR efforts due to short leadership tenures and rel- atively low incentive for organizing actions to meet long-term goals. Even with leadership dedicated to meeting these goals, academic disciplines lack meth- ods and tools for assessing and valuing the risks and uncertainties associated with long-term CSR perfor- mance and goals. Risk management is lacking in both the development and implementation of CSR poli- cies.

We consider CSR applications to present a chal- lenging new frontier for risk management. Risk prin- ciples, tools, and methods should be adapted to ad- dress these dynamic and data-sparse applications. This topic will become even more visible as enviro- nmental sustainability, labor practices, and reputa- tion become increasingly relevant for organizational strategy.

2. SUGGESTED RISK PRINCIPLES APPLIED TO SOCIAL RESPONSIBILITY

To overcome the challenges given above, there is need to apply concepts of risk analysis and risk management toward CSR applications. This section explores how three core risk principles can be ap- plied to the development and implementation of CSR policies. A demonstration of the core risk prin- ciples will be applied to the case of Volkswagen, as follows.

Volkswagen, a leading vehicle manufacturer, was recognized for adopting CSR standards and integrating social and environmental standards within its supply chain.(6) Its CSR policies included high-level goals involving sustainability, community involvement, safety, and diversity For example, the CSR policy documentation describes the Volkswa- gen Community Trust program in South Africa. This

trust was funded by a 300,000 euro per year invest- ment for the purpose of community healthcare, spon- soring nursery schools, financing school building, and investing in worker training.(7) Similar to other orga- nizations, Volkswagen had potential to benefit from improved reputation, long-term shareholder value, and potential avoidance of increased regulation for related activities. In late 2015, it was discovered that Volkswagen had installed a defeat device in over a half-million diesel vehicles sold in the United States. This device allowed the vehicles to emit up to 40 times the allowable limit for NOx emissions (U.S. House of Representatives 2015, available at http:// docs.house.gov/meetings/IF/IF02/20151008/104046/H HRG-114-IF02-Transcript-20151008.pdf, Accessed November 30, 2015). NOx emissions can cause serious health and environmental damage, including respiratory illnesses and damage to soil and water quality. As a result of Volkswagen’s actions, it is facing fines of up to $45 billion,(8) potential class action lawsuits, drop in shareholder value, and a tarnished reputation. This oversight was not only a legal shortcoming, but also in direct violation of its CSR policies.

Regardless of how this breach of CSR occurred, organizations should have safeguards in place to manage risks associated with their CSR policy. One reason for the Volkswagen breach could be insuffi- cient incentive for management to comply with CSR policies. This is a factor that is at least partially con- trolled by the organization. However, another reason for this breach could have been insufficient ability to oversee policy compliance. For example, company culture influencing decisions can be difficult for an organization to control, thereby introducing uncer- tainty and risk. Next, we will present the three prin- ciples and discuss how they apply to this example.

Principle 1. Protecting value through risk man- agement: CSR policies are commonly aimed at ethical or social commitments that may directly or indirectly contribute to shareholder value.(9) It is common in private industry policy making to convert nonmonetary values into dollars, which can undermine valuation of important aspects such as health and safety. Similarly, the primary goal of risk management is to protect value, whether that value is measured in monetary terms or in nonmonetary terms involving health, safety, reliability, social conditions, and many other aspects of performance. However, common risk applications avoid convert- ing these terms to dollars, and instead recognize that objectives can be noncommensurate.

872 Thekdi

Another key difference between risk manage- ment and CSR policy analysis is how future values are projected. The risk perspective is designed to protect current value against negative consequences associated with an event such as a system disruption. Conversely, traditional CSR policy perspective is designed to project the growth of value by using strategic investments. In other words, risk is focused on managing the potential loss of value using like- lihood of events, while CSR policies are focused on the growth of value using optimistic future projections. Although the optimistic projections are useful for planning and goal setting, they neglect to consider a wide variety of uncontrollable outside factors that can interfere with the ability to meet goals.

As applied to the Volkswagen example, its CSR policies aimed for the following high-level objectives:

Acting responsibly has always been part of our corporate culture. We understand social responsibility as being the ability to harmonise our business activities with the long- term goals of (a global) society.(7)

The CSR policy emphasizes concurrent objec- tives as measured by business activities (monetary or shareholder value) in addition to ecological and social concerns. This policy document did not discuss whether the goals were fully feasible, but instead supported the policy statements by describing ongoing CSR activities. Additionally, this policy document did not address factors that could impede the attainment of these goals, such as regionally specific fuel emissions standards, customer senti- ment, organizational culture, climate, fuel prices, competition from other vehicle manufacturers, and others.

In addition, there is no clear rationale for how these current goals of business activities and society are related. Can meeting the goals of a global society contribute to shareholder value? Can these business activities promote long-term goals of a global soci- ety? There is also limited statement regarding how to judge the relative importance of these juxtaposed goals, or how successful attainment of goals is mea- sured, or whether these goals are measured in com- parable units of measurement. A risk assessment and management approach to this policy development and implementation would require dedicated consid- eration of these topics.

Principle 2. Understanding uncertainties: Con- sidering uncertainty is vital for successful policy generation and implementation.(10) This uncertainty

exists in the inability to predict the outcome of policy investments for several reasons, for example, due to inability to model system outputs or due to statistical variability.(11) Additionally, performance can be influenced by dynamic conditions, such as climate, politics, extreme events, and others. De- spite the role of uncertainty in the effectiveness of investments, CSR policy making traditionally treats current conditions as unchanging and simply uses the policies to reflect future goals. A risk assessment and management approach for the policy selection process would promote an understanding of the most influential uncertainties, how the organization should respond to uncertain scenarios, and deter- mine which policy initiatives are robust to these scenarios.

As applied to the Volkswagen example, the se- lection and implementation of the CSR policy was strongly influenced by uncertainty, for example, in relation to whether external testing would detect the defeat device software, whether public sentiment in response to the information would influence share- holder value, and whether the defeat device software would be considered in violation of regional regula- tions. There were also uncertainties about how the organizational culture could have complied or hin- dered the meeting of publicly available CSR goals. Uncertainty could have been reduced by ensuring that the CSR policy was feasible and integrated into organizational culture, thereby allowing this factor to be somewhat controlled. Although it is unknown whether Volkswagen discussed what-if scenarios in- cluding worst-case scenarios when selecting and im- plementing the CSR policies, these practices may have also helped manage risk.

Principle 3. Understanding human and cultural factors: Risk management involves understanding how human and cultural factors influence policies. Similarly, CSR policy is aimed at influencing social and cultural conditions, such as community health and fair labor practices. However, these conditions may be difficult to measure over short time hori- zons and may not even be quantifiable. As the adage claims “what gets measured gets done,” the inability to quantify performance to objectives leads to inabil- ity to determine whether objectives are being met. As a result, those responsible for implementing poli- cies have little incentive to meet policy objectives. Although there is no standardized method for han- dling this issue, decision analytic methods commonly found in risk applications can help guide investments involving human and cultural factors. In addition,

Current Topics 873

risk methods such as stakeholder participation in risk governance allow for value judgments to be included during risk assessment, risk management, and com- munication for policy decisions.(12)

As applied to the Volkswagen case, high-level CSR goals included several sustainability, human, and cultural aspects. For example, CSR documenta- tion includes description of social-oriented programs, such as helping corporate clients reduce fuel usage, managing biodiversity, researching road safety, and interacting with the community. However, it is dif- ficult to quantify these factors and even more dif- ficult to accurately attribute any improvements to these specific programs. Although it is unknown how Volkswagen performed this valuation, policy deci- sions would have benefited from the use of stake- holder dialogue and expert elicitation methods that are supported by the risk field. For example, this would have included considering expert elicitation in the understanding of human and cultural uncertain- ties that could influence policy effectiveness. In addi- tion, this could have included the use of stakeholder and expert survey data to understand whether human and cultural goals are being met.

3. DISCUSSION

The risk approach introduced above offers sev- eral improvements to CSR policy development and implementation. First, it recognizes noncommensu- rate objectives and potential tradeoffs that may exist among shareholder value and social responsibility practices. Second, it allows for the recognition of uncertainties that may influence the effectiveness of policy initiatives. Third, it emphasizes the complex nature of policy modeling and investment while considering human and cultural factors.

In addition to the principles given earlier, the effectiveness of a risk-based CSR approach would benefit from additional safeguards. Organizations should compensate for the absence of regulatory oversight by reinforcing policy compliance internally. These policies should also have an active role within the strategic management process while encouraging stakeholder representation. After policies are imple- mented, there should be an auditing procedure in place to ensure that current operations are aligned with CSR strategy. Additionally, the policy docu- mentation should be clearly written and understood by responsible parties. Finally, CSR policies should be interpreted as a living document that remains rel- evant to the current environment.

4. CONCLUSIONS AND OPPORTUNITIES FOR FUTURE RESEARCH

This article has introduced a new research agenda by describing the critical need for a risk- based approach toward CSR policy analysis. The commonalities and differences between traditional risk applications and CSR policies can be leveraged to develop more specific guidelines. For example, guidelines can be developed to better understand policy functions, explore key uncertainties, and ad- vise investments for policy development and imple- mentation.

The three common risk principles provide pre- liminary guidance for this new research agenda. As there is growing interest for organizations to man- age social responsibility aspects within their overall strategies, the risk-based approach to CSR policy will serve as an effective method to protect organizations, communities, and the environment.

REFERENCES

1. Carroll AB. Corporate social responsibility evolution of a def- initional construct. Business & Society, 1999; 38(3):268–295.

2. Krauss C. Oil spill’s blow to BP’s image may eclipse costs. New York Times, 2010. Available at: http://www.nytimes.com/ 2010/04/30/business/30bp.html?_r=0.

3. Yoon Y, Gürhan-Canli Z, Schwarz N. The effect of cor- porate social responsibility (CSR) activities on companies with bad reputations. Journal of Consumer Psychology, 2006; 16(4):377–390.

4. Johnson HH. Does it pay to be good? Social responsibility and financial performance. Business Horizons, 2003; 46(6):34–40.

5. International Organization for Standardization. Guidance on social responsibility, ISO 26000:2010. Geneva, Switzerland, 2010.

6. Koplin J, Seuring S, Mesterharm M. Incorporating sustainabil- ity into supply management in the automotive industry—The case of the Volkswagen AG. Journal of Cleaner Production, 2007; 15(11):1053–1062.

7. Volkswagen. Responsibility Knows No Boundaries, 2012. Available at: http://www.volkswagenag.com/content/vwcorp/ info_center/en/publications/2013/01/Responsibility_knows_no _bounds.bin.html/binarystorageitem/file/VW_CSR_Weltweit _engl_eBook_DS.pdf, Accessed November 30, 2015.

8. Boston W, Viswanta A, Sloat S. Volkswagen Shares Fall on Fears of Bigger U.S. Penalty, 2016. Available at: http://www. wsj.com/articles/volkswagen-shares-fall-on-fears-of-bigger-u-s -penalty-1452006491, Accessed November 30, 2015.

9. Godfrey PC, Merrill CB, Hansen JM. The relationship be- tween corporate social responsibility and shareholder value: An empirical test of the risk management hypothesis. Strate- gic Management Journal, 2009; 30(4):425–445.

10. Aven T. Risk assessment and risk management: Review of re- cent advances on their foundation. European Journal of Op- erational Research, 2016; 253(1):1–13.

11. Paté-Cornell ME. Uncertainties in risk analysis: Six levels of treatment. Reliability Engineering & System Safety, 1996; 54(2):95–111.

12. Renn O. Stakeholder and public involvement in risk gover- nance. International Journal of Disaster Risk Science, 2015; 6(1):8–20.

Copyright of Risk Analysis: An International Journal is the property of Wiley-Blackwell and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use.