Sustainability Report

Risk Management

Week 10 Workshop

MBA402 Governance, Ethics and Sustainability

COMMONWEALTH OF AUSTRALIA Copyright Regulations 1969

WARNING This material has been reproduced and communicated to you by or

on behalf of Kaplan Business School pursuant to Part VB of the Copyright Act 1968 (the Act).

The material in this communication may be subject to copyright under the Act. Any further reproduction or communication of this material by you may be the subject of copyright protection under

the Act.

Do not remove this notice.

2

High Stakes Dice

Play Video

• What does French mathematician Blaise Pascal mean when he says:

Small Group Discussion

We sail in a vast sphere, ever drifting in uncertainty, driven from end to end.

• In groups, determine a fair allocation of the prize money between Luca and Leonardo.

Luca Pacioli, Franciscan friar and mathematician, has a problem. He and his friend Leonardo Da Vinci are playing a game of dice in the convent courtyard. The victor after five rounds of dice will win 10 florins. After three games Leonardo has won one round and Luca has won two.

A monk interrupts the game and warns the abbot is on his way. Luca and Leonardo quickly hide the money and dice as gambling is strictly forbidden in the convent. Luca declares himself the winner and claims the 10 florin prize. Leonardo concedes that Luca was winning when the game was interrupted but argues he still could have won as there were two games remaining.

Small Group Challenge Milan, Italy 1494

Pacioli’s Puzzle

• Pacioli’s puzzle remained unsolved for two centuries until Blaise Pascal considered all the possible outcomes and devised a triangle that determined the gambler who was ahead two games to one would win three times out of four, and was therefore entitled to three quarters of the prize money.

Pascal’s Triangle

• What are the odds a couple expecting their first child will have a boy?

• ½ odds a boy ½ odds a girl

Pascal’s Triangle • If the couple have

two children, what are the odds of them having two boys, or a boy and a girl, or two girls?

• ¼ odds two boys ½ odds boy and girl ¼ odds two girls

Pascal’s Triangle

• What are the odds a gambler leading two to one in a best of five dice game will win?

• ¼ odds lose (lose) ½ odds win/lose (win) ¼ odds win (win)

• ¾ odds of winning

Probability

• Pascal’s solution to Pacioli’s puzzle meant that people could, for the first time, make decisions and forecast the future with the help of numbers.

• He established the foundations of the theory of probability and its usefulness not just in explaining the past, but also in predicting the future.

Risk

• A risk is a probability or threat of damage, injury, liability, loss or any other negative occurrence that is caused by external or internal vulnerabilities, and that may be avoided through pre- emptive action.

Principle 7

7. Recognise and manage risk Companies should establish a sound risk framework and periodically review the effectiveness of that framework.

Risk Management

• Risk management is the coordination of activities to direct and control a company with regard to risk.

• A risk management framework provides the foundations for designing, implementing, monitoring, reviewing and continually improving risk management throughout the company.

Risk Management Roles • It is the role of management to design

and implement the risk management framework and to ensure the company operates within the risk appetite set by the board.

• It is the role of the board to set the risk appetite for the company, to oversee its risk management framework and to satisfy itself that the framework is sound.

Who is the True Enemy?

Play Video

• What does French novelist Victor Hugo mean when he says:

Small Group Discussion

Caution is the eldest child of wisdom.

• In groups, decide whether or not Vasili should authorise the nuclear strike and provide an explanation for your decision.

Vasili Arkhipov, second-in-command of the nuclear-missile submarine B-59, has a problem. Although the B-59 has had no contact with Moscow for a number of days, a series of violent explosions in the sea above them indicate the Cuban Missile Crisis has escalated into a full-scale war between the Soviet Union and the United States.

Submarine Captain Valentin Savitsky decides to launch a nuclear strike against the United States but requires authorisation from both Vasili and political officer Ivan Maslennikov.

Ivan agrees with Valentin and authorises the launch.

Small Group Challenge Caribbean Sea 1962

Risk Recognition

• A failure by a company to recognise risks can adversely impact not only the company and its shareholders, but also many other stakeholders, including employees, customers, suppliers, creditors, consumers, taxpayers and the broader community in which the entity operates.

Recommendation 7.1 7.1 The board of a listed entity should:

(a) have a committee or committees to oversee risk, each of which: (1) has at least three members, a majority of whom are independent directors; and (2) is chaired by an independent director,

Recommendation 7.1

7.1 and disclose: (3) the charter of the committee; (4) the members of the committee; and (5) as at the end of each reporting period, the number of times the committee met throughout the period and the individual attendances of the members at those meetings; or

Recommendation 7.1

7.1 (b) if it does not have a risk committee or committees that satisfy (a) above, disclose that fact and the processes it employs for overseeing the entity’s risk management framework.

Board Committees

• All directors are equally responsible for the governance of the company.

• Board committees can provide independent and objective corporate governance supervision.

• Board committees prevent management domination of board decisions.

Risk Committee

• A risk committee can be an efficient and effective mechanism to bring the transparency, focus and independent judgement needed to oversee a company’s risk management framework.

Risk Committee • A risk committee makes

recommendations to the board in relation to: o the adequacy of the company’s

processes for managing risk. o any incident involving fraud or other

break down of the company’s internal controls.

o the company’s insurance program.

• What does German statesman Johann Wolfgang von Goethe mean when he says:

Small Group Discussion

Things which matter most must never be at the mercy of things which matter least.

Consider the following examples of five risks faced by international students studying in Australia:

1. Homesickness 2. Abduction and murder 3. Racist attitudes and remarks 4. Workplace exploitation 5. Failing MBA402

Small Group Challenge

• In groups, create a system for calculating the level of these risks and others faced by international students studying in Australia.

Risk Assessment

• A risk is the amount of harm or damage that can be expected to occur due to a specific event.

• The level of risk can be calculated by estimating the probability that the specific event will occur, and the severity of the harm or damage if it does.

Risk Assessment Matrix Negligible Marginal Serious Critical

Certain High High Extreme Extreme

Likely Moderate High High Extreme

Possible Low Moderate High Extreme

Unlikely Low Low Moderate Extreme

Rare Low Low Moderate High

Risk Assessment Matrix Negligible Marginal Serious Critical

Certain High High Extreme Extreme

Likely Moderate High High Extreme

Possible Low Moderate High Extreme

Unlikely Low Low Moderate Extreme

Rare Low Low Moderate High

Student Risk Assessment Negligible Marginal Serious Critical

Certain Homesick

Likely Racism

Possible Exploitation

Unlikely Failing MBA

Rare Murder

Recommendation 7.2 7.2 The board or a committee of the board

should: (a) review the entity’s risk management framework at least annually to satisfy itself that it continues to be sound and that the entity is operating with due regard to the risk appetite set by the board; and (b) disclose, in relation to each reporting period, whether such a review has taken place.

Risk Management Review

• When disclosing whether a review of the company’s risk management framework has been undertaken, the company should also disclose any insights it has gained from the review and any changes it has made to its risk management framework as a result.

• What does English political and military leader Oliver Cromwell mean when he says:

Small Group Discussion

Put your trust in God; but be sure to keep your powder dry.

• In groups, identify a business opportunity for Edward.

Edward Lloyd has a problem. The failure of his business ventures in Wales force him to move to London to start all over again at 41 years of age. He sits silently in a bustling coffee house in Tower Street listening to the lively gossip of sailors, merchants, and shipowners all around him.

A table of shipowners to his left discuss the perils of the sea trade; a friend of theirs faces financial ruin after a storm sent his small fleet of merchant vessels to the bottom of the Atlantic.

A table of merchants to his right discuss the lacklustre state of the economy and the many challenges currently faced by investors and businessmen seeking new opportunities to generate wealth.

Small Group Challenge London, England 1688

Risk Management

• Once risks have been identified and assessed, all techniques to manage them fall into these four major categories: 1. Avoidance (eliminate, withdraw from) 2. Reduction (optimise – mitigate) 3. Sharing (transfer – outsource or insure) 4. Retention (accept and budget)

Risk Management Scenario Risk management

A start up is concerned about the financially devastating impact on the company should one of its key executives suffer a major illness or death

Insurance Key person cover

A bank wishes to broaden its products to include derivatives. A business plan identifies the proposal as being very high risk

Avoidance Proposal is abandoned

A construction company is concerned by the potential injuries and health and safety risks their construction workers could be exposed to

Reduction Safety equipment is provided

A pharmaceutical company wants to create a new drug but is mindful their expensive research and development program may produce nothing

Retention Risk is accepted

Internal Audit

• Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation's operations.

Recommendation 7.3 7.3 A listed entity should disclose:

(a) if it has an internal audit function, how the function is structured and what role it performs; or (b) if it does not have an internal audit function, that fact and the processes it employs for evaluating and continually improving the effectiveness of its governance, risk management and internal control processes.

Internal Audit Function

• An internal audit function can help companies accomplish their objectives by bringing a systematic, disciplined approach to evaluating and continually improving the effectiveness of the company’s risk management and internal control processes.

Internal Audit Reporting

• The head of the internal audit function ideally should have a direct reporting line to the board or to the board audit committee to bring the necessary degree of independence and objectivity to the role.

Playtime

Week 10 Workshop

MBA402 Governance, Ethics and Sustainability

Derek Chipperfield, corporate lawyer and personal friend, looks you up and down after your cardio capoeira class.

“You seem tired,” he says. “Gee, thanks for that Chip,” you reply, “I guess running Australia’s

biggest ever corporate scandal will do that to a person. Besides, you don’t look so fresh yourself.”

“I’m burning the midnight oil just getting my head around the corporate solvency reforms.”

“The what?” you ask. “The corporate solvency reforms, you know, the Australian

Government’s National Innovation and Science Agenda?” Derek realises you have no idea what he’s talking about and roars with

laughter. “You must be the only CEO in the country behind the eight ball on this one.”

“Shut up,” you smile, “and tell me what changes these reforms are going to make.”

“I was up all night researching the National Innovation and Science Agenda and trying to figure out what they mean for Meridian Group until something very important occurred to me.”

“What was that?” Veda asks. “The new NISA initiative is not the problem. Meridian’s lack of a sound

framework for recognising and managing risk is the problem.” Veda seems a little disgruntled, “The directors of this board each have a

great wealth of knowledge and experience when it comes to troubleshooting serious business issues.”

The other directors all appreciate the rare compliment from their leader. “I’m not questioning this board’s ability to troubleshoot business issues,”

you explain, “I’m questioning Meridian’s lack of infrastructure for identifying threats and taking pre-emptive action before they become serious business issues.”

None of the directors seem to understand what you are saying. You need to develop a risk management plan the board will understand

and accept…

Group One In your group, prepare a proposal for a risk management plan Focus on the following:

• Explain the concept of risk • Discuss Principle 7 of the ASX Corporate

Governance Principles and Recommendations • Outline the respective roles of the board and

management in relation to risk

Group Two In your group, prepare a proposal for a risk management plan Focus on the following:

• Explain the importance of risk recognition • Discuss Recommendation 7.1 of the ASX Corporate

Governance Principles and Recommendations • List three things the risk committee makes

recommendations to the board about

Group Three In your group, prepare a proposal for a risk management plan Focus on the following:

• Explain the concept of risk assessment • Discuss Recommendation 7.2 of the ASX Corporate

Governance Principles and Recommendations • Propose three things Meridian could do to

implement the Recommendations

Group Four In your group, prepare a proposal for a risk management plan Focus on the following:

• Explain the concept of internal auditing • Discuss Recommendation 7.3 of the ASX Corporate

Governance Principles and Recommendations • List four things Meridian can do to manage

identified risks

Group One Group Two

Group Three Group Four

• Present your proposal for a risk management plan to the board of directors.

“Winston Churchill described history as one damned thing after another. Since I began in the role of CEO at Meridian we have had to deal with a staff walkout, a publicity crisis, a board restructure, a parliamentary inquiry, an ASIC investigation, a data security breach, and a shareholder association campaign. One damn thing after another,” you say.

“Did you really think it would be easy given the state the previous board left the company in?” Veda asks.

“I never expected things to be easy,” you reply, “but I didn’t expect them to be this difficult, either. We just keep getting broadsided by problems that could have been avoided or at least mitigated had we had a sound framework in place for recognising and managing risk.”

Veda takes a moment to consider your comments. “What did you have in mind?” she asks.

Veda finishes scribbling some notes in an exercise pad. “Our CEO has proposed to us a risk management plan to better recognise

and manage the risks we face as a company. We will now take a vote as to whether we implement the proposed plan. All those in favour of the plan please raise your hands. Thank you. All those against, please raise your hands. Thank you.”

She tallies the votes. “The board resolves to…”