In-House Advisor: The shift from advising on legal risk to advising a business

As general counsel continue to play a bigger role in their companies, the focus is less on legal risk and more about providing legal advice about risk that helps businesses operate
In-House Advisor: The shift from advising on legal risk to advising a business
It's probably not a total surprise to anyone in the business community that legal risk may be poorly understood outside the office of the general counsel.

Indeed, a recent study by the UK's Berwin Leighton Paisner LLP (BLP) suggests that GCs could do a better job of communicating legal risk to their clients, and particularly to management and the board of directors. Just 50 per cent of risk and compliance professionals, apart from those in law departments, acknowledged a clear understanding of legal risk. To make matters worse, only 25 per cent of respondents at the CEO/director level could so acknowledge.

What is surprising is that the GCs' numbers are not all that impressive either, with just 73 per cent expressing confidence that they had a clear understanding. Other in-house counsel came in at an even less imposing 52 per cent.

To be sure, the survey sampled just 125 individuals. But it also drew responses from 11 different industry sectors across Europe, the Americas, Asia Pacific and Africa. Admittedly, that's not broad enough to draw definitive conclusions about how GCs and boards communicate, particularly in Canada. But what it does demonstrate is that there's considerable confusion about legal risk. “In many cases, it's not possible to distinguish legal risk from other risk, because legal risk involves a perspective on something that is happening in the real world of things like products and finance,” says Tobias Mahler, Associate Professor at the University of Oslo's Faculty of Law in Norway, who has written in numerous places on the subject of legal risk management. “So what companies need is a good interface between the responsibilities of non-legal risk managers and law departments.”


Indeed, some prominent Canadian general counsel suggest that the notion of legal risk is – putting it kindly – outdated.

“‘Legal risk' is a misnomer, because it doesn't capture risk in the real world,” says Montreal-based Daniel Desjardins, General Counsel at Bombardier Inc. “Nowadays, legal risk is nothing more than risk enterprise management, deciding who's got to manage what.”

By way of example, Desjardins points out that boards or risk management committees are not and should not be required to understand the intricacies of complex litigation. “What they have to do is make sure that there are the right processes to manage it,” he says.

Geoffrey Creighton, Toronto-based GC at IGM Financial Inc., is a former Canadian Corporate Counsel Association chair. He believes most GCs are moving away from characterizing issues in terms of legal risk.

“If you categorize something as purely legal risk, the board will say ‘leave that to the lawyers,'” he says. “Legal risk always has other components and dependencies, so that isolating it is not terribly productive. It's much more effective to integrate what a lawyer may perceive as purely legal risk within a broader business context.”

Creighton points to the risk involved in misrepresentations in the public market. “The lawyer can only do so much because he's depending on the information he's receiving from other groups,” he explains. “The trick is to have a process in place that ensures that the right people are transmitting and receiving the right information, which comes down to how you structure your risk framework.”

Aaron Emes in Torys LLP's Toronto office is of similar mind. “I wouldn't say there's a disconnect between GCs and boards,” he says. “The disconnect, where it exists, is in management and the board knowing every aspect of what the business is doing, so that they know the associated risks and can decide whether the company has an appetite for that risk.”

The discussion, then, is really about six degrees of separation: in today's world, the focus is not on legal risk, but on how to give legal advice about risk in a way that helps a company decide whether and how to operate a business. “In that way, giving advice about legal risk is no different than giving advice about any other risk,” says Ken Fredeen, Toronto-based General Counsel at Deloitte.

Matthew Whalley, the London-based Client Knowledge Manager at BLP, believes that lawyers don't represent legal risk as operational risk because legal risk has never been helpfully defined. (See “Defining Legal Risk,” Lexpert, Sept 2013.) “A board tends to look at incidents individually, when they're reported,” Whalley explains. “But directors are rarely paid to eliminate the root cause of risk, such as the aggregation of contractual risk.”

The lawyer's job, as Whalley sees it, is not only to help resolve the immediate dispute, but to point to the operational process, such as the way contracts are generally put together and approved, that created the general risk.

However one coins it, the ultimate inseparability of effective legal risk communication from reality emerges from Fredeen's experience during the Y2K crisis at the turn of the century. He was working at (now defunct) Canadian Airlines at a time when Y2K raised questions about whether planes should fly on New Year's Eve.

“Some of the lawyers were saying we should get a warranty from our technology suppliers, but they wouldn't give us one,” he says. “My problem, however, was making sure that management and the board, who were worried about whether the planes would fall out of the sky, understood the risks. But that wasn't just about warranties, it was also about understanding the assurances we received from our suppliers, which had nothing to do with the law or protecting ourselves legally.”

Canadian Airlines stuck to schedule; by contrast, Virgin Airlines shut down on New Year's Eve. “Virgin Airlines could have been given advice to close for a week on either side of New Year's,” Fredeen points out. “Advice like that may have avoided risk, but it wasn't very practical.”

Arguably, “advice like that” could have cost Virgin Airlines' General Counsel his or her job.

“If a GC is a ‘cry wolf' GC, she won't be there for very long,” says Ellen Bessner of Toronto's Babin Bessner Spry LLP. “Boards and management will always judge GCs on the practicality of their advice and whether the risks they're presenting are real.”

Inevitably, then, the advice GCs give borders on business advice. “GCs can stop at the legalities, saying yes or no, or giving a percentage in between, or they can go further and give advice in a broader business context,” Fredeen says.

For example, on one level GCs can stop at explaining compliance risks, but on another level the risks can be presented in a way that prioritizes such risks, helping the company to make sound decisions about deploying its compliance resources.

“If you're creating a risk compliance program on something that is not likely to occur, what's the point of spending the money?” Creighton asks.

A recent study conducted by the Association of Corporate Counsel engaged 1,200 CLOs in 41 countries. The ACC Chief Legal Officers 2014 Survey concluded that “CLOs are directly responsible for adding value and shaping the future of their organizations” even as reducing risk remains among their top concerns.


“CLOs continue to take on more responsibility, with more than 76 percent of CLOs reporting a greater level of involvement in corporate strategy development,” the authors write. “Not only do CLOs report spending more of their time in a consultative leadership role, they also prefer it. Eighty-one percent of CLOs indicated they would prefer to spend the majority of their time advising executives and participating in strategic corporate issues.”

But that's not always possible.

“On the other hand, 76 percent of CLOs prefer to spend their time on strategy development and execution, but just 57 percent of CLOs were able to concentrate on that area,” the ACC concludes.

The failure of GCs to live up to their full potential may lie in a lack of sufficient resources to explore that potential. In some cases, however, companies prefer to keep their GCs in what amounts to a straitjacket.

“GCs in the US are expected to give business advice and do so with regularity, but many Canadian companies are still in a time warp, deciding whether the GC is a strategist or a technician,” Fredeen says. “The difference in how US and Canadian companies have answered that question so far has to do with the comparative respect and understanding these organizations afford to their GCs in the two countries.”

Whether or not companies want more from their GCs, what is becoming apparent is that regulators' expectations are high. In early January, Germany's financial regulatory body issued a report all but suggesting that Deutsche Bank fire General Counsel Richard Walker in the wake of the Libor scandal involving the alleged manipulation of the inter-bank lending market in Europe.

The report singled out Walker, a member of the executive committee, as no less than an example of the board's failure to effect cultural change at the bank following the scandal. Effecting cultural change, it must be noted, is not likely on the curriculum of any law school in the world.

The overriding trend, then, is towards the broader role for General Counsel. “Although the role of the GC has continually evolved, the changing nature of risk management in many industries demands that they provide even more direction,” note the authors of “A Framework to Help General Counsels Manage Increasing Risks,” which first appeared in Deloitte's Risk & Compliance Journal.

In that context, a good GC is also one who is a generalized expert in his or her client's business. On close analysis, this requirement isn't all that different from what's expected of independent directors: each may have a specific expertise but is expected to bring a generalized knowledge of the company's business to the board table.

There's another message here: GCs can't do it alone. Presenting sound legal advice about risk in a way that helps a company decide whether and how to operate a business requires contributions, or at least buy-in, throughout an organization.

“The huge challenge that all GCs have is get the C-suite and board to recognize that the obligation to lay the proper information on the legal department's desk is a company-wide obligation,” Bessner says. “In order to present risk properly to boards and officers, GCs need to get understanding and cooperation from places other than boards.”

In other words, what propels the proper communication of legal risk (in the broad sense) is, in Whalley's words, “communicating with front-line people by way of constant feedback that enforces behavioural change.” But a November 2012 KPMG study suggests it's not happening.

“The appetite for developing relationships outside the legal department overall appears to remain quite narrow and concentrated around a governance role,” write the authors of “Beyond the Law: KPMG's global study of how General Counsels are turning risk to advantage,” which surveyed 320 General Counsel in 32 countries across regions and industries.


Donna Epps, a partner with Deloitte Financial Advisory Services LLP in Dallas, Texas, has suggested that companies develop a “risk-intelligent” framework that encompasses a common approach to risk governance and management. Such a framework recognizes that all risks, including legal risks, are addressed across organizational silos. “GCs have the enterprise-wide perspective needed to use this approach effectively with regard to legal risks,” Deloitte writes. “Risk intelligence also holds that risks are interrelated and interactions among risks can amplify risk.”

Whether or not a company chooses to go with the risk-intelligent approach or another framework, Bessner cautions that the GC, albeit an important member of the risk management team, should not be the one putting the team together.

“It should be the CEO or COO, because it's a way of demonstrating that they care about risk,” she says. “If it's the GC who puts the team together, she will be treated as a naysayer, and GCs want to be very careful that they're not perceived that way.”

At IGM Financial, Creighton's legal team meets with diverse groups within the company to brainstorm “all the things that can go wrong,” as he calls them. These meetings result in the risks being aggregated, ranked and populated.

“For example, someone from another department may opine that our warranty terms are far too generous, or the PR department may suggest that we don't have a rigorous enough process to monitor public disclosure,” Creighton says. “It doesn't matter how the risk created is defined – though in my experience it's harder to get buy-in when you call something legal risk – as long as someone is taking care of it.”

The upshot is that GCs and legal departments are undergoing, or will have to undergo, a metamorphosis from what has traditionally been a risk-averse posture. In Deloitte's “risk intelligent enterprise,” that means moving to an approach that balances the oft-competing needs to preserve assets and create value.

“[A risk-averse] posture may result in the legal function being excluded from information flows or losing its place at the table, either of which may undercut its effectiveness,” Deloitte writes in “The Risk Intelligent general counsel: Discard the compass and get a GPS.”

In the authors' view, GCs should be widely involved in strategic and operational decision-making. “They also should be there to identify legal and regulatory risks associated with new products and services, business partners, and market initiatives (particularly in foreign jurisdictions) and to help develop ways of mitigating and managing these risks,” Deloitte adds.

So how well have GCs embedded themselves in the business decision-making processes at their organizations?

At the outset, it's important to note that there's a real gap between the progress Canadian GCs are making and the results they believe they can achieve in an expanded role. A 2013 KPMG survey of Canadian General Counsel found that 76 per cent of respondents were more involved in the formulation of business strategy than they were five years ago, but the global study cited earlier concluded that almost all North American counsel (96 per cent) believed that their involvement helped to reduce the number of disputes and regulatory issues their companies face.

“GCs are making significant progress in playing a bigger role in their companies, but they still have some way to go to realize their full potential as business leaders,” conclude the authors of the global study.

Otherwise, some 47 per cent of Canadian General Counsel sat on their companies' boards and another 35 per cent reported directly to the board. “Where GCs have already won this influence, they have learned to present their legal and regulatory knowledge in powerful, practical commercial language that Boards recognize and appreciate,” KPMG states. “Moreover, GCs bring a different perspective, which complements the skills of others who advise senior decision-makers.”

IGM Financial Inc.'s GC Geoffrey Creighton puts it somewhat more succinctly, saying, “Your legal knowledge is just table space in the room — until you establish how your expertise is relevant to the organization.”

LAYING THE FOUNDATION: THE GC AS COMMUNICATOR

The role of the GC is changing from legal advisor to business and strategic advisor. Communicating effectively with the board in this expanded role requires a fulsome appreciation of this evolution. Here is a summary of what KPMG calls its “Waypoints for General Counsel” seeking to operate and communicate expansively and effectively:

> Engage directly with senior decision makers.
> Work closely with the people dealing with the company's
risk and governance agenda.
> Communicate with senior decision makers in the
commercial language they use.
> Put dispute avoidance before dispute resolution.
> Analyze past incidents to anticipate future risks.
> Learn the business and its risk appetite.
> Give advice in a commercial context.
> Manage the creation of contracts and relationships.
> Adapt to different regulatory environments.
> Be flexible in resolving disputes.
> Treat dispute resolution as a strategic decision.
> Build relationships across the business and
work collaboratively.
> Don't underestimate the impact of cultural differences.
> Spend time embedded in other parts of the business.
> Stay up to date with new technologies affecting the business.

Firm(s)