Here's how firms can learn from Murdoch

At our last corporate Governance meeting on 19th July, we briefly talked about future of Compliance and risk management. This article appeared in the Evening Standard that afternoon.

Anthony Hilton

19 Jul 2011

Think of the fortune they must have spent on risk control at News International down the years and look at the mess the company is in now. It is hard to believe they got value for money.

Or look at BP still reeling from the oil spillage in the Gulf of Mexico; Cadbury, which was badly hit long before the Kraft takeover by a scare over salmonella in its chocolate; Shell, with its inflated reserves; Airbus, and the problems thrown up in the assembly of its superjumbo. No analyst ever complained about a lack of financial sophistication in these companies or about their inadequate financial controls.

But all were hit by the kind of reputational disaster that now batters Rupert Murdoch's empire. And like Murdoch, no one at the top seems to have seen it coming. Whatever risks the boards thought they were measuring or had convinced themselves they understood and were on top of, they were the wrong ones.

A bit of timely research published this week by a team from Cass Business School gives some insight into why. Having made a list of seemingly unassailable companies that all came unstuck, the team of four - Derek Atkins, Anthony Fitzsimmons, Chris Parsons and Alan Punter - set out to discover what if anything these diverse businesses had in common, and in particular whether there were any common underlying weaknesses that made them prone to a crisis, and for that crisis to escalate into a disaster.

Lord (Paul) Myners said the other week that behind every failed company was a failed board, and broadly that is what this research found too.

However, it is more subtle and goes rather deeper to isolate seven potential areas of
danger, none of which seem exceptional, but all of which sadly seem to need repeating.

They warn for example that boards may simply not be sufficiently competent or, even when competent, too inclined to talk about reward and opportunity and unwilling to engage with the less exciting issues of reputation and licence to operate.

They found disaster was also brought about by poor leadership, particularly when it creates a culture where lip service is paid to ethical rules but the employees all live in a parallel universe where they know all that matters is performance. This pressure may be added to by inappropriate incentives - either explicit ones, where people get paid massive bonuses, or implicit ones, where everyone knows the unspoken rule that only those who deliver can expect to keep their jobs, let alone get promoted.

They note that boards and companies kid themselves with ambiguous mission statements. Cadbury is cited in the report for adopting a slogan "performance driven; values led", which begs the question of which comes first. Let's just say that employees under pressure to reduce waste changed Cadbury's tolerance of salmonella from "zero" to "low". An outbreak and massive product recall followed a few months later.

Risks also arise from businesses which are just too complex - obviously a problem with banks, but an insufficiently appreciated issue in most companies which straddle a range of markets and geographies.

Boards are fooled into believing that because they can Skype anywhere in the world, they actually know what is going on there. They would do the job better if they realised more readily that they often do not even know what is happening under their nose. In the words of joint author Fitzsimmons: "Too many boards live in a rose-tinted bubble."

The main problem at the root of most of this is communication. Conventional risk-control systems are too narrow in what they cover and - a brave finding this for Airmic, the report's sponsor and the trade association for risk professionals - the people manning the systems are too low status to make their voices heard at high level. This is particularly true when it is those upper echelons that are the cause for concern.

In essence, risk systems tend to be numbers-based, and cover potential hazards or current operations. They can cover hard data, technical know-how, systems and strategies. What they don't do is handle softer issues such as management style, employee motivation, shared values and corporate culture. They are hopeless at behavioural issues.
So for that matter are male-only boards. There are suggestions a board with a strong female presence is far more likely not to be so blinkered.

This all harks back to a point made in this column before. The trouble with accounting, performance measurement and risk control - and indeed the teaching of business schools - is that they treat companies as if they are mechanical. They assume broadly that they are machines which, for a certain level of inputs, will deliver a predictable level of output. But the greater truth, particularly in the modern era where talent is the big differentiator, is that companies are collections of people, and they are as much biological as mechanical.

Biological behaviour is much harder to predict and control - but somehow businesses are going to have to learn how to do it, and also to learn how to speak truth unto power.

(Published in The Evening Standard, Tuesday 19th July 2011)