Quantifying Legal Risk: A Method for Managing Legal Risk

Return and risk are the two major dimensions of business decisions. While return is a wellidentified factor, risk is less understood. This analysis addresses risk management issues within a firm, specifically with respect to litigation because legal costs can range from 3% to 10% of businesses' annual revenues.1

Here is how the Committee of Sponsoring Organizations of the Treadway Commission (COSO) described enterprise risk management (ERM) in 2004:

"Enterprise risk management is a process, effected by an entity's board of directors, management and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives."2

This definition can be broken down into the following elements:

A process: A process is ongoing; it is something that has its own momentum but that must be supported by the decision makers in the firm and (if the process is useful) will become a part of the firm's culture. A process, however, is not merely a series of tasks, nor is it just a project (although it may be tested as a project). ERM can only become useful and successful if it is viewed as a process-a way of doing things-not just as a way to fix a problem (whether as a quick fix or a slow fix).

Effected by an entity's board of directors, management, and other personnel: The people who make the decisions in a firm must be involved in ERM and must actively support the plan. In addition, there must be deep support and involvement from throughout the firm. Just as making a profit is "effected by an entity's board of directors, management and other personnel," so, too, is enterprise risk management.

Applied in strategy setting and across the enterprise: Enterprise risk management is not a tactic-it is a strategy. As a strategy, it will have application throughout the firm and will be one of the key factors that points the firm in whatever direction its overall business planning intends for it to go.

Designed to identify potential events that may affect the entity: A fundamental part of enterprise risk management is an analysis to determine the activities and drivers of activities that affect the firm. Such an analysis is not something one person can be told to complete before next Friday. (One person may indeed have that responsibility, but it will take information from throughout the firm to identify these events.)

Manage risk to be within its risk appetite: To manage risk means to control risk, not to handle it by dancing to the tune played by risk. The whole point of enterprise risk management-the whole justification for its cost in time, money, and other resources-the only reason it has useful value-is to put the firm into the position of actually managing, or controlling, its risk. The risk appetite in any firm (the range of risk it can accept as what it will live with) is never going to be large. Even a firm on the cutting edge would prefer to have as little risk as possible, but some activities will always be risky, and some risk may have to be accepted because its causes are difficult to identify and/or do much about.

To provide reasonable assurance regarding the achievement of entity objectives: This is why a firm wants to control its risk-so it can focus on meeting the goals of its business plan.

ERM, therefore, is a strategic process that must be supported properly throughout the firm and that has the fundamental purpose of giving a firm the ability to control its risk so it can focus on its business.

RISK MANAGEMENT FROM A LEGAL PERSPECTIVE

Lawyers do not necessarily look at the world in the same way as others, including business people. This is also true for risk management. The legal perspective of risk management is often seen as a method for protecting the firm-as a plan for putting out fires. Although there is nothing wrong with protecting the firm, risk management is not really about protection. It is about making changes within the firm that lead to an ability to control risk. The focus on risk management is finding a way to control risk so more of the firm's resources can be used to further the firm's business planning.3 A result of all this may mean "protection" for the firm, but if all you want is protection, you really do not need to change much; you could just stand guard and watch carefully.

Companies need to meet certain minimum standards in order to sell their services (quality assurance) or their products (quality control). The common goal is for the firm to have services or products that make it competitive and bring it lots of customers. From a legal perspective, quality assurance and quality control are also great methods for preventing breach of contract (by meeting quality standards or specifications) and for avoiding negligence, especially professional malpractice (by making sure professionals are, and remain, qualified).

Compliance planning has become a legal necessity for many firms. It is all about making sure the firm complies with state and federal law, particularly the regulations of agencies that license, certify, or otherwise have the authority to seriously affect the firm. Aspects of compliance planning are similar to enterprise risk management, but the two are different. Compliance planning is strictly about developing a plan to ensure the firm complies with the law on particular issues. ERM is about controlling risk.

In our model, developing a compliance plan is a part of enterprise risk management in order to carry out the objectives learned from the risk management analysis (sometimes referred to as a legal audit).

A PROCESS FOR RISK MANAGEMENT

Basically, our model presents a method for:

* Getting to know the business and its activities.

* Focusing this information into identifying where risk exists.

* Quantifying or giving weight to the risk.

* Making choices based on most to least risky, or whatever method the firm chooses; the risk areas will be quantified, and the drivers or root causes of the legal risk in the various activities will be determined.

* Finally, developing a plan for managing the risk.

The model could be used for a comprehensive firmwide audit. It could also focus on a department, some unit of the firm, or specific activities or issues within the firm. This model will have full value only if it can be adapted to fit the needs of a particular company. Here is an outline of the risk management process:

1. Compose a model of generic value chain4 for the business in order to organize gathering comprehensive information about the company (see Table 1). The purpose is to get to know the firm, identify at least some initial causes of risk, and/or to highlight areas or activities where risk might be more prevalent.

2. Use the value chain information to prepare the Worksheet for Determining Areas of Risk from Value Chain Activities (see Figure 1). Next to each entry on the worksheet, make notes about the things that cause risk, however slight or great. The purpose is to determine what activities are contributing to the risk in the areas identified on the value chain model.

3. The information from the Worksheet is then analyzed using the Model for Determining and Evaluating Causes of Risk from Support and Primary Activities. The goal is to quantify how risky a particular activity is, at least compared to other activities of the firm. (Table 2-A describes the process, and 2-B shows scaling that could be utilized.) For each legal risk source (activity/driver) that is identified in a topic area, managers or advisors can assess the likelihood of occurrence with 1 being the lowest probability and 10 being the highest. In other words, if someone believes that this source has a 90% probability of occurring, he or she would score it as 9. Next, the severity of the risk shall be assessed.5 Multiply Column 2 times Column 3 to get the composite score in Column 4. The scores for various risk sources are then quantified on a scale of 1 to 100.

4. The information in the Model is then used in the Model for Determining and Evaluating Drivers of Specific Causes of Risk (see Table 3). The firm can choose which activities it wants and in what order it wants to do this analysis, perhaps based on level of risk in each activity. The data-gathering problem is analogous to a cost-collection problem that is solved via the activity-based costing (ABC) analysis of Robert Kaplan.6 (It is worthwhile to note that the COSO "decomposition of risk" concept fits consistently with the ABC analysis accounting method.)

This can be a major plus because businesses understand ABC fairly well. While the ABC approach is not an exact science, nor is it flawless, the activityidentification process can lead to improvements with successive iterations.

5. As appropriate, compliance planning (however formal or informal) can be done to manage identified legal risk. Plans can range from very specific to very general and can be formal or informal, complex or simple. The best plans, however, tend to be workable, practical, and have as little disruption as possible (see Table 4).

PITFALLS TO AVOID

How Should "Success" Be Defined?

The definition of "success" from managing legal risk must ultimately be subjective because the nature of legal risk is subjective.7 This is not to say there are no common causes and drivers of legal risk, just as there are common causes and drivers of cost, but how these causes and drivers affect a specific firm and its activities can be defined only by the firm.

Several factors, though, can help companies evaluate success:

1. Clarity in Understanding the Firm's Legal Risks. The better a firm understands the legal risks it must face, the better it will be able to plan to avoid, or at least to minimize, these risks. Even when the firm determines that it must engage in certain activities that it identifies as having a high legal risk (due to the inherent high risk of some activities), it will have better knowledge about the true nature of the risk and can plan to be prepared if actual problems develop. This would also be true for risks that could be reduced but that the firm is not able to deal with at the time (because of lack of sufficient capital or other resources, for example).

2. Recognition that Avoiding All Legal Claims Is not Possible. Although it is reasonable to conclude that a reduction in legal risk should result in fewer legal claims, it is never possible to avoid the necessity of being prepared to defend against a claim. Some people may file a lawsuit of questionable merit because of a perception that the targeted firm will settle the case instead of defending it, as long as the cost of a settlement is cheaper than the cost of defense. If the firm settles a lawsuit, it does not matter whether or not the underlying claim was frivolous or had merit; the act of settling precludes any legal ability to pursue the matter any further. Although under Rule 11 of the Federal Rules of Civil Procedure and corresponding state rules, making frivolous claims violates both federal law and the law in all 50 states, a claim cannot be ignored just because it is seen as being frivolous. A legal claim is considered frivolous when the plaintiff has little or no chance of success, but the determination of whether a plaintiff's case is frivolous probably cannot be made merely by examining the complaint. Instead, a court will have to allow the case to develop until enough facts have been established and the legal arguments clearly show that the case has no merit. Therefore, it is necessary to incur expense in order to establish whether a claim is frivolous or even whether a claim with merit will be unsuccessful against the firm. This situation cannot be avoided by managing legal risk.8

3. Measuring Dollars Alone May Be Inadequate. A firm may very well incur additional cost when implementing a system to manage legal risk, and there probably will be ongoing cost in maintaining this system. In addition, legal risk analysis of certain prior revenuegenerating opportunities may result in the decision not to pursue them in the future. Expenses, opportunities not taken, and the need to still obtain legal opinions at times will all result in a financial impact on the firm. Overall, legal risk analysis may save the firm money, but the goal should not be to merely save money. Knowing when and where to put dollars and other resources to deal effectively with legal risk analysis must be considered a factor in defining success instead of merely measuring the financial impact on the firm.9

4. Ease of Communication about Legal Risk. Quantifying legal risk will allow communications about the causes and drivers of risk, as well as the level of risk for each activity that has been evaluated, to have a common basis for meaning throughout the firm. This can be especially useful for larger firms and for firms with more than one facility. It can also provide a common basis of understanding for firms with facilities and interests in different legal jurisdictions, nations, legal systems, and cultures. Increased clarity in communications about legal risk issues throughout the firm can be an important factor in measuring success.

"Success" ultimately means that a firm has found a way to identify and manage risk. The determination of whether success has been achieved, therefore, requires a broad analysis. ERM results in achieving factors of success instead of a simple and misleading "examine the bottom line" approach. In addition, avoiding these other pitfalls will further enhance a firm's ERM successes.

Avoid Form Over Substance

It will prove to be a waste of time merely to go through the motions of risk management. As with anything, doing something for the sake of doing it, focusing on how something looks, developing something only to say "we have one," or creating a good process only to place it on the shelf with all the other dusty form-oversubstance plans will be the same as having done nothing at all. ERM is a process that must be implemented.

It Is Only for Big Companies

No it is not! Too many textbooks, articles, presentations, and other types of resources designed for business focus on large businesses to the exclusion of small ones (other than an occasional contrast to the local "mom and pop" business). This can lead to the idea that whatever comes along is supposed to be used by big business and that small business does not have to pay much attention or at least can wait until the "kidsize" version comes along. This may be true for some ideas, but not for legal risk management. No firm is too small to be sued, face other legal problems, or have risks that can eat up its resources and keep the owner awake at night. No firm, therefore, is too small to use this model for legal risk analysis. In fact, it is not all that difficult or expensive for a small firm. Any size firm can benefit.

Do not Just Create a Bureaucracy

While legal risk management takes time and, depending on the issues involved, can result in detailed planning to control the identified risks, it should be kept as simple as possible at all times. Do not create a bureaucracy to handle risk management issues. Do not create a bunch of "stuff." Risk management is about controlling risk, not about making another complicated procedure with accompanying forms. (Think of it like a good coffeemaker: It just makes coffee, and it does not do 5,000 other things that nobody really wants anyway or even knows about.)

Do not Prove Preconceived Ideas

It may be normal to have an idea about what is causing certain types of risk or an idea about how to control legal risk effectively. Fine. Do not, however, gather information simply to prove (or even disprove) any preconceived ideas. Just as a good research project sets out to test instead of prove a hypothesis, effective legal risk analysis must be used gather information for analysis-wherever that analysis leads.

Do not Focus on Blame

Legal risk analysis can determine how a particular person, group, or department (whether an owner, manager, or part-time high school student employee) may be a driver of one of the causes of legal risk. The response is to change how that person is doing things, not to blame them for problems. Risk analysis is not a witch hunt or an effort to identify and round up those among "us" who are really "them." Legal risk analysis is about developing a process that will allow the firm to control risk; it is not about placing blame.10

Keep the Purpose in Focus

No matter what comes up at any point in risk management, remain focused on its purpose: a strategic process that must be supported properly throughout the firm and that has the fundamental purpose of giving a firm the ability to control its legal risk so it can focus on its business.

EFFECTIVE LEGAL RISK MANAGEMENT

In this article we outlined the components of a process for identifying, describing, understanding, evaluating, and quantifying a firm's legal risk. The plan is consistent with both the enterprise risk management model (COSO 2004) and models for conducting legal audits11 and legal compliance.12

By applying a legal risk management model to the value chain, the framework makes it possible to separate legal risk management into the different aspects of a firm's activities. Thus, the organization can make the legal risk management model more feasible to implement and more effective.