What Is Legal Risk Management (LRM)?

The focus of legal risk management or LRM is to control and manage an organization's legal risks, which in countries such as the United States are numerous and diverse. Legal risk management processes are primarily designed and implemented to engage in preventative projects, such as counseling the organization regarding insurance matters, developing risk management processes, and administering training programs, as well as involvement with legal defense activities, such as coordinating the company's defenses against product safety litigation and claims, responding to product-related investigations, and analyzing governmental reporting responsibilities vis-à-vis the company's various products. In fact, a compliance program can be considered part of the LRM process, as it can be an effective tool to monitor and prevent actions that are either against corporate policies or that are illegal. As you can see, it is a broad and important function that encompasses many areas.

By controlling and managing legal risk, an organization is able to control its future. Without adequate LRM processes, a company is exposed to claims, lawsuits, fines, and investigations. Not a day goes by where some governmental investigation or lawsuit is not reported in the local newspaper. These days it is a common occurrence. Therefore, it is imperative that an organization understands the role that LRM plays in an organization and that adequate systems, processes, and procedures be implemented to minimize, control, and transfer such legal risk.

Applying Legal Risk Management in a Corporate Setting

Legal risk management processes and procedures must be applied to provide risk management expertise and to prevent loss due to claims, litigation, and investigations and fines. LRM, when properly applied in a corporate setting, whether under the control of the company's law department or under the control of a separate division such as compliance or insurance, should cover general areas of responsibility or functions such as:

• Periodic risk assessment of the company's operating divisions and departments, and reporting the results to management

• Developing solutions to risk management issues

• Advising the corporation on insurance coverage issues and potential alternatives for coverage

• Oversight of the company's defense of product safety litigation and claims and advise management and legal on a regular basis on product safety matters

• Monitoring of product safety issues and analyzing the need for governmental reporting and/or taking corrective action

• Oversight of the company's information and document retention program

• Compliance review

• Development of training programs

• Monitoring compliance issues

• Training the company's employees on risk management, product safety, and often various legal issues such as antitrust, product liability or intellectual property (IP) issues

In order to apply LRM in a company or corporate setting, legal and management must take an active role in applying the above areas of responsibility through processes or systems implemented within the company. Normally, a Risk Management Department (RMD) will be established separately or in Legal, Compliance, or other divisions that will have certain risk management functions, responsibilities, or mandates across the company or organization as a whole.

The issues facing many companies when dealing with legal risk management, whether through a stand-alone department—RMD—or within Legal or Compliance, is that divisions and/or departments within a corporation often fail to effectively partner with RMD. This, in turn, leads to improper handling of major legal and sensitive issues, which can lead to legal claims, fines, and liabilities. Legal missteps can lead to a major crisis. Therefore, the LRM process must be properly implemented in a corporation. Such implementation is discussed in a more detailed fashion in part 2 of this book.

Legal Risk Management and Corporate Governance

3.1 US Obligations

Risk management as part of good corporate governance has become popular in many countries due to recent scandals such as Worldcom and Enron. Due to such scandals, the Sarbanes-Oxley Act (SOX) was introduced in the United States in 2002. SOX requires, among other things, that proper internal financial controls be established in publicly traded companies as well as whistleblower provisions and compliance policies. In fact the U.S. laws and regulations regarding compliance requires that the board of directors are not only trained in compliance but also has compliance oversight. Similar measures have been passed in other jurisdictions as well.

The result of SOX and other laws in other jurisdictions was to force upon the board of directors the obligation of ensuring the proper financial controls are in place and that such controls would be properly followed and maintained.

As such, risk management processes in general should be considered by the board of directors in light of the board's fiduciary and legal responsibilities.

3.2 Fiduciary Oversight

Legal risk management not only plays an important part in the success or failure of a corporation, but it is so important that it must be elevated to the board of directors for such LRM processes to be effective. As the board of directors of a company owes a fiduciary duty and obligation to the corporation, such duty requires a board of directors (BOD) that is fully informed and knowledgeable on major issues of risk. Whether it is ERISA issues, compliance issues, SOX, currency risk, antitrust, M&A issues, etc., the BOD must be fully informed to make the appropriate decisions involving the management of the company. Due to its very nature, the BOD cannot escape its fiduciary obligations with regard to understanding and approving LRM processes.

Obviously, to protect the board as well as officers from frivolous lawsuits, including shareholder actions, a company should purchase directors and officers insurance (D&O insurance). Whether to purchase D&O insurance is a question that must be decided in the context of legal risk management. Good corporate governance requires the board to be fully informed as to the major risk issues facing the company. D&O insurance may be necessary to protect the BOD as well as executive management from lawsuits stemming from fiduciary responsibilities or lack thereof.

Failure to properly elevate risk issues to the board level is not only a failure of proper corporate governance but of LRM processes as well. Authority to implement many LRM processes must come from the BOD of a company, or its counterpart in other organizational forms. Therefore, failure to properly inform the BOD on LRM related issues can spell disaster.

Legal Risk Management

Minimizing legal risk or the exposure of legal risk takes place in several stages, basically, several stages prior to potential litigation or pre-litigation and, of course, during litigation as well. Obviously, minimizing legal risk even during pre-litigation is a proactive or preventative stage in which risk management processes are implemented in order to reduce the risk of lawsuits or government investigations, fines, or penalties.

This stage of LRM can be considered in essence a stage where the company can take an "proactive" approach to legal concerns and prevent potential exposure. This stage can cover areas such as:

• Prelaunch product review: What processes are in place to look at a product's historical data prior to its launch in the marketplace?

• Product safety: If a company produces products, what processes are in place to minimize claims, recalls, class action, CPSC settlements, and fines?

• Product risk management: What processes are in place to encourage correct product use, increase customer satisfaction, and manage possible injury from its use? This also includes improving the ability of the company to defend itself by substantiating defenses to liability, reducing exposure to liability, and assisting in regular compliance.

• Insurance: What processes are in place to review the company's insurance coverage? This includes assessments of availability/policy limits, relationships with insurance cost benefit analysis of premiums, and alternatives for coverage such as creating a captive insurance company.

• Information/document retention program: A major issue for companies dealing with the United States in any capacity is the creation and use of a document retention program. What processes are in place to implement a robust document retention policy, which minimizes fines, penalties, or sanctions during litigation? The program must be in place before litigation to adequately protect the company.

• Risk management assessments of critical departments within the corporation: What processes, if any, have been developed to assess the risk factors of major departments or divisions, such as Human Resources?

• Compliance: A properly implemented compliance program can have a great impact on corporate liability and exposure to legal risk. What processes, if any, have been put in place to develop a compliance program? Does one exist?

Legal Risk Management and Litigation

Legal risk management plays a vital role during litigation as well. LRM processes should drive a company's defense during litigation, especially litigation in the United States. Such processes should play a major role in coordinating a company's defenses against product safety litigation and claims, responding to government investigations, and product-related or service-related investigations.

It should be noted that processes developed to defend against litigation must take into consideration a number of issues, especially if more than one division or subsidiary is subject to potential litigation in the United States or elsewhere. Such processes should include the following litigation considerations, especially these companies or divisions operating in the U.S. marketplace.

• Multiple group companies can be named as defendants. These companies will need coordination of defense and discovery matters.

• Maintaining corporate compliance.

• Litigation respecting same products in multiple jurisdictions.

• Insurance coverage: Is it adequate? Risk Management or Legal needs to review insurance coverage.

• Communication: Are communication protocols set up to facilitate effective and efficient communication between relevant departments, especially in case of a crisis?

• Internal Investigations: Is there a complaint and investigation procedure protocol?

• Centralized management of litigation must be implemented for:

• Effective coordination of legal defense efforts in order for the companies and attorneys to avoid duplication of cost and effort from case to case.

• Coordinated use of witnesses, answers and interrogatory responses, documents, deposition materials, and research and briefs on legal issues.

• Assurance of consistency of actions taken at every phase of the litigation, including pleadings, discovery and responses, discovery motions, and settlement strategies.

• Proper minimization of disruptions to the company's business by internally coordinating fact-finding.

• Development, implementation, and coordination of a defense plan.

• Coordinated activity regarding PR.

• Coordinated activity respecting financial considerations, such as:

• Reserves

• Disclosure to auditors

For cases where multiple group companies are named as defendants or where actions respecting the same product are filed in multiple jurisdictions, an effective litigation management process can provide a central site for:

• Preservation of evidence, documents, files, and records

• Use of document depositories and computerized storage

• Coordinated or cross-referenced numbering system for documents

• Coordination of protective orders and procedures for handling claims of confidentiality and privilege

An LRM program must also:

• Establish complaints and claims handling procedures and controls.

• Establish claims processing procedures.

• Establish record-keeping guidelines.

• Establish e-discovery process controls.

From the above, it is apparent that the role legal risk management should play in litigation is important. Only a well-thought-out LRM program that considers all the above-mentioned issues and concerns will be successful.

SUMMARY

LRM focuses on processes that control, manage, and mitigate an organization's legal exposure. The processes can be preventive in nature, such as training or implementation of insurance programs. An example of a preventive process would be the implementation of a compliance program. This can minimize fines, lawsuits, and investigations.

To be successful, LRM processes need to be properly applied in an organization's structure. If applied in a corporate setting, such processes should be controlled by the Law Department or Risk Management Department covering such areas as oversight of product safety issues, insurance coverage, and compliance. The RMD or Law Department must take an active role managing risk management functions and applying such programs.

The mandate to apply and manage LRM processes usually comes from executive management, including the board of directors. To be effective, the BOD must authorize and approve such programs. Hence, the BOD can only do so when fully informed on the necessity of such programs.

LRM processes take place in stages, normally prior to litigation (pre-litigation) or during lawsuits or investigations (the litigation stage) and claims. During pre-litigation, the company can take an "offensive" approach to prevent claims, such as the use of insurance or product risk management programs. Otherwise, LRM processes can be used during litigation in a more reactive manner, such as using tools to centralize and manage litigation in order to control costs.

Legal Risk Assessment and Evaluation

6.1 Risk Assessment

In order to implement a legal risk management (LRM) program that mitigates legal risk, manages product claims, and ensures the timely escalation and handling of risk-related issues, it is imperative to conduct a risk assessment and evaluation of the findings of such risk assessment. Many companies have in fact some risk management processes in place, but usually only a few, and those processes are not well coordinated. The basic implementation of risk management takes place in phases as follows:

RISK MANAGEMENT SOPHISTICATION

Phase 1 Some sporadic risk management activities

Phase 2 Routine risk management activities

Phase 3 Enterprise-wide risk monitoring activities

Phase 4 Risk management becomes part of the overall strategic process

It is only through adoption of a comprehensive risk management program and routine that a company can begin to not only identify major areas of legal risk but implement a fully integrated risk management structure that coordinates all enterprise risk management (ER) activities.