Risk Intelligence

Risk intelligent executives know that both threats and opportunities will present themselves in this new era of corporate responsibility and sustainability (CR&S). These business leaders realize that the circumstances are not analogous to developing a new product or entering an untested market or fending off a feisty competitor. Rather, these executives see the situation clearly for what it is: an entirely new environment in which they must compete for their own sustainability.

Deloitte believes that the topic of corporate responsibility and sustainability should be on the minds and agendas of every executive and board at companies across the world. Those companies that fail to proactively address CR&S may find themselves on a difficult path.

Toward Risk Intelligence

The CR&S challenge can be met through the principles of risk intelligence, Deloitte’s philosophy on effective risk management. Many characteristics distinguish “The Risk Intelligent Enterprise,” but one trait warrants additional emphasis: risk taking for reward. In Deloitte’s view, companies that focus solely on risk avoidance (the traditional realm of risk management) may survive but rarely thrive. Instead, companies should take a proactive approach to CR&S, one that sees not just peril but opportunity.

Step 1: Understand the Present

Evaluate the regulatory climate. Conduct a regulatory and “state of the world” review. What are the trends and forecasts for CR&S disclosures and regulations? Are new environment, health, labor and workplace safety regulations on the horizon? What impact might they have on your business?

Benchmark the field. What are your major competitors
doing right now in terms of sustainability? Create a catalog of leading practices and creative initiatives that may be adopted.

Survey stakeholders. Find out what is important to your customers, suppliers, employees, lenders, insurers, NGOs and shareholders. Survey your board, management team and business partners. Query analysts and consultants, your law firm and your accountant. Troll your upstream and downstream supply chain.

Take inventory. Virtually every company has activities and programs that fall under the CR&S heading. Take inventory of them all.

Do not neglect the business of business. Failing enterprises rarely make a lasting impact. Don’t let the enthusiasm surrounding your CR&S initiative distract you from your primary responsibility: building value for shareholders.

Step 2: Envision the Future

If you are a CR&S idealist, your first act should be to dispel any notions of grandeur. Your actions are not going to save the world. That is not to say you cannot have an impact. In fact, your company can make a profound difference, if it acts in a strategically focused manner. But you alone cannot solve all the planet’s problems. So ask yourself: What do you want to be known for? What are your company’s strengths? What is your organization’s long-term vision? What are your key growth strategies?

Step 3: Plan the Journey

Do not separate CR&S from your overall business strategies; they should be integrated, complementary and mutually supportive. At this critical stage, a few points should be kept in mind. One, remember that CR&S is not a public relations initiative; it should be much more than generating an annual report.

Two, prioritize your CR&S issues. You cannot deal with them all over the short run. Decide what your objectives are.

Three, conduct a gap analysis. You have cataloged your own CR&S activities, you know what peers and competitors are doing, you understand the concerns of your stakeholders, you’ve surveyed the regulatory landscape and you’ve established goals. Now you can document the gaps between where you are and where you want to be.

Four, perform a risk intelligent scenario planning exercise: What is the risk of inaction? What are the opportunities for action? What problems and issues might arise that could thwart your objectives? Consider using tools such as the Risk Intelligence Map² to spur discussion and creative thinking around the potential risks that may threaten your CR&S objectives.

Five, take a global perspective. Corporate responsibility extends beyond national boundaries more than many other initiatives. Even for companies that serve a local or regional customer base, many parts of their business can still have global components, including their supply chain and any offshore or outsourcing arrangements.³

Step 4: Plan and Build

Assess your resource requirements for attaining your CR&S objectives. Pull oversight of CR&S back up to the executive level. Demonstrate leadership and commitment to make good things happen. Your actions help set the tone and establish the culture. Set high expectations and live by them.

Step 5: Execute

Take your time. Do not try to leapfrog to the finish line. Instead, take measured steps. As you execute your plan, develop governance policies and procedures related to implementation. These provide valuable reference points as you move along in the process.

Step 6: Review and Revise

To keep your CR&S program on track, monitor your progress and assess your success. This means developing ways to measure your activities and compare them to your goals. Utilize feedback from stakeholders to assess course adjustments to your plans.

Step 7: Report and Communicate

After working through the previous steps, it is time to take a fresh look at your CR&S report. If you followed the recommendations above, you may find your old report barely recognizable. Items that seemed important then may appear trivial now. A variety of reporting standards exist, each with strengths and weaknesses. Thus, you should work with your board and advisors to determine whether an existing template, a customized report or a hybrid will best serve your needs and those of your stakeholders.

Step 8: Assure (internally)

The review and revise process described in Step 6 should not be a “once and done” exercise. The metrics that you developed to monitor your progress should be placed into regular use. Deploy these same tools to verify data and claims contained in your CR&S report. Measurement of nonfinancial data is unquestionably difficult, but is a process worth engaging in. Consider tapping internal resources. For example, your internal audit group possesses expertise in business process analysis; financial, operational, compliance and information technology control testing; and risk management, making them well positioned for a consulting and assessment role in your CR&S program. Similarly, your legal department, environmental health and safety group, and human resources division all harbor capabilities that can be drawn upon. Of course, some areas of your CR&S program will require entirely new skill sets, since deeply technical aspects of such topics as greenhouse gases require engineering skills that may have to be developed or recruited.

Step 9: Assure (externally)

In most countries, a publicly listed company is required to publish periodic financial statements that include independent assurance. The practice of providing this objective verification of financial data is so well established that it’s hard to imagine producing a financial report without it. The nonfinancial data that makes up a typical CR&S report carries no requirement for independent assurance. Companies are, for the most part, free to include whatever information they wish, employing any metrics they desire. This latitude may simplify report preparation, but it does not necessarily enhance credibility.

As such, Deloitte recommends that once your company reaches a certain level of maturity in its CR&S program (i.e., once you have completed the steps outlined above), you obtain outside assurance of your CR&S assertions. Doing so will not only improve the reliability of your report, but will also put you ahead of the curve. Deloitte expects that within a decade, independent assurance of CR&S reporting will be mandatory in many jurisdictions.

External assurance can provide greater confidence that the underlying report data is reasonably accurate, appropriately gathered and properly summarized, in keeping with the declared standard or definition being applied by the company.

Note: This is an abstract from “The Risk Intelligent Approach
to Corporate Responsibility & Sustainability,” the 11th installment in Deloitte’s “Risk Intelligence Series,” which builds on previous white papers. Copyright 2008 Deloitte Development LLP. All rights reserved. (See www.deloitte.com/RiskIntelligence.)

*Footnotes