Dibbs Abbott Stillman on franchise risk management

According to Dibbs Abbott Stillman , some may ask, risk management policy? What risk management policy? This is definitely not a question you want to be asking yourself or the kind of comment you want being passed about your company. National Australia Bank has been on the receiving end of a lot of criticism over the various scandals that dogged the bank in 2004. NAB is one of Australia’s largest banks and was generally thought of as a solid performer. So what went wrong?

Many have been quick to point the finger but NAB’s woes can be traced to risk management. Companies should now be asking themselves: If the same happened to this company, how would our risk management policies stand up? It is time for a little introspection, some self-examination.

The ASX Principles of Good Corporate Governance and Best Practice

Recommendations suggest establishing “a sound system of risk oversight and management and internal control”. A risk management policy is like a company’s watchdog, however risk management should not create risk-averse management but, rather, provide the framework for effective decision-making based on an understood level of risk.

Given the increasing likelihood of the courts questioning how directors and senior management have handled risk and what systems they have in place for this purpose, it is important to create a risk-aware culture in your company.

Have you examined the risks facing the company?

Before a culture of risk awareness can be created, the board and senior management must examine the business of the company. What risks present themselves?

How often would these risks occur? If they do occur, what is their likely impact on the company? A risk management policy can then be structured around these risks.

Risk management policy

The risk management policy should be signed off by the board and senior management. It should be specific to the company, not one ‘borrowed’ from elsewhere, even if it is held out to be an exemplary model. No two companies are exactly alike, so while a certain amount of similarity is acceptable, make sure your policy is tailored to your company’s particular needs.

Create a clear division of responsibility

An effective risk management policy should clearly delineate who has authority to sign off on particular expenditures.

There should be a clear system of accountability and supervision with no one person having unfettered authority. It should also include a process for employees to report irregularities or issues of concern. The system should include checks and balances to ensure that the company is not exposed by persons acting outside their authority.

Train employees on risk and control procedures

Employees must be regularly trained in risk management procedures and policies.

This should start at induction. Training should be reviewed on a regular basis – spot checks and internal audits are a useful tool and should be used at all levels (management included).

Regularly review risk and control

Procedures. Risk management policies are not meant to be kept on the shelf only to be dusted off when external audits are conducted. They are meant to be an everyday reference point for the normal (and occasionally not so usual) workings of the company.

If internal reviews show that the policies are not being used or that they are not working, either the policies need to be reviewed or further training is required to reinforce how important risk management is to the company. Compliance is an ongoing process and three measures – monitoring, assessment and review – should work in combination to regularly measure and assess the performance of the compliance program at different stages in time.

Conclusion

NAB certainly had risk management policies; but either these were not applied or cracks had developed in the system. What happened is a timely reminder for any company, irrespective of its size, that if a risk management policy is not properly developed, adhered to and reviewed, the flow-on effect can seriously damage morale, public perception and financial performance.

Read about buying a franchise and running a franchise.