What Is Legal Risk Management (LRM)?

The focus of legal risk management or LRM is to control and manage an organization's legal risks, which in countries such as the United States are numerous and diverse. Legal risk management processes are primarily designed and implemented to engage in preventative projects, such as counseling the organization regarding insurance matters, developing risk management processes, and administering training programs, as well as involvement with legal defense activities, such as coordinating the company's defenses against product safety litigation and claims, responding to product-related investigations, and analyzing governmental reporting responsibilities vis-à-vis the company's various products. In fact, a compliance program can be considered part of the LRM process, as it can be an effective tool to monitor and prevent actions that are either against corporate policies or that are illegal. As you can see, it is a broad and important function that encompasses many areas.

By controlling and managing legal risk, an organization is able to control its future. Without adequate LRM processes, a company is exposed to claims, lawsuits, fines, and investigations. Not a day goes by where some governmental investigation or lawsuit is not reported in the local newspaper. These days it is a common occurrence. Therefore, it is imperative that an organization understands the role that LRM plays in an organization and that adequate systems, processes, and procedures be implemented to minimize, control, and transfer such legal risk.

Applying Legal Risk Management in a Corporate Setting

Legal risk management processes and procedures must be applied to provide risk management expertise and to prevent loss due to claims, litigation, and investigations and fines. LRM, when properly applied in a corporate setting, whether under the control of the company's law department or under the control of a separate division such as compliance or insurance, should cover general areas of responsibility or functions such as:

• Periodic risk assessment of the company's operating divisions and departments, and reporting the results to management

• Developing solutions to risk management issues

• Advising the corporation on insurance coverage issues and potential alternatives for coverage

• Oversight of the company's defense of product safety litigation and claims and advise management and legal on a regular basis on product safety matters

• Monitoring of product safety issues and analyzing the need for governmental reporting and/or taking corrective action

• Oversight of the company's information and document retention program

• Compliance review

• Development of training programs

• Monitoring compliance issues

• Training the company's employees on risk management, product safety, and often various legal issues such as antitrust, product liability or intellectual property (IP) issues

In order to apply LRM in a company or corporate setting, legal and management must take an active role in applying the above areas of responsibility through processes or systems implemented within the company. Normally, a Risk Management Department (RMD) will be established separately or in Legal, Compliance, or other divisions that will have certain risk management functions, responsibilities, or mandates across the company or organization as a whole.

The issues facing many companies when dealing with legal risk management, whether through a stand-alone department—RMD—or within Legal or Compliance, is that divisions and/or departments within a corporation often fail to effectively partner with RMD. This, in turn, leads to improper handling of major legal and sensitive issues, which can lead to legal claims, fines, and liabilities. Legal missteps can lead to a major crisis. Therefore, the LRM process must be properly implemented in a corporation. Such implementation is discussed in a more detailed fashion in part 2 of this book.

Legal Risk Management and Corporate Governance

3.1 US Obligations

Risk management as part of good corporate governance has become popular in many countries due to recent scandals such as Worldcom and Enron. Due to such scandals, the Sarbanes-Oxley Act (SOX) was introduced in the United States in 2002. SOX requires, among other things, that proper internal financial controls be established in publicly traded companies as well as whistleblower provisions and compliance policies. In fact the U.S. laws and regulations regarding compliance requires that the board of directors are not only trained in compliance but also has compliance oversight. Similar measures have been passed in other jurisdictions as well.

The result of SOX and other laws in other jurisdictions was to force upon the board of directors the obligation of ensuring the proper financial controls...