Getting ethics right as a risk manager

Outside of the obligations of compliance and legislation lies a task for risk managers which is cursed with ambiguity.

While some ethical decisions can seem obvious, others can be shrouded in an unsettling vagueness.

Professor Christoph Lütge, author of Business Ethics and Risk Management, says there are two main types of ethical risks to be faced in the globalised economy: reputation risks and legal fines risk.

“Both types are usually ethical risks at first, but they can obviously turn into economic risks at a later stage,” he says.

“These risks get triggered by a number of ethical matters and conflicts, such as corruption, discrimination, working conditions – especially along the supply chain – human rights issues and others.”

Lütge says in many cases, such as the recent Volkswagen scandal or the Siemens corruption scandal 10 years ago, the ethical, or rather unethical, decisions were made over a long period of time, in a gradual, slow manner.

“The task of risk managers here is to identify these gradual processes before they seriously damage a company,” Lütge says.

David Ralph, head of risk management & compliance, PCCW Limited in Hong Kong, says ideally risk managers should be able to present risks and potential mitigating actions that achieve a balanced solution that would not require any question as to the ethics of such a solution.

“This is not always the case,” he says. “Probably the most difficult recommendations are those that may have a material negative impact on employees who rely on the company to support themselves and their families, such as a … staff lay-offs, potentially on short notice.

“Another, which is again human resource focused, is when it is necessary to make recommendations that may put staff into harm’s way, such as arranging for travel to war zones, or high medical risks territories during epidemics, even though all precautionary measures have been identified and agreed.”

Ralph says his approach to such matters is to always ensure that the preliminary assessments are as thorough as possible and that all avenues which may avoid or significantly reduce the possible impact have been fully identified and included in the recommendations.

“It is also important to ensure that when presenting such matters, high priority is afforded to the actual impact on the individuals and the company of actually proceeding with those actions as is afforded to the impact of not doing them,” he says.

“At all times it is important to ensure that the rationale for any recommendation is quantitatively unassailable – so clearly defined without subjectivity – before looking at the objective aspects. Then for each adjustment to address the ethical issue, reassess the quantitative position,” says Ralph.

Peter Young, who heads the Risk Leadership Project at the University of St. Thomas, says nearly every decision has an ethical component.

“The idea I always start with when talking to risk managers is the concept of teleopathy, or ‘goal sickness’, which poses the thought that ethical risk issues arise when Goals, Values, and Means are not in alignment.

“As a simple illustration here, if the means by which you pursue your goals are not consistent with your values, you probably have found the source of an ethical risk,” says Young.

As for how to approach these ethical decisions, Lütge says to install mechanisms as an early warning system for ethical risks.

“It is not enough to write memos and codes of conduct, or put some ethical guidelines on the wall. Rather, incentive mechanisms have to be installed and monitored.

“Of course, this is a task for the entire organisation, a case for restructuring central processes, as the Creating Shared Value approach suggests,” adds Lütge.

Young says values sit at the center of most organisational decisions though they are not always evident.

“At an operational level, decisions about risks – credit risks, worker injuries –commonly present us with data that allow us to construct quantitative models of analysis and establish concrete decision rules,” he says.

“The issue at the operational level becomes one where the risk manager has to consciously find ways to include the values impacts of these decisions.”

Young says at the board and executive level the issue is different.

“Although executives may demand data, they operate in a world of uncertainty – their main challenges revolve around unique, unusual situations where data are not available.

“Here, when the question arises: how do you make rational decisions in the face of the unmeasurable/non-quantitative uncertainties, the answer seems to be your organisation’s values are – directly and obviously – your decision rule.”

Young adds the challenge at this level is to assist leaders in recognising that careful thinking about uncertainties through the lens of organisational values is probably more important.