Risk reduction, or something to that effect, is among the benefits of corporate sustainability programs and initiatives.* It sounds great and even seems to make sense. But risk reduction values of sustainability/CSR are largely mythical, wishful thinking and not particularly credible.
Unlike many sustainability/CSR/environmental professionals, my career included a seven-year stopover at the world’s largest insurance brokerage/risk advisory firm where I learned about traditional risk management. The first thing I learned is that I didn’t know a damn thing about risk management concepts and frameworks. What ended up making through my thick skull is worthwhile knowledge for anyone attempting to place a dollar value on sustainability risk reduction.
Risk Management in General
While many corporate risk management functions focus on procuring insurance coverage, traditional risk management involves more than that. Sustainability practitioners need to understand this before putting dollar signs next to their initiatives.
Understand exposures. The first step in managing risk should be identifying what risks are applicable to an entity and how big the exposures may be. This risk assessment should scope out the entire risk management landscape - meaning the breadth and the “height” of possible risks. Risks are usually assessed using a two-dimensional framework – frequency (or likelihood) of occurrence, and severity (or impact) of an event should it occur. The effort should not be limited to only risks that are probable; to be most effective, risks should be assessed in their gross (or uncontrolled) state. It is important to be thoughtful here: this creates a foundation of types and values of risk to be addressed. For instance, while it may be appropriate to be conservative in estimating potential fire losses in establishing insurance coverage limits, using a loss estimate that is too high means unnecessarily high insurance premiums. As an analogy, not many people are willing to pay the price of insuring their everyday car for five times retail price; likewise, it probably doesn’t make sense for companies to drastically over-estimate insured values either. Besides, insurance carriers have guidelines on insured values and coverage limits as well.
Establish risk tolerance. Once the overall risk landscape is understood, business decisions can be made about how much risk the company is willing to accept or tolerate. The deductible on car insurance is an example of personal risk tolerance. Some people are willing to pay higher premiums for lower deductibles because they have a low risk tolerance.
Implement solutions. Selecting solutions goes hand-in-hand with risk tolerance determinations. Generally speaking, there are three risk management solutions:
Avoidance. This is fairly self-explanatory. Avoiding a particular risk involves avoiding the business activities associated with that risk. For instance, if a company does not care to expose employees to high voltage electrocution risk, then it prohibits employees from doing any work on high voltage lines and equipment. Risk avoidance is also a major factor in M&A decisions as well – a company that makes cookies is not likely willing to take on the environmental risks that come with an acquisition of a chemical company.
Management. Risk management involves accepting a certain amount of risk while implementing programs and systems to reduce risk to within a tolerance level. Recall that risk has two dimensions; it can be managed by addressing one dimension or both. Physical controls, monitoring programs, employee training/qualifications and operating limits help reduce the frequency or likelihood of events. A financial solution is the best approach to managing severity or impact since that is usually defined in financial terms.
Transfer. Transferring risk includes obtaining insurance and/or imposing contractual requirements on relevant parties for indemnities, limitations of liability and the like. The mechanism should be appropriate based on risk tolerance and other management programs. Not all risks are insurable. Environmental fines are not insurable because, among other things, doing so would create a “moral hazard” – meaning that the insured would have no incentive to operate in compliance if insurance paid the penalties.
Where Sustainability Goes Wrong in Risk Reduction
Insurance reflects the replacement value of an actual quantifiable loss. The value of avoiding a potential loss is much different – and that is what many sustainability practitioners attempt to quantify. Averting a loss that is irrelevant, may not occur or is poorly defined is speculative to the point of not being credible. Consider this hypothetical conversation between Beverly, the company’s Director of Risk Management, one of her staff, Jim.
Jim: Beverly, I know how to save our company at least $100,000 in property premium.
Beverly: That is fantastic! How did you manage that?
Jim: Well, because our warehouse is 500,000 square feet, our property insurance premium is $100,000 lower than if it was 1 million square feet.
Beverly: But we don’t have a 1 million square foot warehouse and we have no plans for one.
Jim: And if we stored priceless Egyptian papyrus scrolls, do you know much that coverage would cost? So we are saving even more by not storing Egyptian papyrus scrolls in the 1 million square foot warehouse we don’t have.
Beverly: Jim, we store landscaping rock in a 500,000 square foot warehouse. Why don’t you take some time off.
Clearly, Jim’s claim is not credible. Yes this is conceptually similar to some risk reduction claims about sustainability. Not only do sustainability valuations frequently include avoiding a loss that may not occur in the first place, they can also rely on highly contingent (or flat out questionable) values. For instance, trying to claim the value of avoided carbon taxes in the US. Or perhaps the stickiest question of them all: how to value a human life or the ecosystem. Economists call these “externalities” and I won’t even go there.
Then there are attempts to link sustainability to reducing stock price risk. This is a complex matter about which I dedicate several pages in my book. Let me simply summarize the matter this way: the relationship between sustainability and equity pricing is not definitive, and it can be plain baloney.
Initiatives with sustainability roots can have definitive risk reduction value. Some of these include:
Chemical substitutions may reduce fire risk and product liability, possibly resulting in reduced property insurance premiums.
Improvements in employee safety manifest in direct medical cost savings and workers compensation costs.
Implementing or improving certain operational controls may have definable value in risk reduction terms.
Where a company has experienced losses due to negative reputation/brand events/boycotts or supply chain disruption due to subcontractors, those known values may be used for risk valuation for similar potential events.
In the end, every company establishes their own risk management philosophy and benchmarks. Some organizations may choose to accept quantifying the avoidance of contingent risks with undefined value as a management tool. There is certainly nothing wrong with that. But in my experience that is an exception rather than the rule. Sustainability and CSR practitioners should determine how their own organizations regard risk avoidance valuations before going too far. Presenting ideas and numbers that are not credible to management subverts credibility of the sustainability program and its leader.
Final note: Don't just take my word for this. A 2017 report from the World Business Council on Sustainable Development (WBCSD) had very similar findings and conclusions. That report is available at http://bit.ly/2jdwiGb
* Anyone who has read the book will immediately chastise me for using the word “sustainability.” However, it is intentional for this particular article.