Corporate risk management and legal strategy

The board of directors has ultimate responsibility for strategies implemented by corporations. This chapter provides a link between the board’s risk management activities and corporate legal strategies. In this context, there are two relevant regulatory elements: the corporate governance rules that require companies to establish a risk management policy and the associated disclosure, and the specific legal requirements that the particular company risks breaching due to the nature of its operations. The theoretical part of the chapter examines the concept of strategy and explores the connections and tensions between corporate risk management policy, the expectations generated by risk management disclosures, the company’s true exposure to legal risks, and the implications for enterprise. The chapter then shifts focus to look at a number of examples that reveal the problems associated with treating the law as fixed. Examples include: the introduction of new statutory law where the company’s ability to generate and preserve useful evidence may become an issue (e.g. Corporate Manslaughter and Corporate Homicide Act 2007, UK); established statutory duties where a degree of uncertainty remains due to difficulties in statutory interpretation (e.g. aspects of United Kingdom health and safety law); and established law that becomes subject to change in a common law system (e.g. the duty of care to those injured on company premises). These examples are linked back to the opening discussion of corporate governance principles with the aim of highlighting difficulties and inconsistencies faced by a board in coping with both its governance role and its role in corporate legal strategy.