ISO certifications

What is risk?

What is risk?

The informal notion of risk as the chance that something bad might happen is not a bad place to start defining risk. Better management requires a better definition though. We need to break risk into distinct parts that are measurable.

RISK IS THE PROBABILITY OF LOSS GIVEN AN EVENT

Mathematical precision is possible and desirable in some cases. Large financial firms, for example, have sufficient data about operational losses that they can build predictive models based on experience to measure risk. They are the exception.

To illustrate how we might define risk in statistical terms take the formula: R = p * LGE. In this case R stands for risk, p for Probability of Event expressed as a percentage, and LGE stands for Loss Given Event. LGE is a measurement of the financial harm from an event. LGE can include non-financial losses, but they must yield to measurement for the formula to quantify risk.

Most organizations do not have the data or resources (or confidence in) abstract models of risk. Organizations without statistically valid loss data can still measure and manage risk, particularly legal risk, by simply moving a few steps toward quantification, away from the "bad stuff" notion.

Effective risk identification

To identify risks reliably requires a workable definition of risk. The ISO 31000 definition of risk usefully includes "positive risks." This is right lens for identifying legal risks and, ultimately, managing legal risks.

Risk in an information problem. We can manage risk when we understand the scope and components of our uncertainty. The approach to risk can guide the organization to develop a risk management strategy.

WHY IS RISK TOLERANCE IMPORTANT?

An explicit legal risk tolerance policy achieves two objectives. First, it saves the organization money by calibrating the cost of risk treatment under ISO 31000. The organization cannot know how much to spend on preventative risk management if it does not have a target for acceptable risk.

Second, the legal risk tolerance policy improves organizational efficiency. For example, it is not unusual for sales executives to complain about revenue deals held up in legal. If both sides understand the organization's tolerance for risk, then sales executives and lawyers can collaborate on the contract in a meaningful way.

Legal risk in the context of market data

With annual revenues in excess of USD 20 billion, the market data industry is complex and large. It is no surprise that using, buying, creating or selling market data presents a range of risks, including technology, financial and legal risk.  Legal risk typically arises from breach of obligations under legislation (including regulations) or contract.

Legal risk translates to additional payments (e.g. damages or regulatory fines), increased regulatory burdens, reputational damage (e.g. public censure) and regulatory or legal processes which are costly and time-consuming distractions from a firm’s core activities. A lawyer advising on market data may be involved in a range of matters: (many) contract negotiations; negotiations and disputes over audit outcomes and licensing policy; advice on data management and compliance/remediation projects; advice on creating and contributing to financial indices and benchmarks; matters involving trading and information platforms (sometimes in competition with existing data vendors); and submissions to competition law authorities.

In the context of market data, some key legal risks for market data users are:

(1)    Unbudgeted spend arising from usage: unsurprisingly, vendors will seek to maximise revenue and customers will seek to control spend. Customers may have to pay for unauthorised use, or pay a fee based on usage (or deemed usage or access). Exchanges and vendors are alert to the possibility of undeclared usage, whether through audit, training or even relationship visits to the trading floor. Uncontrolled usage or distribution of market data can therefore be very expensive.

(2)    Terms unilaterally changeable by the vendor, so little control of legal risk:some vendors (notably exchanges) reserve the right to change the deal by notifications to customers (or even simply by notifications on a website). In such cases, the customer will have little opportunity to manage legal risk. Sometime what appear as small points of detail – e.g. unit of count for users – can have significant commercial impact. Some vendors are even unwilling to provide contractual assurances of their right to license data to their customers in the form of indemnities against third party intellectual property claims.

(3)    Complexity of contracts: some market data contracts have many components  – for example, master agreements, licensing policies, business principles, addenda, order forms – which customers often find difficult to manage. Uncertainty over whether customers can create derived data (either at all or without further payment) may taint data held by financial institutions. Industry developments such as the FISD Consumer Constituency Group’s CRISP (Contracts should be Readable, Intuitive, Standardised and Precise) are welcome but at an early stage – readers may assume that, at least for now, many market data Contracts are Rubbish, Asymmetrical and Problematic. In the shorter term, data governance and remediation projects can help bring clarity to the complexity, but require resources with the requisite expertise and time.

(4)    Vendor contractual terms lock users in: vendor contracts often impose restrictions on users from using a vendor’s data, even if that data is not protected by any intellectual property rights and in the public domain. Requirements to delete data upon a subscription terminating can also effectively mean that a subscription cannot be terminated, as historic data may need to be held to support risk and P&L figures.

(5)    Burden and risk of contributing data: contributing to a benchmark has proven costly for a number of banks. The processes for contributing to any reference price or benchmark should be subject to strict governance – not just for interest rate benchmarks, but for any contributed price.

(6)    Risk of inaccurate regulatory reporting:  market data is generally provided by vendors with no or very limited assurance as to its accuracy. While the vendor’s wish to limit liability is understandable, this leaves financial institutions with the responsibility of ensuring that their filings to regulators, shareholders and the markets are accurate. In theory, the management of an FCA-regulated entity could face criminal penalties for negligent processes around reports to regulators – food for thought for senior management.

(7)    Reporting and audit requirements: the burden of audit and reportingrequirements can be complex and resource-intensive.

While negotiation of new agreements can go a long way to mitigating these risks, sometimes firms are hamstrung by master agreements signed several years ago (often with no review by market data professionals or by lawyers with knowledge of market data) and so face the question of whether and when existing agreements should be renegotiated.  Deciding on the correct strategy is an area where market data professionals and experienced lawyers can add value.

But it’s not plain sailing for data providers either: their role in creating markets is increasingly under scrutiny, with the possibility of increased regulatory involvement from the financial services regulators, anti-trust authorities and privacy regulators.

Legal Risk Management

Legal Risk Management

1. Select framework

RISK MANAGEMENT IS A CONTINUUM

OBJECTIVES FOR A FRAMEWORK

A risk management framework for legal risk and compliance should meet four objectives:

1.    Simple but not simplistic

2.    Scalable but not overbearing

3.    Adaptable but with clear guidance

4.    Practical but not regimented

2. Obtain organizational commitment

Risk management initiatives often stall and stagnate because the organization insists on "doing it right," meaning implementing a risk management framework for the entire enterprise. Enterprise risk management (ERM) is a noble and important endeavor. However, it is not an essential starting point.

General counsel, compliance officers, contract managers, other legal professionals can implement legal risk management within their own domain. A focus on legal risk yields two benefits. First, the broader enterprise will benefit from clarity and measurement of formerly opaque risks. Second, the bar for approval of software and processes is lower than enterprise risk management, because the systems are simpler and the field of use is constrained.

There are four key questions to obtain organizational commitment:

·         What is the scope of the legal risk management initiative (meaning: departments, divisions, or enterprise)?

·         What types of legal risk will get tracked with the initiative (contracts, regulations, litigation, etc.)?

·         Who is the audience for legal risk reporting (management layer, corporate functions, etc.)?

·         How much budget is available to track and treat legal risk in terms of time, money, and staff?

Answering these questions will focus the organizational commitment needed to get started.

3. Identify legal risks

Risk identification is an issue spotting exercise. The objective is to compile a broad list of risks. There are three steps to identify legal risks:

Step 1: Find sources of legal risk. The primary sources of legal risk are contracts, regulations, litigation, and structural changes.

Step 2: Recognize potential and actual risks. Uncertainties with legal consequences can arise from hazards (physical injuries), events (a single occurrence), situations (entering a new international market), and scenarios (counterparty does X, Y, or Z).

Step 3: Record risks in a risk register. A risk register is basically a list that also captures some attributes of each risk. To start, track the name of the risk, the likelihood on a simple scale as an estimate, the consequences rating on a simple scale as an estimate, and the combined risk rating on a simple scale.

Now you can subject the risks to analysis, driving toward decisions about how to manage legal risks.

4. Analyze legal risks

Risk analysis is about understanding the risks in the risk register. To analyze legal risks, begin with an assessment of controls. Risk controls can take a variety of forms depending on the risk, the industry, and the organization. For example, to manage a contract risk, an organization might use a requirements tracking system to ensure that individual obligations are satisfied.

Once you have gauged the effectiveness of risk controls, analyze the likelihood and consequences of each risk. The likelihood of a legal risk is the combination of the chance of discovery (will a claimant or regulator identify the problem) and the chance of an adverse decision. Similarly, consequences are the product of damages (usually in financial terms) and frequency (the number of incidents).

Precise measurement of likelihood and consequences is rarely, if ever, possible or even desirable. Risk involves uncertainty. Risk analysis aims to refine, but not resolve, the identified risks. The final part of risk analysis is to build in parameters or variables for the elements

With the analysis in hand, you can refine the risk register with more definitive ranges. Risk analysis is an iterative process. Some risks will fall off the list; some will merge with others; new risks will emerge after analysis.

5. Evaluate legal risks

Evaluating legal risks is quite different from the analysis of risks. To evaluate a legal risk is to prioritize the response to the risk. At the core of risk evaluation is your organization's risk tolerance. Legal risks that are above the line - intolerable - need risk treatment. The idea behind risk treatment is simple: modify the risk so that it is tolerable. Notice that it is not necessary to eliminate the risk, just render it tolerable.

Risk treatment options are as diverse as the risks we manage. However, there are several repeatable techniques:

·         Avoid the risk by not starting or continuing the activity that can create the uncertainty

·         Increase the activity that creates the risk, if the consequence is beneficial

·         Remove the source of the risk

·         Change the likelihood and/or consequence of the risk

·         Share the risk through contracting or insurance

Each of these techniques can change the character of legal risk. Adapting these techniques to legal risks brings legal professionals closer to the operations of the organization to reduce the cost and impact of uncertainty.

6. Communicate and advise

Once legal risks are inventoried and analyzed in the risk register, it is important to communicate the results to the broader enterprise. However, many risk professionals diminish the power of their message and the effectiveness of their communication by presenting each risk.

To make a lasting impact on the organization, think holistically and communicate clearly. The principles of effective risk management presentations are detailed in "The 20 Minute Risk Manager."

Risk management is the frontier for lawyers, compliance officers, and contract managers to add value to their organizations. A pragmatic approach to legal risk management is within reach.

Why global legal risks have increased

Why global legal risks have increased

RISK CRITERIA

Risk criteria allow the organization to evaluate and compare risks. The cost of risk treatment is measured against the level of the risk with the risk criteria. Risk criteria impose consistency on how an organization identifies and measures each element of a risk. In the examples here, there are only three risk criteria:

1.    Likelihood is measured as a percentage probability,

2.    Consequence is exclusively a financial loss (not a profit), and

3.    Risk is the product of the two with no other considerations.

Reason for increase in risk

Over recent decades legal risks have intensified around the world. The following are the main reasons:

·         The volume of law is now out of control internationally and is unmanageable.

·         A large part of this increase of risk results from the intensification of regulatory regimes, notably in the West. These regulatory regimes, of which there are a great many, typically criminalise the ordinary law and are sometimes aggressive. In some cases, particularly large parts of financial regulation, their usefulness is questionable.

·         Almost all jurisdictions are now part of the world economy in the sense that they have businesses, banks and corporations which do business with other countries. Few countries are hermetically sealed off. Out of the just under 200 countries, there are about 320 jurisdictions and almost all of these now participate in world markets.

·         The law is much more volatile than it has ever been and changes rapidly, sometimes with no apparent reason, arbitrarily, just because somebody wants to fiddle with the law, or has a flash of anger.

·         In developed countries, domestic financial and corporate law is breaking up into tiers or layers internally, with different protections for different sectors of the population, usually politically driven.

·         There is great diversity around the world as to how the law is actually applied and the rule of law. For example the basic law in Congo-Kinshasa and Belgium derives from the same roots but the application is very different. One therefore has to cope with a double layer – the written law, or the law on the books, and then how it is applied.

Common legal risks that can impact your business

 Common legal risks that can impact your business

The role of General Counsel and legal departments is changing. Not only do legal departments need to understand the law, draft legal documents and conduct litigation, but General Counsel is increasingly required take on the strategic management of legal risks to protect the value and assets of a company.

But what is legal risk?

Risk – by definition – is the uncertainty of the outcome of a certain event. Businesses are faced with a variety of risks on a daily basis. Business look to assume the right types of risk with positive consequences, like profit or increased market share, while reducing the potential of negative consequences, like litigation or fines.  While many risks can have legal implications, that does not necessarily make all risks legal ones.:

Types of legal risk

Certain types of risk are accepted as a part of business, others that relate to legal matters, like contracts, entities, assets, IP and compliance, can have serious, adverse effects on a business.

As mentioned, any risk could have legal implications, however, typical legal risks that fall under the responsibility of the legal department include:

·         Corporate

Businesses have several options when choosing a legal and governance structure for the organization which will set the tone and set a foundation for processes around taxation, liability, required documentation, etc., and how management and operational decisions are to be made.

General Counsel need to understand the pros and cons of each legal structure, and need to adopt a strong corporate governance that promotes ethical business practices throughout the entire organization.

Once a legal and governance structure has been defined, it’s important to identify the corporate risks across the whole company, such as fraud or unethical business practices, and implement controls, like audits and awareness programs, to manage these risks.

·        Assets

Another type of legal risk that General Counsel need to understand is the risk to assets. The value of both tangible assets, like buildings, and intangible assets, like human capital and intellectual property, need to be protected.

To protect the rights and obligations related to the legal assets owned by a business, General Counsel require a clear picture of all the company’s assets so that they can identify and manage risk to avoid negative consequences.

·        Contracts

Contract risk is often defined as the possibility of financial loss either due to a buyer reneging on the contract or a failure by the organization to adequately manage the contractual benefits or obligations .

However, when looking at contract risk it’s equally important to look at the contract management process to fully understand your company’s risk exposure. Poor contract processes, such as manual mistakes, non-compliant terms and/or an inability to close a contract on time, can put your company at risk.

Automatic processes and contract management software can help standardize the contract process and empower managers to draft contract terms using templates, reducing the organization’s exposure to contract risk.

·        Disputes

Legal disputes include any dispute in which a legal claim is made, including employee misconduct, accidents, product liability, etc.

As General Counsel, one of your many responsibilities is to limit the risk of disputes. Even if disputes don’t end in litigation, they can damage business relationships, reputations and cost your company valuable time and resources.

To reduce the risk of disputes and litigation, General Counsel can take proactive steps like using risk transfer agreements, ensuring compliance, maintaining accurate records and using legal management software that can alert you to potential dispute risks.

·        Regulatory

Regulatory risks is the risk of having your company’s license to operate “withdrawn by a regulator, or having conditions applied (retrospectively or prospectively) that adversely impact the economic value of an enterprise” (PwC ).

Your business may be subject to regulations from government institutions, commissions and/or agencies. It’s important to understand the specific regulations that apply to your company’s activities and the related rules, such as specifications, policies, standards or laws, you must follow to avoid penalties and/or litigation. It’s also important to know when changes are made to that your company is not at risk of non-compliance.

Proactive regulatory risk management requires implementing specific policies, procedures and protocols to ensure that your company is in compliance well in advance of regulatory changes.

Conclusions

As General Counsel, our role is to support the organization in assuming the right types of risk with positive consequences, like profit or increased market share, while reducing the potential of negative consequences, like litigation or fines.

HISTORICAL RESEARCH:

 HISTORICAL RESEARCH:

Historical Research means

“ Finding out the previous law in order to understand the reasons behind the existing law and the course of its development”

-P.M.Bakshi

in his essay,

 Legal Research and Law Reform stated Historical Research as On the Archives Building in Washington, there is a famous inscription

which reads:

 ALL THAT’S PAST IS PROLOGUE

These are pregnant words and not mere rhetoric. The past often explains the

 present, most vividly”.

 Historical research in this context is not meant a discussion of the history of each rule of law or of each statutory provision for the sake of mere intellectual delight or for mere record. Like all other types of research required for the purpose of law reform,historical research is useful in law where the present statutory provision or rule of law has raised meaningful queries and it becomes necessary to explore the circumstances in which the present position came about. Not unoften, an exploration of the historical material gives a clue to the reasonswhy a particular provision was framed in the form in which it now appears. This often removes certain doubts, or even supplies to the researcher the reasons that justify the present provision - reasons which may not otherwise be apparent. Obviously, where such a fruit is yielded by historical research, it has its own utility. It prevents one from making

a suggestion for change in the law which one was tempted to make (before knowing the past), but which now appears to be unnecessary.

Secondly, historical research may often reveal that alterations in the law on particular lines which are now tentatively under consideration had already been thoughtof in the past also, in the earlier attempts at reform of the law, but had been rejected for sound and valid reasons.

Thirdly, historical research would often show that a particular existing provision,fully justifiable at the time when it was introduced, is no longer so justifiable because the reasons that justified the original inclusion of that provision are no longer valid. Historical research reveals the reasons, which might otherwise remain obscure.

Finally, on more general level, when the history of a particular idea which has been given a concrete shape in the law is studied in depth, it shows the gradual evolution of the law on certain lines, thus showing the general trend of change. It is true that some jurists fight shy of history

.Jeremy Bentham

stated

we are told, had scant respect for history and contributed little to an understanding of legal and social change in a continuum

But it is now well recognised that in many cases there is certain logic in the wayin which the law evolves, even though, in some other cases, one may, no doubt, find thatthe law had in the past developed rather on haphazard lines. Of course, when one speaks of historical research, one is not confined to pure law. Even though the material directly under study may be legal, that is to say, the source to be consulted may be a traditional legal source, the factual material that comes to light and the knowledge of ideas gathered from such a source, may often have an interest that transcends the exclusively legal field. In fact, social and legal factors cannot be always reduced to water tight compartments. Any adequate appraisal of the precise nature and rate of change in a particular country must also pay special attention to the effect of relevant physical, demographic, technological

Variables.

Sources of Historical Material 

What, then, are the sources from which historical material may be drawn? Here the legal researcher sometimes feels a handicap. Notwithstanding the availability of general books on Indian legal history and Indian constitutional history, the researcher willfind that when he sits down to tackle a particular subject assigned to him in a project of law reform, the historical material is not easily traceable. At least, it is not as easily traceable as Precedents.So far as pure statute law goes, some of the commentaries, no doubt, supply the reader with the text of the corresponding provisions in earlier statutes. But this does not always fully satisfy the curiosity of the researcher, and may not, in every case, yield sufficient light as to why a certain provision was phrased in a certain manner in the corresponding earlier statute.For this purpose, he will have to consult the relevant legislative debates.Fortunately, so far as central Acts go, these are excellently preserved in the national archives or state archives in regard to the older Acts. If the researcher finds it necessary(as he often may) to know the contemporaneous judicial understanding or exposition ofthe earlier provision, he will certainly like to go to the sources that contain such exposition. Experience has shown that one of the best sources to be consulted for this purpose are the earlier' commentaries on the particular statute