Quantifying Legal Risks: Financial and Reputational Impact Assessment (Full Transcript)

Speaker 1: So we've talked already about what legal risk is and we've talked about how to identify legal risk within your business. Once you've got a list of legal risks that you're exposed to, the next step is to quantify those risks so you can understand the actual financial and reputational exposure that they subject you to. So when quantifying legal risk, you want to look at those two categories. What's your potential financial loss and what's the potential impact on your reputation? So a direct financial and an indirect financial loss. For financial, it should be fairly straightforward because you're looking just at dollar or pound or euro value. For non-financial loss, you need to set up a set of categories that can impact the business. So you would typically look at things like newspaper headlines. You would look at potential of customers leaving your business because of whatever situation has occurred. You would look at the impact on your business's ability to achieve its strategic objectives as some examples of how to flesh out that non-financial risk. Once you have that non-financial matrix and you have your idea of dollar value, the best way to quantify and to understand risk exposure is to get in-house lawyers, business people and risk specialists in a room to talk through the list of risks and talk through two scenarios. There are lots of ways and lots of structures to assess risk. My preferred method is a scenario analysis that looks at your typical expected loss. So what do you expect to lose in the next 12 to 24 months? And an extreme plausible scenario. So what's the worst plausible loss that could occur over whatever time frame? So work through your risk register, your list of risks to look at what you're expecting to lose due to that risk in a typical year, whether it's through legislative risk, contractual, non-contractual rights, obligations or dispute. And then work through some extreme scenario analysis. So, okay, if your control environment fails, what could happen? And those two sets of numbers, the typical loss is normally pretty low because businesses generally comply with law and regulation. But the extreme loss can be very high and it can be in the high millions, if not billions of dollars for some large institutions. Add those together to get a risk rating so that you can prioritise any control, augmentation, any legal risk mitigation activity in the business moving forward.