I promised in my earlier blog on risk management in the legal practice to explain why I believe that the concept of "legal risk" is meaningless and useless.
Important risks - who is interested in the petty ones? - are multidimensional. Major risks are not either legal, or financial, or strategic, or reputation, or whatever else. There are legal and financial and strategic and reputation. Isn't it arbitrary and futile to define them as "legal", "technical", "reputation", "strategic", or whatever else, when they are all of these simultaneously? It just depends from where you look at them. A lawyer will see a legal risk where the CFO will see a financial risk where the engineer will see a technical one. Risks are just risks. What is legal, financial, or strategic is the way you look at them. A risk is not per se legal (or anything else). Important risks are those that support a variety of perspectives.
For example, a EU antitrust investigation may look as a perfect illustration of a true "legal risk". Indeed, it is about legal rules, it involves lawyers, and it costs legal fees: it is definitely a legal thing. But it is also a strategic risk: it may delay or block a merger or force to sale of a business unit. And there is also a financial risk at stake: the penalty may amount to dozens of millions. See? What looks like a legal risk is actually a multidimensional one. On the contrary, what looks like the opposite of a legal risk may actually have a significant legal dimension: an engineering company builds a bridge. The collapse of the bridge is, a first sight, a technical risk: something that engineers should prevent and deal with if it happens. But lawyers will also be involved: to draft the contractual liability and force majeure provisions in the contract, to negotiate an insurance coverage and, as the case may be, to manage claims by the victims and against the subcontractors. So, the collapse of a bridge, however technical it may look, is pretty much of a legal risk as well.
This is why I don't find it very useful in practice to base a risk management policy on risk categories (legal, financial, strategic, etc.). Even if it satisfies the logical mind, it does not match real life. Everything is in everything, and "legal" cannot be isolated. Nothing of importance is all and only legal. A marriage (isn't that a risky venture?) is of course a legal thing (there is a contract), but it is also psychological, economic, social, just to name a few. It may be appropriate to talk about the legal aspects of marriage and the legal dimension of managing the risks inherent to a marriage, but calling marriage, or divorce, a "legal risk" simply does not mean anything.
The question that really matters is not whether a risk is legal or not, assuming you can produce a satisfying definition of "legal risk", which is a challenge in its own right. The real question is, in the presence of a major risk for the company, whatever its nature, "What can lawyers do about it"? Legal risk management should be understood as a shortcut for "lawyers' contribution to risk management". For sure, lawyers' contribution to managing risks will be more central in certain areas than in others. But again, what matters is not to define what is a legal risk, but to see what lawyers, with their specific skills and knowledge, can do to help managing the major risks of their organisation.
Working with categories (legal risk, financial risk) also induces the idea that lawyers should deal with legal risk, finance people with financial risk, etc. This is a dangerous idea. Assume a contract for a cross-Atlantic transaction, with a provision dealing with USD/Euro exchange rate risk. The contract is submitted to the lawyer. What should he do about the provision? He could say "Exchange rate is a financial risk, not a legal risk, so I am not reviewing this provision". Or "I am only going to check whether this provision is legally valid and enforceable under applicable law." Both approaches would be perfectly in line with the idea that there is such a thing as "legal risks" and "other risks", and that the lawyers’ responsibility is limited to the former. But is that enough? Wouldn't the client - and rightly so - prefer a lawyer able and willing to look carefully at the provision, check if it is not only legally valid but also properly designed and drafted, economically balanced, and technically sound? If the provision is legally OK (no law is violated) but nevertheless catastrophic for the company, should the lawyer just say, "this is a financial risk, not a legal one", and go on to the next page? Of course not. A good lawyer should be able not only to assess the legal dimension of an issue, but also to understand and be relevant in the other dimensions.
In a sales contract, force majeure can be seen as a meteorological risk. Does it mean that the lawyer should not deal with it? And if late payment is a financial risk, does it mean that the lawyer should abstain from commenting on the provisions dealing with it? Non-compliance with technical specifications will often be described as a technical or operational risk. Should therefore the lawyer be absent from discussions on this subject? What is 100% legal, actually? Choice of applicable law, details of the arbitration procedure, and the so-called final provisions stating strategically important matters - I am kidding - like annexes forming an integral part of the agreement? If a lawyer limits his focus to the strictly legal, he condemns himself to working on issues that are of not much significance, relevance or importance for anyone else in the company. Eventually, he will pale into insignificance within his organisation. Not exactly what you would expect from a modern in-house counsel determined to deal with strategically meaningful priorities!
So, the better lawyers are, the more they become familiar with and involved in dealing with risks that are not primarily branded as legal. Good lawyers have a deep understanding of financial tools, strategic options, business process, operations of the company, and the evolution of the business environment. So, what's the interest of categorising risks? The idea that lawyers should be dealing with legal risks, and that in a separate room the financial people should be dealing with financial risks, is nothing but an accurate definition of a highly dysfunctional, bureaucratic, and ineffective organisation.
Because important risks are multidimensional, managing them requires a multidisciplinary approach. Effective risk management demands a blend of competences. Important risks should not be managed by one specialist only, lawyer or other. People of different departments must talk to each other. Cross-teams must be formed. Lawyers who want to play a signifciant role in risk management must be able to understand the non-legal dimensions of the risks they are contributing to manage. How could a lawyer efficiently advise on the risks involved in the acquisition of a company if he has no idea about the strategy behind this acquisition, about the financing arrangements, and about the business of the target? Risk management requires a cross-functional approach, and as a lawyer you cannot stand out in a cross-team if you don't get what the financiers or the engineers are talking about. No need to be an expert in finance, strategy, marketing, operations and all the rest, but a solid culture générale in business is a must for effective risk management by lawyers.
Antoine Henry de Frahan