Social responsibility is often thought of as something companies can choose to practise if they wish. Even voluntary actions, however, have a legal context. In the UK companies can make donations, but not political ones, and in the US laws on misrepresentation and false advertising frame voluntary company reporting.
Contrary to some perceptions, a sizeable body of regulation relates directly to corporate social responsibility. In a recent client note, the international law firm Lovells lists 32 ‘CSR initiatives in force’ applicable to UK companies alone, and a further 24 in the pipeline. A number of these, such as the Organisation for Economic Co-operation and Development Guidelines for Multinational Enterprises, are not formal regulations, but as the note says, the list could have been longer because the boundaries of corporate responsibility are uncertain.
CSR, according to Lovells, embraces a commitment ‘which is increasingly regulated but goes beyond legal compliance’.
In the UK, the CSR-related legislation currently focusing legal minds is the requirement for companies to produce operating and financial reviews, which next month is expected to be allocated parliamentary time.
Hilary Plattern, director of public policy at Clifford Chance, the largest fully integrated law firm in the world, says: ‘The legislation the government is bringing forward on OFRs will arouse the interest of lawyers because the question of materiality will inevitably lead to questions being asked about whether the directors have left something [material] out.’ The debate over the ideal length of an OFR suggests she is right.
OFRs, however, are not exactly revolutionary. Many, but not all, companies regularly already consider a range of risk in their reports. Stephanie Bates, corporate partner at Mayer, Brown, Rowe and Maw, points out that companies regulated by the US Securities and Exchange Commission, which includes many large UK businesses, have to write a Management's Discussion and Analysis to accompany the numbers in their financial report, and the OFR is equivalent to this narrative. The proposed legislation fits the pattern of demand for greater transparency. ‘We tend to come across CSR issues when reviewing company reports’, says Bates.
CSR, however, is about much more than transparency in reporting. Lawyers say that well-thought out CSR policies, if implemented, can help a company to manage not only reputational, but also a wide range of regulatory risks.
Jonathan Pickworth, regulatory partner with the international law firm DLA, says a company should ask two related questions: what makes it a good corporate citizen, and how a regulator – which can range from a utility watchdog to the Inland Revenue – might intervene in the business. Well managed CSR policies and procedures, he says, make it less likely things will go badly wrong, and if they do, should mitigate legal and reputational risks.
‘Established compliance programmes in areas such as health and safety, environmental protection and financial services provision make it less likely problems will arise, but if the wheels do come off, you want to demonstrate that this has happened despite your best efforts rather than because of your failings. Having in place risk management procedures counts as significant mitigation. Community and charitable work alone won’t get you off the hook. You need to look at what makes you a good corporate citizen overall.’
Pickworth stresses the value of external verification. ‘Third party verification is important. If you have the right systems and procedures audited by outside advisers, you are in a much stronger position,’ he says. ‘An outsider can raise issues you’ve never thought of, like data protection.’
The trend for governments to make directors personally responsible for corporate failings will concentrate managerial minds on responsible working practices. ‘A code of conduct can mitigate risk,’ says Pickworth, ‘but if the code is a manual no one ever reads, and the CEO ends up in the dock, and the code says the opposite of what has been done, it will not look good. You need to have a policy, and to implement it properly. The big issue is the corporate culture.’
Corporate culture, he says, ‘is undoubtedly key to any effective company risk management policy’. A survey conducted for DLA last year by the London School of Economics found that corporate culture was the second biggest barrier to effective risk management, after lack of leadership from the board.
As Halina Ward, a director of the International Institute for Environment and Development, and author of a recent paper on legal issues in CSR, says: ‘One message is clear: any company that aspires to integrate corporate citizenship across the full range of functions needs to involve its legal advisers in the development of management systems for CSR.’