8/2/2019 papa_john

1/6

Director Notes

JANUARY 2011

Vlm 3, Nmb 2

Risk Oversight Practices:Two Success Storiesby Ellen S. Hexter and Gregory Vainberg

In a series of recent interviews with directors of publicly held U.S. companies,The Conference Board gained important insights on how boards can beinstrumental in adding value to risk management oversight. The case studiesdiscussed in this report illustrate the value and rigor that boards can infuse

into the companys enterprise risk management (ERM) program.

Having the curiosity to understand ERM, its link to strat-

egy, and the importance of a vigorous risk conversation has

helped the two companies noted in this report to create and

sustain leading risk management practices.

At Papa Johns International Inc., ERM took root and

began to flourish at the insistence of a board member.

The audit committee chair was not satisfied with the risk

information the committee had been receiving, and she

asked the CEO to allocate resources to develop ERM. Withsome help from an outside consultant and after eventually

finding the right person internally to lead the efforts, Papa

Johns built an enviable ERM program.

The second case study demonstrates the value of the deep

understanding of the business, its success drivers and risks,

within both senior management and the board. NewStar

Financial was created in 2004 with a risk-savvy board. The

management team understood that the board could only

bring true value to the company if the members were fully

knowledgeable of the complexities of its f inancing business.

That strong alignment of risk understanding and support

from the boardalong with meaningful ongoing commu-

nications, particularly during the financial crisishas beencrucial to the companys performance and survival through

challenging times.

8/2/2019 papa_john

2/6

Director Notes Risk oversight practices: two success stories .nfnbd.2

Papa Johns International Inc.

Papa Johns International Inc. demonstrates the crucial

role that a board can play in developing excellence in risk

management practices. The development of its risk man-

agement program started with a request from the boards

audit committee, which urged senior management to adopt

a more robust ERM program. The companys effort has

spanned the last three years, during which Papa Johns has

developed a framework to cover risks on the continuum it

describes as from farm to fork.

Papa Johns is widely recognized as one of the leading

pizza restaurant chains. It currently owns or franchises

more than 3,600 restaurants in all 50 states and 30 coun-

tries around the world. The philosophy at the core of Papa

Johns program is that risk should be considered in al l

strategic decisionsfrom brand strategy to expansion in

business segments and from marketing to distribution.

This philosophy emerged from the audit committee, which

insisted that risk should become a key part of decision

making and urged senior management to invest accord-

ingly. Given this board directive, the organization has

implemented a number of very sophisticated tools that

enable senior management and the board to make risk-

informed decisions.

As it has evolved, effective risk management fits well into

Papa Johns decision-making process. To protect Papa

Johns Better Ingredients, Better Pizza claim in its slo-

gan, food safety is a significant focus. Food safety issues

can arise at any point in the supply chain or at the point of

end-product delivery. These risks are complicated further

by Papa Johns global footprint. For example, the deci-

sions made regarding food distribution quality controls in

Beijing, Boston, or Birmingham, England, can reverberate

through the entire company and must therefore be managed

very carefully.

Like many companies, when Papa Johns began its ERM

program, the framework and processes were being devel-

oped by external consultants. As the program evolved,ERM has become more effective because the company was

able to secure the r ight talent, both internally and exter-

nally. The audit committees focus was on having an ERM

leader with the right capabilities: an expansive mind, key

analytical skills, strong communications skills, and a deep

understanding of the business. Getting the right person in

charge internally was critical to embedding risk thinking

throughout the organization.

Anlyl l

In particular, three tools provide strong risk management

at Papa Johns:

Rk pyamd Papa Johns likes to think of how risks fitinto its decision making by aligning various risks within

the context of a risk pyramid. At the base of the pyramid

there are operational risks. At the top of the pyramid ther

are strategic risks. Business line managers and business

unit leaders follow a rigorous process to identify the signif

cant risks that could impact the company. The teams have

developed a laundry list of risks that is categorized by

risk type (e.g., strategic risks, business model risks, f inan-

cial risks, operational risks, and regular decision making

risks). The list is then reviewed and edited by the executive

team. Owners are assigned to each risk and are respon-

sible for tracking, addressing, and escalating the issuesthat arise. This model of tracking risks is in l ine with its

decentralized business model but ensures that every risk is

adequately monitored.

Rk app uvy During the risk assessment phase,

management and board members complete a r isk survey.

The survey is designed to gauge the level of risk the organi

zation is willing to accept for each of the identified risks

from unwilling to accept any risk (e.g., food safety) to

willing to take risk (e.g., the business case for internationa

expansion). These risk levels can then be aggregated to

level-set the risk appetite of the organization. Interestinglywhen management and the board began to talk about risk

appetite, the two groups did not appear to be aligned.

It took further discussion to understand that the board

and management understood the questions differently.

Rk ha map This is the primary tool used by management and the board to holistically track risk. The identifie

risks are mapped according to three criteria:

1 nl m n bn mdl;

2 bbly f n; nd

3 ly d n mlz

(n mn f, n q mdm, nd

n y l).

The CEO, CFO, general counsel, and business unit leaders

helped develop and now update and discuss the heat map

every quarter. The audit committee receives quarterly repor

on corporate risks and spends time analyzing changes

in the risk heat map. At each audit committee meeting,

8/2/2019 papa_john

3/6

.nfnbd. Director Notes risk oversight practices: two success stories 3

a business or process owner will speak about selected risks

in depth. Some topics are deemed important enough to be

discussed with the full board. Perhaps the most important

risk management oversight task that the audit committee

employs is to challenge the business model and assump-tions about the operating environment. These discussions

lead to a better understanding of both key business dr ivers

and risks that could impact those drivers.

Much of the value of the heat map for board members

comes from the discussions that are generated. The board

doesnt just see a snapshot of the risk profile, but engages in

a discussion on risk mitigation and accountability.

Risk map changes need to drivebehavior changes.Keeta Fox V Pdn, Fnan, Papa Jhn Innanal In.

Rpn k Both the board and management agreethat a heightened focus on risk has increased the focus on

risk agility (i.e., how quickly the company can respond to a

risk event). Papa Johns understands that risk management

tools and processes are ineffectual if they become a check

the box exercise or stand-alone analysis that is not embed-

ded in strategic decision making. The organization hasavoided this pitfall by fostering rich, r isk-informed dialogue

between the board and senior management and including

risk analysis in strategic decisions.

Although this case study highlights three tools, Papa Johns

incorporates risk throughout the decision-making process,

using a variety of methodologies and processes (includ-

ing shock-loss calculations using a Monte Carlo analysis

simulation model1) and has developed leading indicators

and mitigation strategies to help stay ahead of the risks the

organization is taking.

The Papa Johns story illustrates the value that risk integra-tion can bring to better decision making and the critical

role that board members can and should play in demanding

strong risk practices.

1 A nly l d f mnn nny, Un MnCl Smln Anly f Fnn, Financial Modeling Guide,lbl .fnnlmdlnd.m/nlyl-l/mn-l-mln.

The keys to Papa Johns success are:

Enn bd nd n mnmn nndf mn f mnmn nd l mdl

b.

Cn -mnmn n lyfml qn, nd ndndn ERM

b bn, n fm, nd nn

l jdmn.

W bl, n ldn nd n,n, nd mn , b y

d n.

Adn nly ly. I y y fll n f yn bl n n n ff y

ly qnfy m f nl f

f bn nlly ll ndd,

my l n mn lmn ld

l l m b n nlly dnfd.

An n ll n b md. Smm, m n nzn n d ll-dfnd

nnny/ ln nd ll-xd mmnn

y nd n.

Enn d f n ll f y , n ld n. T bd dn

lld n mn nd bd mmb b

ndnd l fm f P

Jn y d.

Mn bd nd mnmn bndndn f mny l.

Papa Johns International Inc. is an example of how a pro-

active and engaged audit committee can make a difference

in developing valuable risk management practices.

NewStar Financial

Boards and executives rarely have the luxury of designing

the culture of an organization from its beginning. NewStar

Financial, founded with a laser-sharp focus on the impor-

tance of strong risk management, is one of those rarities.

The company is in the business of buying and distributing

risk. Its risk philosophy permeates its people and processes.

NewStar Financial is a nationally recognized commercial

finance company. It was established in 2004 to capital-

ize on opportunities in middle-market lending, including

direct origination of proprietary deal flow in corporate

middle-market leveraged loans and commercial real estate.

8/2/2019 papa_john

4/6

Director Notes Risk oversight practices: two success stories .nfnbd.4

Default rates in the industry usually can rise to as high as

10 percent but reached the low teens near the end of 2009 in

the wake of the credit and liquidity crisis.

With assets well over $2 billion on its balance sheet,

NewStar was able to outperform its peers in 2009 with a

default rate in its portfolio that was approximately half of

industry benchmarks. The organization attributes a large

portion of its success in the past couple of years to its focus

from inception on robust risk management practices.

It is no surprise that a company whose business is buying

risk would focus on risk management; what is surprising is

how, from the beginning, NewStar has taken a very deliber-

ate approach to risk management, including a number of

crucial elements:

1 Apppa affng Sffn nzn bn m fd, nn

n mnmn m ffd nddl

mll y f xn n y

f d. In l, mmb f fl mn-

mn m , n , m n 20 y

f xn (m m n 30). NS

fd n bn n, b n mnmn nd

n bd: nddl d d

ndndn f fnnl mn l flly

ld d ll f .

2 Indvdual d ln NS lly

dfnd l lln,

n n l , f x

lm n ndy nnn, nd nddl x

lm. T nmn mm, nld CEO

nd f nmn ff, nd

ln; fm, f ln l m b

nnmly fd by ndn mm

n nmn mm. T nmn

mm n nd n ln nl

NS d ln

flly flld. NS mly

d nn , nd n d dln

nldn mn mnmn, n ,dln fnnl mdl, ln dly ln,

nd lln ln m (.., lzn,

qly f mnmn, nd dnd n). E

dl nld nn n y

dn-mn bl f n

n n, NS mnmn n nld

ly m nd nl .

3 Cnan pfl mnng NS lly

mnn fl n n ly n

m ndn n. T bn

mnly nnl bln f f ldn nd,

flld by qly f d n,nd mnly m fqn f n

l, qd. If ny, n mnmn

ll m dly mn nd nd lqdy ll

nd dj ll f (.., ln n

nmn n n f dmd y). Fm

bd , dl f d-

n n mn f mm

ndnd. T mm mmb nd dl

n d bd, mnmn, nd

nd nmb y n.

Bynd , bd nd n l

nbl f .

4 Rgula mmunan NS bl

m nn ld, m n-

fdn ld ll fl NS ndl n

. T bnf f mmnn

dn dn dffl m n n fnnl

, n NS ld b-ly bd nfn

ll. Bd mmb ld ll n n d n

n f fl nd ny n bn

n. NS ld nly mlmn

ffly b nzn nd n n

nf nfmn n nd n

m dn nd nfmn bd n m,mnmn bl, fl mn, nd

l, bf d. Tnny fnd-

mnl l f NS nd nbld n

llnn nnmn.

5 Hl k dun T mny nz

dn qnfy f n m y

d fnnl, d, lqdy nd y .

H, NS n ly mn

mny f f , nldn nn f y

nnl.

6 U f k app NS lly dfnd

f fmn nnl nl nd

n. In m m dffn m n d

yl, mnmn m my dd

l n ld . T mny

dynm f fm nd

mny ll mn nd nx f

n n nnmn.

8/2/2019 papa_john

5/6

.nfnbd. Director Notes risk oversight practices: two success stories 5

From its start, NewStar hired a cadre ofrisk management professionals whowere world-class risk management and

senior credit people. They [understood]risk quantification, capital allocation, riskreporting and applied these techniquesto this very small company.

Charles Bravler , wSa Fnanal

NewStars story reinforces the value (and luxury) of a com-

pany built on a strong understanding of and commitment

to risk management. The keys to NewStars success are:

Fmn m f xnd fnl, ll f m d bnd.

Ebln bd d nd x b bl ndnd nd lln y n

d mnn.

Alyn dlnd n x, nnm d mnly, n nn f y

nn, nd lly dfnn lm.

Dln d blm ln m f xnd fnl.

Alln f mn f n fndn nd lymnn lqdy nn dnn.

Pdn n nd l mmnn nllnfdn n y ld.

Aly nn bd nd mmn .

Enn bn n n n.

Dln n flxbly ndqly m n.

Conclusion

Papa Johns International Inc. and NewStar Financial

share active, engaged boards whose focus on risk man-

agement has helped them create and reinforce strong risk

management.

In the most challenging of operating environments,

NewStars effective risk management program and gover-

nance structure has enabled it to continue to focus on its

mission and respond quickly to protect the organization.

Similarly, the courage of one of Papa Johns board mem-

bers to stimulate senior executives to identify and evaluate

the weaknesses of their existing risk management practices

to move toward an integrated ERM-type program has ben-

efited the organization in countless ways.

Its important to recognize that neither company would

say that their risk management journeys are complete;

effective enterprise r isk management demands continuous

improvement. It is not possible to avoid all risks, but strong

ERM can help companies avoid some risks and frame risk

as part of strategy to encompass opportunity as well as

negative events. Both case studies show that risk oversight

is not a passive job. It is the responsibility of each director

to remain engaged in the process to ensure the board is

adequately informed and aligned with the organizations

risk philosophy and policy.

8/2/2019 papa_john

6/6

About the Author

Ell S. Hxt is a senior advisor at The Conference Board,

where she develops research on enterprise risk management

and manages seven councils, including the European and U.S.Strategic Risk Councils, the Council of Financial Executives,

and the South Asia Council on Corporate Governance and Risk

Management. Hexter is the author of numerous reports on

enterprise risk management and frequently speaks on risk and

governance issues. She also serves as a faculty member of The

Conference Board Directors Institute. Hexter received an A.B.

from the University of Michigan and an M.B.A. from Cleveland

State University. She is a Chartered Financial Analyst and serves

as an arbitrator for the National Association of Securities Dealers

(NASD).

Gy Vb is an associate principal in the Montreal office

of McKinsey & Co. Since joining the firm in 2006, he has workedin the electric power, basic materials, and institutional investing

sectors. He has helped organizations on a variety of risk-related

topics, including the design of their risk function, creating risk and

return dashboards, reviewing their project valuation approaches,

and formulating hedging policy.

Prior to joining the firm, he completed aPh.D. in financeand a

Bachelors degree in computer engineering from McGill University.

He is the author of Option Pricing Models and Volatility Using

Excel-VBA.

Acknowledgments

The authors would like to acknowledge Andr Brodeur,

Christopher Donohue, Claude Fontaine, William May, Martin

Pergler, Tony Santomero, for their contributions to this research

project and Gary Larkin for his editorial finesse. The authors

would also like to thank Charles Bravler, Olivia Kirtley, Keeta Fox,

and Peter Schmidt-Fellner for their sharing insights into their

companies practices.

About Director Notes

Director Notes is a series of online publications in which The

Conference Board engages experts from several disciplines of

business leadership, including corporate governance, risk over-sight, and sustainability, in an open dialogue about topical issues

of concern to member companies. The opinions expressed in

this report are those of the author(s) only and do not necessarily

reflect the views of The Conference Board. The Conference Boar

makes no representation as to the accuracy and completeness

of the content. This report is not intended to provide legal advice

with respect to any particular situation, and no legal or business

decision should be based solely on its content.

About the Series Director

Mtt Tll is director, corporate governance research, atThe Conference Board in New York. For The Conference Board,

Tonello has conducted governance and risk management analyse

and research in collaboration with leading corporations, institu-

tional investors, and professional firms. Also, he has participated

as a speaker and moderator in educational programs on gover-

nance best practices. Recently, Tonello served as the co-chair

of The Conference Boards Expert Committee on Shareholder

Activism and as a member of the Technical Advisory Group to Th

Conference Board Task Force on Executive Compensation. Befor

joining The Conference Board, he practiced corporate law at Dav

Polk & Wardwell. Tonello is a graduate of Harvard Law School an

the University of Bologna.

About The Conference Board

The Conference Board is the worlds preeminent business mem-

bership and research organization. Best known for the Consume

Confidence Index and the Leading Economic Indicators, The

Conference Board has, for over 90 years, equipped the worlds

leading corporations with practical knowledge through issues-

oriented research and senior executive peer-to-peer meetings.

2011 by The Conference Board, Inc. All rights reserved. Printed in the U.S.A.

The Conference Board and the torch logo are registered trademarks of The Conference Board, Inc.

F m fmt t t, l tt:

Matteo Tonello, LL.M., S.J.D., director, corporate governance, at 212 339 0335 or matteo.tonello@conferenceboard.org.

T Cf B www.conferenceboard.org

T Am 845 Third Avenue, New York, NY 10022-6600, United States / Tel +1 212 759 0900 / Fax +1 212 980 7014

A china Beijing Representative Office, 7-2-72 Qijiayuan, 9 Jianwai Street, Beijing 100600 P.R. China / Tel +86 10 8532 4688 / Fax +86 10 8532 5332 /

www.conferenceboard.cn

hong kong Suite No. 2-3, 18/F, Queens Place, 74 Queens Road Central, Hong Kong SAR / Tel +852 2804 1000 / Fax +852 2869 1403

india A-701 Mahalaxmi Heights, Keshavrao Khadye Marg, Mahalaxmi (East), Mumbai 400 011 India / Tel +91 22 23051402

singapore 8 Eu Tong Sen Street #22-81, The Central, Singapore 059818 / Tel +65 6325 3121 / Fax +65 6222 4637

Eu Chausse de La Hulpe 130, box 11, B-1000 Brussels, Belgium / Tel +32 2 675 54 05 / Fax +32 2 675 03 95

T Cf B f C 255 Smyth Road, Ottawa ON K1H 8M7, Canada / Tel +1 613 526 3280 / Fax +1 613 526 4857

www.conferenceboard.ca