9.1 GENERALITIES AND PRESENTATION

The Wellcome Trust is a charitable endowment fund, registered with the UK Charity Commission. The Wellcome Trust was established in 1936 under the will of Henry Wellcome, founder of the Wellcome pharmaceutical company. Initially the Trust was funded from company profits as it owned shares of the company and received dividends. In 1992, the shares were sold thus severing direct links with the pharmaceutical industry. The money raised was invested in an endowment fund with the sole purpose of providing income for the Wellcome Trust. That endowment is now worth over £14 billion and provides an income annually of £600–700 million.

Despite its not-for-profit status and being a charity, the Trust is still among the top 100 companies paying taxes to the UK government, mainly VAT (value added tax) and transaction tax on the investment portfolio.

The Wellcome Trust funds research in universities and other educational institutions in the field of bio-medical research for humans and animals. It also funds a public engagement program to promote understanding of science. It has recently created a new subsidiary, Syncona, endowed with £200 million in funds, which will invest in companies in the bio industry – start-up or small companies – in order to ensure practical adaptation of the science for end users.

Academic institutions apply for funding directly to the Trust, where an internal team of scientists creates a shortlist. Final selection is made by expert committees from across the world, chosen for their expertise. The Trust has a staff comprising 2000 employees. Half of these work at the Trust headquarters or at the adjoining Museum, and half work in Cambridge, England at the Sanger Institute, a wholly-owned not-for-profit subsidiary of the Institute devoted to genome research. The Trust also funds research outside of the UK through academic institutions in Malawi, Kenya, South Africa, Vietnam and Thailand. Funding overseas is cost effective and the work increases the level of science and research competencies in those countries.

The Trust also partners with other charity, governmental and not-for-profit institutions that could be seen as competition but in reality work cooperatively. These institutions include universities, the Gates Foundation and the Howard Hughes Foundation.

The major stakeholders are:

• Charity commission (a charter needs to be complied with).
• UK government – encouraging a culture of sciences (Education, Health).
• NHS – National Health Service in the UK.
• European Union authorities (policy influencing, animal research, stem cell research, etc.).
• Animal protection groups (not high on their list but still be aware of very limited action).
• University community, especially in the UK.
• Medical Research Council (GOV) and Cancer Research UK (Charity).

The institute's mission statement clearly defines its purpose: “To achieve extraordinary improvements in human and animal health. In pursuit of this, we support the brightest minds in biomedical research and the medical humanities.”

However, beyond research grants, the Institutes operate in different directions to improve the public understanding and knowledge of the biomedical science and advances, and that includes:

• A robust public engagement to inform the public through the Wellcome Collection (exhibits collected by Henry Wellcome which are all linked to health and medicine) and visiting exhibitions – one held in early 2013 was about “Death”: art related to death. Exhibitions are planned to be controversial and ask the viewer to question science and medicine. The current exhibition includes paintings from disabled and psychiatric patients in Japan.
• Education in schools (Darwin, etc.).
• Improvement of science teaching in schools (funding of residential courses for teachers).

9.2 THE ERM PROGRAM

In 2008, a risk professional was hired to understand and promote risk management in the investment portfolio. The risk manager embarked on a journey to raise the need of the organization for a global and integrated approach to risk management far beyond the limited scope of the investment portfolio. The ERM responsibility now covers all other areas of Trust activity.

Contrary to many organizations, no adverse event prompted top management to move towards ERM, but the environment and the context were opportune.

The scope of the ERM implementation for Wellcome is clearly defined. In principle it leads a process for the management of all risks except those in the investment portfolio. While there is a connection through a strategic risk identified with the investment portfolio, the ERM program deliberately has no direct involvement in investments. The ERM manager also manages the insurance portfolio but not health and safety, which has its own professional manager. The two managers do interact and share information.

The executive board and the board of trustees endorsed the establishment of the ERM program and made the original decision to hire a risk management professional. There is no legal or regulatory obligation for the trust to set up the function. The ERM manager reports to the COO who is part of the executive board (comprising of eight members). Internal audit reports to the COO and the audit program is largely delivered by Deloitte but supervised by one direct Trust employee.

Fiona Davidge, the incumbent risk manager, assumed the position in 2012. She holds a law degree, a diploma in RM and is a FIRM and M-BCI. She has 14 years' experience in risk management but had not been directly involved with insurance purchasing until joining Wellcome. She found that her experience in managing risks helped her to understand the scope of the job and she did not find a huge challenge in tending to the insurance portfolio thanks to the assistance of a broker – Aon. Wellcome has global exposures requiring a broker with a worldwide expertise.

The COO chairs the risk committee, which has four members of the executive team (involved in rotation), the two risk professionals, head of finance and a member of the investment team as permanent attendees. Each main department has a risk champion – a senior manager – who is in charge of the periodic review with risk owners. Davidge feels that she has the full support of the executive teams and has adequate resources.

The organization has a clear strategic plan and an operational plan (clearly articulated objectives) and set up regular meetings to ensure involvement of RM in the process. In the risk register, the link between strategic objectives and risk is identified and managed.

The risk register is held as a Word document and there is no specific software as it is not needed. The risk committee provides full papers to the whole executive and the board of trustees. Minutes are available to all staff on the intranet. Specialists are invited as required to the risk committee to examine specific issues (such as IT resilience, health and safety, business continuity). The periodic review is well accepted by risk owners who view it as an opportunity to enhance their performance.

When she arrived at Wellcome, Fiona had these goals:

• “Tidy up” the risk register that contained “non risks” and “risk controls” instead of just active risks. Reduce the number of risks (from 32 to 18) and bring more focus on risk mitigation.
• Develop an annex for key risk controls. The annex requires an annual review unless the risk control owner feels it has to be reviewed sooner.
• Make sure that systematic project RM is in place for major projects like the one currently in progress to refurbish the exhibition building next door to the Wellcome Institute headquarters in London.

The heat map reproduced in Figure 9.1 provides an evaluation based on impact and probability. The main issues considered are cash flows, investments, health and safety issues, and reputation. Wellcome controls the grantees as they look into the reality of research results. Wellcome leadership is especially keen on verifying the reality of the research results and must remain beware of the risks of falsified result claims used to justify funding.

While the investment department has developed its own controls, the ERM had shied away from complex approaches and adopted the “KISS” motto (Keep it simple stupid) and has traditional controls that reflect the ISO 31000:2009 terminology.

So far, the Institute has not identified any surprise challenges for critical risks. As it is not a large organization, it is felt that most risks have been identified. What risk management has brought is a more systematic approach to risk management, which is presumed to be more efficient. However, there can be surprises overseas, for example, when the money does not find its way to the end users (not necessarily fraud but lack of competence).

The following processes and procedures related to disruption planning and reinforcement for the institute resilience have been developed:

1. Business continuity in place at London headquarters and at Sanger.
2. Auditing funding programs.
3. Generic response plans with a crisis management procedure. Activation route will depend on the nature of the potential crisis. Communication is then assessed and implemented.
4. Evacuation plans.
5. Business continuity plans exercised twice a year.
6. All members of staff have business continuity information card and know what to do in an emergency.

9.3 THE BENEFITS OF ERM: COST AND BENEFIT ANALYSIS

The heat impact map is mostly assessed in financial terms (for investment in percentage of portfolio) but the impact on Wellcome's reputation cannot be ignored as it might result mostly in a challenge to its charitable status. Also the loss of scientific credibility could jeopardize the very existence of the Institute. Health and safety are also taken into account. However, there is no performance indicator as such due to the specific activities involved in health and safety.

Success is measured by how “uncertainty” becomes part of the natural way of doing business. The only measure is linked to return on investment (there are ceilings to the percentage of investment at risk in decision making). The endowment must generate the money needed but this can be difficult in certain economic conditions like the recent great recession. The only “no-no” investment area is the tobacco industry (others may be debated).

The managers have no direct incentive to participate in the risk management effort. There is presently no direct incentive in the “bonus equation” – and with the not-for-profit culture bonuses are very limited (small bonuses are in place for the investment team but their size is limited compared to an investment banking or hedge fund). One important note is that the time horizon for investment is much longer than in commercially driven funds so Wellcome is able to take a longer-term investment view.

The costs associated with ERM consist mostly in salary and related expenses: one full time person and one in “investment”. Insurance premiums are part of cost but are carefully managed. Being a risk champion is part of each manager's job. The main benefits gained from how risk management is organized are efficiency gains and focus on the essential, but this is not easily translated into financial terms.

9.4 THE PROBLEMS OR CHALLENGES ASSOCIATED WITH ERM

One of the major challenges is to maintain the attention of all involved, to keep the risk management process afloat and relevant to objectives, and to prevent it from being linked to the view that it is only about events/accidents.

In management meetings, risks are managed but not necessarily consciously and systematically – this is the added benefit of a formalized risk management approach. However, sustaining ERM over time does not come naturally and requires a strong personal engagement, and engagement of everyone, especially the new employees.

The quantification of results, or lack thereof, is not really an issue at Wellcome Trust as RM has become a natural way of doing business.

However, Wellcome understands it still is in the learning curve for ERM:

• New hires are educated during the induction process (seminar); and
• The intranet is being realigned to better explain ERM to employees.

The 3-year strategic plan is reviewed with RM in attendance and remarks are expected, but there is still room to identify more clearly the risks that could potentially impact strategic goals. Also, the procurement process is reviewed and RM is checked with the tender offer process (mostly IT due to the specific activity). Davidge has found that on the whole the executive level is more aligned with RM issues than what she experienced at a previous employer.

9.5 RECOMMENDATIONS FOR OTHERS SEEKING TO IMPLEMENT ERM

For those organizations and professionals engaging in the development and the implementation of an ERM programs, Davidge has the following advice: Work on clear objectives otherwise it does not go beyond “emergency” management. Strategic objectives are at the heart of the RM process.

Davidge suggested that there are two pitfalls to avoid in risk management:

• One size fits all (i.e. in a smaller organization, personal interaction matters more and in larger need of proper structure).
• Be wary of heavy methodology for light structure (risk management information system, business information system or analytics).

More specifically it is essential to avoid unnecessarily complex procedures that would duplicate existing management systems.

At a previous job Davidge explained that disbanding the RM committee proved a bad idea, as its replacement did not materialize. She suggested that this might be considered only when risk management maturity is such that risk management is actually totally woven in the management process and culture. No organization today can afford not to invest in a robust risk management framework but top management active involvement is essential.

Davidge must coach all managers on keeping the RM viable everywhere and this includes taking an active part in the project risk management exercises for major investment projects, such as the exhibition building that is being refurbished.

Fiona is a member of the group of international experts that is in charge of writing the Risk Management Standards for the International Standard Organization (WG 262) currently working on the implementation guide for the ISO 31000:2009 (ISO 31004). She is also active with the IRM (Institute of Risk Management in London) and recommends such involvement to her peers as she finds that sharing experience with other professionals is a key to successful ERM implementation in one's own organization.

9.6 QUESTIONS FOR STUDENTS AND PRACTITIONERS

1. Use the Wellcome Trust Corporate Risk Matrix to identify critical risks for a company of your choosing or one that your instructor provides.
   1. Relate these critical risks to the strategies and strategic plan of the organization.
   2. Define the impact of these critical risks to the organization and develop a risk management strategy for each.
2. Identify potential risks to reputation that could affect an organization like Wellcome Trust.
3. In this case it was determined that the horizon for investments in ERM is longer than other measures used to incentivize managers. Develop an incentive program for executives and managers of the Wellcome Trust that will be in sync with a longer investment horizon for ERM.
4. Not-for-profit enterprises do not produce profits. Traditional measures used to assess the value, and change in value, of publicly traded organizations are not appropriate to evaluate the ERM initiative.
   1. What measures would you recommend that not-for-profit organizations use to assess the value of their ERM implementation?
   2. How can the not-for-profit enterprise provide evidence that their ERM activities are producing the value and not other activities or influences?
5. What are the characteristics of a good athletic coach? Translate these characteristics into the characteristics for being a good risk management coach. Would you add additional characteristics or competencies, if so, what and why?