LORENZO MESSINA: What EOH can teach us about strengthening risk culture

Previously making headlines for its role in large-scale tender irregularities, EOH recently earned praise from the Zondo commission of inquiry into state capture for its efforts to clean up the company’s image. It’s a turnaround worth a closer look.

Testifying before the commission, Stephen van Coller, who was appointed CEO of EOH in 2018 with a mandate to rescue the business, explained how they have taken steps to bolster management accountability and commercial viability along with efforts to shift the organisation’s risk culture, which he identifies as the root cause of the corruption that brought the company to its knees in 2017.

A strong risk culture — essentially the mindsets and behavioural norms that determine how an organisation identifies and manages risk — can be a critical component of institutional resilience in the face of shocks. This means that in today’s turbulent world, it matters more than ever.

In a recent study, McKinsey points out that organisations that have developed a mature risk and integrity culture tend to outperform their peers through economic cycles. “A good risk culture allows an organisation to move with speed without breaking things. It is an organisation’s best cross-cutting defence,” the authors argue.

By contrast, in the case of EOH, the lack of a robust risk culture caused them to break a lot of things on the way down. The beginning of the end for EOH came out of nowhere. On December 7 2017 the company’s share price nosedived 35% after a margin call prompted by the sale of about R138m in shares by two high-profile company directors sent investors into a panic and spooked the markets.

An independent investigation initiated by Van Coller and carried out by law firm ENSafrica in 2018 revealed deep-rooted risk culture gaps that had allowed corrupt dealings to go undetected because there were no policies, governance structures and processes in place to enforce accountability and transparency. The rot had set in from the top, where all the decision-making power had vested with a handful of directors who had simply wielded too much power.

Severe governance failures, including collusion between company employees and the buyers and sellers of software sold by EOH were laid bare. The investigation lifted the lid on government tender irregularities, inappropriate gifting and promotions, unsubstantiated payments and timing lapses on work done and payments made.

The  risk failures Van Coller inherited on his appointment included under-invoicing and over-charging of Microsoft contracts and gaps in policies, corporate governance and financial controls. He believes that complex corporate structures, limited governance and compliance, lack of board independence, the use of middlemen and the lack of whistle-blowing avenues are the red flags for potentially corrupt practices and evidence of a poor risk culture and must form the bedrock of structures to rebuild. Three things stand out.

First, accountability and transparency are important, and checks and balances need to be established across the organisation. EOH has implemented three layers of such checks: in front-line employees, with a compliance and internal audit function and an external audit. Van Coller appointed new personnel untainted by the company’s corrupt legacy, notably a chief risk officer and a new CFO, to boost accountability of the control functions. And his own transparency about the turnaround strategy — including multiple interviews with media, the ENSafrica investigation and testimony at the Zondo commission — all speak to this spirit of accountability.

Second, it’s important to make it easy for whistle-blowers to come forward, and EOH has now developed an app to allow people to make their voices heard. As Kurt Meyer, Anette Mike, and Robert S Kaplan write in the Harvard Business Review, psychological safety around risk reporting is, as a solid body of research indicates, essential to the speak-up culture that is the oxygen of risk management. Equally important, there must be structures in place for information to be acted on and the tone for risk visibility and accountability starts at the top.

Which is also why, third, board independence is a non-negotiable for a healthy risk culture. SA has world-class governance guidelines in place but implementation of these depends on the rigour and quality of the board. As EY’s Kris Pederson argues, leading boards have talent and culture issues as standing items on the agenda. The EY Global Board Risk Survey 2021 found that 80% of companies leading on risk management often or always talk about the culture needed to support the organisation’s strategy at board meetings.

While it is tempting to view the sequence of events leading up to the downfall of EOH — and indeed other big corporate scandals — as just another case of greedy leadership that has nothing to do with culture, the story of EOH’s rise and fall and rise again reminds us that culture is often at the heart of such incidents.

As Van Coller says: “Businesses aren’t corrupt, people are. Corruption is instigated, normalised and practised by individuals who have made the choice to be corrupt, or overlook corruption. If you don’t have a culture of doing the right things, in the right way, with the right customers, you’re finished. Combating that culture of corruption can revive a business. Culture beats strategy every day.”

• Messina is a lecturer at Henley Business School Africa and author of the new Henley case study: ‘EOH: corruption, losses & the impact of a poor risk culture’.