The recent pilot debacle at airline Ryanair is a prime example of how governance decisions made at the board level can have wide reaching implications. Risk managers across all sectors should take heed of the lessons learned. By Antony Ireland

Irish low-cost airline Ryanair may claim it is on track to make a record profit this year, but having been through an employment dispute that is set to cost €100m in pay increases, led to the cancellation of 20,000 flights and dented its reputation, the company presents a fine lesson in governance risk.

With a business model built on cost saving, Ryanair often employs young pilots on much lower salaries than traditional airlines. However, a dispute over work rosters, pay and demanding hours has dragged the company’s employment practices through the mud, culminating in costly strikes.

On 22 September a caller to LBC Radio claiming to be a “furious” Ryanair pilot claimed that Ryanair charged applicants €300 to attend job interviews, €29,500 to complete training, before being put on zero-hour contracts, earning as little as €20 per hour on their first flights, and having to cover their own expenses, from hotels to even drinking water.

He claimed that because of these working conditions, Ryanair was suffering an exodus of pilots to rival airlines, many of whom were leaving within the first 12 months of their employment.

CEO Michael O’Leary had earlier done little to calm dissent in the ranks, reportedly calling the pilots “precious and full of their own self-importance”, while denying that they could suffer from fatigue due to limitations on the number of hours they can fly per week.

Ryanair said there was no evidence the LBC caller was a pilot, denied that it put pilots on zero-hour contracts or charged for training or interviews, and insisted free filtered water was available.

Amid the ensuing flight cancellations, media frenzy and social media posts from disgruntled employees, Ryanair’s share price fell by around 20% between 16 August and 25 October.

A pilot from a rival airline tells StrategicRISK that he fears Ryanair’s working environment could even compromise passenger safety. “Graduates leave pilot school with debt of around £100,000, and as such are desperate to take on as much work as they can to clear their debts,” he says.

“Budget airlines are also under huge pressure to maintain punctuality. Some of us in the pilot community question whether this creates the right environment for pilots and ground crews to adequately conduct the necessary safety checks and procedures,” says the source.

“The combination of pilot debt, fatigue and pressure to maintain punctuality is not necessarily conducive to a safe working environment,” the pilot adds.

StrategicRISK approached Ryanair for comment on these issues but received no response.

Failures of governance can take many forms and have wide-reaching implications for companies in every sector, but safety failure is undoubtedly the biggest risk faced by airlines. Specialist human expertise is essential, making workplace conditions a key risk factor.

“Airlines have a high dependency on specific personnel, from pilots to ground crew, so how management interacts with the workforce is very important. This includes remuneration and working conditions,” says Thomas Poppensieker, senior partner with consulting firm McKinsey & Co. “It is surprising that given increased volatility in the business environment many companies have not adjusted their management processes to reflect the increase in risk.”

Recent insolvencies and strikes in the aviation sector suggest that some airlines are passing the cost pressure they face onto their workforces. Setting the right compensation model is “a great way to avoid suffering the wrath of the shareholder activist”, according to Steve Shappell, chief legal officer at JLT Specialty.

“Many of our clients spend a lot of time addressing questions around compensation, compensation committees, who advises them, and how the dots are connected between various committees and the board to ensure the governance is in place and followed.”

Ryanair is not the only firm to have experienced disastrous personnel-related issues this year; disruptive taxi firm Uber recently lost its licence to operate in London due to concerns that its workforce structure posed public safety and security risks.

Other sectors may have different governance priorities. Pharmaceutical companies, for example, will be highly focused on regulatory compliance around the sale and promotion of drugs, while a grocery store chain is reliant on inventory and market recognition.

“Good governance starts with identifying the risks you are dealing with, and understanding the factors that drive these risks,” says Poppensieker. It is also essential to establish which senior management decisions have the biggest impact on the company, and how the implications of these decisions can manifest down the line, he explains.

“Board decisions are fundamental to any company, and good governance always asks what the outcome of important decisions would be under various scenarios, whether technical, workforce-related or concerning the company’s dependency on external events.”

The German utility sector is a prime example of an industry in which boards have fallen foul of external events and disruptions, such as the exit from nuclear energy after the Fukushima disaster and the rise of renewables. This, says Poppensieker, has led to some ill-judged investments as the energy market polarises into fossil fuel and renewable approaches, both with very different risk profiles.

Similarly, leaders in the banking sector did not foresee the intense clampdown on consumer protection that has led to large settlements for mis-sold payment protection insurance, and other misdemeanours.

“Good governance means an organisation doesn’t get blindsided by developments, even if they are not on their immediate radar,” Poppensieker says. “Companies with good governance incorporate forward looking analyses into the DNA of their decision making, rather than simply extrapolating past trends.”

Looking backwards could have better prepared Ryanair; its workplace practices had previously been called out numerous times and fallen foul of employment laws in France and Denmark. By taking heed of such warnings, management could have foreseen a PR disaster coming.

The stakes of poor governance are rising for senior executives, as regulators have become more sensitive to governance issues and increasingly hold board members and executive teams personally liable for risk incidents.

“Even when it is impossible to identify personal liability, organisations now have a responsibility to ensure adequate risk and compliance and robust governance processes are in place,” says Poppensieker.

This, says Shappell can also mean bringing in third parties with specialist skills and experience to help deal with challenging risks and decisions. “Good governance includes consulting with experts in areas in which you lack expertise.”

This may be particularly relevant to smaller firms that lack the resources to set up various committees to deal with personnel, compliance and other governance hotspots, and who may also be struggling to meet today’s heightened regulatory governance burden using internal resources alone.

“Just because you’re a smaller organisation, you don’t get a pass from having good corporate governance. Many companies spend resources on putting processes, checks and balances in place, then don’t execute on them. You have to do both,” says Shappell.

“Companies with limited resources may have to ask more from their general counsels or heads of compliance, risk or audit to ensure governance structures are in place and upheld.”


Key governance questions

McKinsey & Co. views governance risk and compliance (GRC) in four layers - risk governance; ERM framework; commercial, technical and strategic risk and control processes; and risk culture, which includes training, incentives, norms and values.

According to Thomas Poppensieker, senior partner at McKinsey, companies with good governance should be able to answer the following questions:

- Which senior management decisions are fundamental to the company’s risk profile?

- Do you know the risks you face and how important they are?

- How often is risk reporting done?

- Who puts risk considerations forward, and how do you engage with them?

- Which risk control frameworks are in place, and which need to be expanded?

- What new risks are emerging and how do you plan to deal with them?