Legal counsel plays a central role in modern business risk management — from identification and assessment to designing appropriate controls.
This article analyzes in detail the role of legal counsel in business risk management activities in Vietnam, based on VDD LAWYERS' consulting experience with many clients.
1. What Is Legal Risk?
Legal risk is the possibility that a business suffers financial losses, reputation damage, or business opportunities due to:
- Legal violations: intentional or unintentional violations of regulations
- Contract disputes: being sued or suing partners
- Legal changes: new regulations changing business model
- Government agency actions: inspections, audits, penalties
- Labor disputes: from employees
- IP infringement: being sued by other companies or being infringed
2. Legal Risk Management Process
2.1. Risk Identification
Legal counsel leads creating a list of all potential legal risks through:
- Periodic legal audit: annual review of all contracts, licenses, processes
- Interview departments: sales, finance, HR, production — each has its own risks
- Monitor legal changes: monthly legal newsletter to detect new risks
- Analyze internal and external incidents: learn from industry cases
2.2. Risk Assessment
Each risk is assessed on 2 dimensions:
- Probability: low / medium / high
- Impact level: light / moderate / severe / catastrophic
Results form a risk matrix with 4 zones:
- Red (high-high): must address immediately
- Orange (high-medium or medium-high): plan action
- Yellow (medium-medium): monitor with controls
- Green (low): accept or monitor
2.3. Risk Treatment
For each risk, 4 main strategies:
- Avoid: stop participating in that activity
- Mitigate: implement measures to reduce probability or impact
- Transfer: buy insurance, push risk to partner via contract
- Accept: for small risks or where control cost exceeds risk
2.4. Monitoring and Reporting
Legal counsel builds legal risk dashboard with indicators:
- Number of disputes in progress and potential loss value
- Number of new regulations affecting and compliance status
- Contract review compliance rate
- Legal incidents in period
- Employee compliance training rate
3. Typical Legal Risks by Industry
3.1. Manufacturing
- Environmental risk: discharge, pollution
- Labor safety risk: accidents, occupational disease
- Product quality risk: recalls, compensation
- Material import risk: taxes, customs, certification
3.2. Real Estate
- Land legal risk: planning, site clearance
- Project financing risk: capital raising, selling before eligible
- Customer dispute risk: delivery delays, commitment failures
3.3. Technology
- IP risk: copyright, patent infringement
- Personal data protection risk (PDPD)
- Compliance with cyber content regulations
3.4. Financial Services - Banking
- Compliance risk — AML, KYC
- International payment risk
- New financial product legal risk
4. Legal Risk Management Organization
The "three lines of defense" model is recommended:
- Line 1: business departments — proactively identify and control risks in daily operations
- Line 2: legal and compliance departments — develop policies, check compliance
- Line 3: internal audit — independently evaluate effectiveness of Lines 1 and 2
Legal counsel leads Line 2 and supports Line 1 through training and tools.
5. Risk Management Tool Investment
Useful tools:
- Contract Lifecycle Management (CLM): track contract lifecycle, alert before expiry
- Case management system: track ongoing disputes
- Contract template library: standardize to avoid self-drafted risks
- Legal monitoring system: automatic regulation updates
- Compliance e-learning: periodic employee training
This article is for reference only. Please contact a lawyer for accurate advice on your business situation.
Frequently Asked Questions
Do small businesses need legal risk management systems?
Yes, but at simple scale fitting size. Businesses under 50 staff may not need legal department but should have basic risk list and contract review process. External counsel can help build this framework at reasonable cost.
How often should legal audit be conducted?
Large businesses should do comprehensive audit annually and topic-specific review quarterly. Mid-sized may audit every 2 years. Small businesses should at minimum audit at major events: ownership change, business expansion, fundraising.
Can liability insurance replace risk management?
No. Insurance only transfers financial risk after incidents occur, does not eliminate reputation, criminal, or uninsured losses. Businesses need to combine prevention (risk management) and transfer (insurance).
What KPIs evaluate legal department effectiveness in risk management?
Reference KPIs: contract review compliance rate (>95%), declining legal incidents over periods, dispute success rate, legal request response time, employee compliance training completion rate.
Should compliance and legal be separated into two departments?
Depends on size. Businesses under 1,000 staff typically combine. Large businesses especially in finance, pharma, energy should separate: compliance focuses on regulation compliance, legal handles transactions and disputes. Both need close coordination.