1. What are Jason's options?

Can he accept a risk management program that does not involve the
legal department?

Basically, Jason have following options

 Not involving the legal team in the risk management program but understanding the more
significant risks to the organization and assign each area of risks to individual executives
with in the company and making sure the actions are taken to mitigate the risks.
 Hiring a special dedicated legal team as a part of risk management process so that, it can
handle different lawsuits which involve millions of dollars and bring down the major legal
risks.
In my view Jason should not accept any risk management program that does not involve the legal
department because being a billion-dollar technology company and listed in the top stock
exchanges it should not risk millions of dollars in multiple lawsuits. There can be different legal
risks like patent issues, dual licenses etc that are legally too technical to face for any organization’s
higher management. It is also mentioned that BSC is subject to all US Securities and SEC filing
requirements. So, to have a better understanding of these legal risks BSC has to have a legal
department.

2. Do you agree with George's arguments? Are they valid?

Yes, I do agree but to some extent because George believes that involvement of the legal team will
constitute formal risk discussions which lead to unnecessary disclosures to the company’s
disclosures. Yes his arguments are logical and have huge possibility, But it is only one part the risk
that should be considered if there is no legal team the company has to face more risks, since those
risks are very legal know-how which cannot be understood by company’s leadership and if some
lawsuits are filled on the company whole organization has to face the impact.

3. How would you proceed, if you were the risk officer?

If I am a risk officer, I would definitely consider involving the dedicated legal team to manage legal
risks and since, George mentioned that if legal team is involved it would lead to unnecessary
disclosures I would take necessary actions such that the legal team can disclosure only certain
areas where major risks are involved and for some small issues I would make internal team to
involve and take responsibility of the risk management and mitigate those risks with informal
discussions which would be like a normal part of running a business .