As the top risk manager at Reynolds American, SusanWilson has had plenty of risks to be concerned about. Starting in2004, there was the integration of the second and third largestU.S. tobacco companies, R.J. Reynolds and Brown & WilliamsonTobacco, to form Reynolds American. Litigation with the states andindividual plaintiffs continues. Last year, Congress gave the U.S.Food and Drug Administration new regulatory authority over tobaccoproducts. And imploding credit markets and a severe recession havesocked nearly all of corporate America.

It was the merger, however, that prepped Reynolds American todeal with later events. Wilson, who had just been promoted togeneral auditor at R.J. Reynolds, was tasked with examining themerged company's integration risk, an analysis that took her intoevery nook and cranny of its business units.

Susan Wilson

“It was the first time we took a very holistic view–puteverything in one place–to view what the primary integration riskswere,” says Wilson, who joined R.J. Reynolds in 1988 as a financialanalyst and previously ran her own financial planning firm.

Under Wilson, the general audit has evolved from a historicaland controls-based function to one that includes risk management,ensuring FDA compliance, and compliance services, an internalconsulting arm. In 2005, Wilson headed the effort to extend riskmanagement not only within each operating company but across theenterprise and into each of its business processes, from marketingto operations. “I wanted to evolve internal audit to have a morevalue-add and forward-looking focus.” she says.

That paid off after Lehman Brothers' collapse in September 2008,when credit all but froze. Reynolds American, with more than $8.4billion in sales last year, was already calling customers andvendors on a weekly basis to assess its credit risk exposure, andmitigate it when necessary.

“One of our risk metrics is surprise-risk events, and we didn'thave any,” Wilson says.

Reynolds American has defined three levels of risk, startingwith five broad risk categories in the following priority: businessstrategy; marketing and business; financial performance;operations; and compliance, financial reporting and fraud. The nextlevel comprises 35 types of risk, such as a catastrophic event orfire, that fall under the category of operations risk. A thirdlevel defines 60 even more detailed risks.

That's the “top down” risk universe that comes with apre-established set of risk management tools. The “risk owners” whohead up the functions in each of the subsidiaries–the head ofoperations at American Snuff Co., for example–also define risksspecific to the functions they oversee.

Wilson calls support from the CEO and board of directorsessential to creating an effective risk management program. Sherecommends sustaining a holistic program by avoiding too muchdetail and complexity. Risk management should also be integratedoperationally into the company's business processes, and not justan occasional check-the-box exercise. Another challenge is to focusnot just on internal risks but external ones, such as potentialpolitical and regulatory risks.

For the top risk manager, that means understanding the“personalities” of each business unit and its managers, since theyunderstand best where the risks lie.

Wilson says she left financial planning–where it's imperative tounderstand clients' life goals and convey the importance of afinancial plan to minimize their risks–because she didn't like thesales aspect. That training, however, has been very useful. “Youhave to understand your company's culture, the clientele in thecompany you're dealing with,” she says, “And you have to be able tosell them the benefits” of risk management.