Uber Risk Management

Uber; founded in 2009 and is a high tech rideshare company. They found a way to connect the need for transportation (like taxi cabs) with the ride-sharing app. Uber quickly grew and became more popular than US taxi cabs or limousine industry. While the primary function of the company still on ride-sharing, thanks to the success of the company it has now ventured into fast-food delivery with its UberEats app, Uber Freight for bulk shipping services and the company is even looking into self-driving technology along with urban air transport services (Uber Offerings). In May of 2019, UBER stock went public, and now one can purchase stock in Uber.

Rideshare companies like Uber have seen their share of risks, and the need to adapt to those risks and plan for them. While the company has grown vastly over the past few years, but this rapid growth has resulted in risks that the company must tackle. Risks that Uber has faced since they first launched are not limited to but include loss of revenue, misuse of their service, fighting battles in both federal and local laws and staying compliant. The biggest issue that remains on their radar is safety. When we talk about safety with Uber, we are talking about both customers and employees. The risks of being an Uber driver, don’t just include physical security, but also insurance liability. With our case study, we are confident that we will be able to identify key risk factors impacting Uber and also offer solutions to mitigate those risks so Uber can stay relevant in the future.

Current ERM Practices

Uber has faced many risks since it started up in 2009. Because of the variety of risks associated with the rideshare industry, an assortment of risk management techniques have been used to understand better and control possible risks. Some of the risks we identified are included in the chart below. All companies face risks and adapt to mitigate the risks, but Uber has had their fair share for being a new company and a new business venture. When Uber started up, there was no real ERM plan they could follow; they had to come up with their own as they grew. (Schieve, 2018) Some of the most significant risks that they have faced, competition, federal and state laws, and safety; now when we say the safety of customers, employees, and data. What is Uber’s current ERM plan(s), and who is responsible for what?

When Uber launched, they had to a tough battle; they basically had to build their ERM plan from scratch. Currently, on Uber board of directors, you will find a group called “Board Oversight and Composition.” (Securities and Exchange Commision, 2019) This is where their ERM team starts. With the board of directors and other standing committees, and senior management meeting regularly with risk management experts, to discuss risks and how to mitigate them (Securities and Exchange Commision, 2019). The senior officers responsible for risk oversight include Chief Legal Officer, Chief Compliance and Ethics Officer, Chief Financial Officer, CEO, Enterprise Risk Council, and Risk Management function are all included in these meetings. Risk management and functions group are responsible for identifying a critical risk that may hinder Ubers goals and make recommendations for risk management actions. In addition, there is an audit committee that oversees the risk management procedures, thus to help to prevent and detect fraud.

The board of directors has the primary responsibilities on the risk management oversight committee. This includes assigning specific duties to members of the committee, receiving risks that arise from management, and meeting with ERM specialists. The audit committee reviews annually risk profiles, receives and reviews an annual report on management implementation, and maintenance of Uber’s risk management process from the risk management team (Pg 214 Securities and Exchange Commission, 2019). Reviews risk management policies and procedures, including financial ones and the steps taken to monitor such exposures. The audit committee also reviews allegations of fraud at any employee level. Management at Uber plays a role in ERM, as well. They identify risk and develop risk controls for those risks. They join and participate in risk assessment strategy meetings and decisions. They also assist in establishing procedures to prevent deter and detect fraud. Lastly, they provide reports and updates on risk-related matters to the Audit Committee. The nominating and governance committee; reviews risk associated with Uber’s corporate governance framework and provides recommendations. They also are the committee that recruits and interviews potential board members, including evaluating the independence of each director and director candidate.

Lastly, we have the compensation committee, who oversees Uber’s compensation program for all employees. They review the risks associated with compensation and conflicts of interest involving advisors of the compensation committee. The last, we see the Board’s involvement in ERM with a role in the Cybersecurity Oversight team. They oversee Uber’s efforts to address cybersecurity risk through the cybersecurity team. The cybersecurity team includes the Chief Trust and Security Officer and Chief Information Security Officer as well as senior managers. Uber’s cybersecurity committee is responsible for many activities, including conducting threat and vulnerability assessments, managing cyber incidents, and pursuing projects to strengthen cybersecurity. They also work very closely with Uber’s privacy and legal teams.

Culture is a prominent item in Uber employees. Uber’s leaders work at building an inclusive workplace and foster an environment in which authenticity is celebrated as a strength. At Uber, they support their ERGs, which does include many affinity groups for their diverse cultures. They hired Bo Young Lee as their Chief Diversity Officer and Nikki Krishnamurth as their Chief People Officer. These two not only leader human resources, and recruiting but they oversee many diversity and inclusion teams. Uber’s ERGs are working on Uber’s culture at all times. They build, enhance Uber’s culture thus helping to ensure that Uber better servers employees, consumers, relationships with restaurants, shippers, carriers and the cities they do business in.

5 Risk Areas for Uber

Areas of risks identified for Uber are as follows. We listed a significant risk than two minor risks that fall under the major.

1. Loss of Revenue
   1. Competition & Sales of Shares
2. Mis-Use of the Program
   1. Criminals using Uber for business
   2. Data breach
3. Safety
   1. The risk to Uber Drivers & Passengers
4. Federal & Local Laws
   1. Use of Services in states
   2. Compliance
5. Employment with Uber
   1. Taxes & Employee risk
   2. Liability of Insurance

Overview of Risk Identified

Similar to all for-profit organizations, Uber’s primary focus to generate revenue through their primary business focus of ride-sharing and other business ventures. Like other organizations, Uber has faced some risks. Some of the risk factors that can negatively impact Uber’s image include federal and local laws where they operate, employees, misuse of Uber services, and safety of data, employees and consumers.

Federal & State Laws

A risk that Uber faces is related to the laws that it might comply with along with laws impacting the use of its service in states. UBER is a worldwide ride-share company based out of California. As UBER introduces itself in different countries, it will face various risks. Each state has different laws that the ERM team will need to be aware of and address to be able to have UBER adapt in those states. UBER will need to research and know the federal and local laws for each of the states. They will need to adapt to business for each location. An excellent example, Uber broke the law in all 50 states and DC is notifying the state department of data breaches. Remember the data breach in 2016, Uber hid that evidence and paid the ransom in hopes the data stolen would not be sold or misused. Lisa Madigan, Illinois attorney general, stated this is the most egregious case we’ve ever heard of or seen in terms of notifying the states. She also noted that we are not going to put up with companies, Uber or any company completely ignoring our laws.

As Uber is a new ride-share venture, there are now laws in place, where before there were not. Uber has done its fair share of finding loopholes and ways around the laws. Laws like regulations proposed for drivers like taxi cabs, like fingerprinting, Uber states they are a ride-share and self regulate their drivers. This has caused Uber to be banned in cities like Austin, TX, in 2016. Another example, they now have scooters that people can grab to get around town. In areas like the Keys, Florida, they are banned. In LA, they are banned, and on the verge of confiscated, because Uber refuses to comply with city regulations and data sharing. This is just the latest conflict in legal issues Uber faces with being compliant with laws at Federal and State levels. Uber would need to know how to adapt to changes from the state to state and city to city.

Employment with Uber

Additionally, the company has come under strict scrutiny regarding the classification of its contracted workers and liability of insurance risks. Uber is also being looked into for how they classify their employees. Uber drivers are currently classified as contractors (Freelancers), and neither party seems to look at this as an employee & employer relationship. Thus meaning that Uber will issue them a 1099 form for filing taxes. One way the scrutiny comes in when those Uber drivers don’t understand what is required for tax and filings. Uber also takes a portion of the payment for ride and tips that are given. Some drivers have even filed a lawsuit saying it is more than just a small piece. They state by classifying them as freelancers vs. employees; Uber avoids paying sick time, vacation, holiday and benefits. The fight over the classification of Uber drivers as independent contractors was resolved this year. It did not settle easily on the bank account of Uber, as they agreed to pay $20 million in a settlement. But this settlement was only with a few drivers; It is believed this battle is not over. (Hawkins, 2019)

Secondly, the safety issue with being an Uber driver is the liability of insurance. A prominent legal issue for Uber, is who is responsible when there is an accident involving Uber rideshare? A severe accident can mean more money than an individual’s insurance would cover. Uber, you think, would be the target if a lawsuit were to take place, but the “Communications Decency Act of 1996” prevents liability. Where does that leave the driver? Independent contractor vs. employee classification questions has been issued before but mostly in cases like medical malpractice, tax disputes. Until all these can be sorted out, Uber can expect more lawsuits about safety for all employees and passengers. This can be a time consuming and costly for Uber.

Loss of Revenue

As stated above, like any business, Uber’s primary goal is to generate revenue and grow business. What risks face that could cause them to lose income? Uber posted a $5.2 billion loss this year in the second quarter. This is a considerable loss of revenue, and the largest since Uber started, thus sending their shares on the stock market plummeting. (Rapier & Wolverton, Business Insider, 2019) With such a massive loss in revenue and just going to opening their IPO this year, their shares to the public people are nervous about purchasing the stock as prices dropped. Uber stock fell as much as 12%. Two things are attributed to the loss, driver rewards, and stock-based compensation, both from Uber IPO. How does this affect Uber’s competitors like Lyft? Well, honestly, Lyft is in the same boat with a huge loss. If they can’t get into the side where they are making money, they have competitors that are smaller and local that will take over the market.

Is it bad press or lousy culture that causes risk for Uber? In 2017 the bad press for Uber included allegations of discrimination, sexual harassment and viral #DeleteUber campaign. First impressions are hard to get past. Uber is still trying to recover from the scandals in 2017, that had customers turned off. Some of the scandals include employees’ claims of sexual harassment, gender basis that were dismissed by HR. In February of 2017, two investors leaked betrayal and suggested that Uber had stolen technology. Thus causing Google an Uber investor to sue for intellectual property theft. (Carson, 2017) These stores are still easy to find on the web; thus while Uber is and has changed their culture, it will take a few years for people to forget. We learned that culture plays a role in ERM, and it is without stating that culture problems are a foundation issue, and there are no quick fixes.

Misuse of Program

Another risk that Uber faces is associated with the Mis-Use of its app and ride-share service. Some Uber drivers are using bogus identities and sharing accounts with friends and family. It is against Uber policy but still happened. Why is this an issue? When you are an uber driver, you have been through a background check, been licensed and insured, and, most importantly, vetted. Instances of Uber unauthorized drivers have included criminals, convicted felons. Thus causing a huge safety issue for riders. Unknowingly you get in the ride and think your safe on your way to your destination, only to be robbed, or worse. In South Carolina, a 21-year college student got in what she thought was her uber ride, only to be brutally murdered. (Jagannathan, 2019)

Criminals have exploited the platform in multiple ways. Uber’s customers and the application have also been prone to a data breach by hackers. Criminals like cybercriminals are turning to new methods and technologies to complete their crimes. One way they are doing this is by hacking uber accounts of drivers. In 2016 Uber faced a major data breach, and again 2019 suffered a data breach. In 2018 Uber was fined $148m and advised to tighten their data security, all because they failed to notify their drivers/customers their accounts have been hacked. Uber hid this fact and evidence and instead paid the ransom to ensure the data wouldn’t be misused. (Associated Press, 2018) In Nov. of 2016, over 600,000 Uber drivers’ information was stolen, including driver license. Uber hid the information and paid $100,000 in ransom. This breach also included 57 million names, addresses, and cell phone numbers of riders around the world. Uber acknowledged this information in 2017, thus the hefty fine.

Global Risk Identified – Safety

Now we reach the last risk we identified for Uber. We believe this is their global risk, Safety. Most of Uber’s risks mentioned above can be related back to safety in one way or another. Uber management and ERM team even acknowledge that safety is a risk they are trying to mitigate. Quoted directly from Uber management “If platform users engage in, or are subject to, criminal, violent, inappropriate, or dangerous activity that results in major safety incidents, our ability to attract and retain Drivers, consumers, restaurants, shippers, and carriers may be harmed, which could have an adverse impact on our reputation, business, financial condition, and operating results.” (Pg 33 Securities and Exchange Commission, 2019)

When Uber first launched, complete background checks were not done on all drivers. Uber has now corrected this issue, but they did hire hundreds of drivers who had a lengthy criminal background, including felony charges like assault and rape. Refer back to the young lady we said got into an Uber in South Carolina that was not really an Uber driver, and was killed. In the South Carolina case; Seth Rose and Micha Caskey introduced a ‘Samantha L. Josephson Ridesharing Safety Act’ bill this week requiring rideshare drivers to display illuminated, company-provided signage. (Jagannathan, 2019) Uber drivers are now required to follow this law. Uber is currently performing more intense background checks. They list a list of people who will not qualify to be uber drivers. They offer driver training on how and what to do if they pick up an aggressive passenger. Uber has recognized that drivers expect a level of safety just like the passengers do.

What is Uber doing to promote the safety of its passengers? Uber has added new features to its app. Features like 911 text, bike lane alerts and most importantly ride verification. The 911 feature will allow riders to discreetly text for emergency help should they feel they are in danger. They can send car make and model, license plate number, and location details. Uber recognizes that consumers choose a Ridesharing service based on a mixture of wait time, quality of service, Safety, app functionality, brand recognition, convenience and support. Uber states that Safety is our goal for all. Our goal is to make ridesharing with us a safe transportation option in all cities. From the time you schedule your pickup, to the point you are dropped off at your requested location.