10 questions for de-risking a board

A company’s board of directors can and should play a critical role in risk management, guiding the CEO and senior management on key business issues and taking the lead on governance issues like succession planning. But who oversees the board?

To a large extent, it’s an exercise in self-policing. But a good relationship between the board and the CEO can facilitate better governance and oversight and make sure the board is an asset, not a risk.

When structured and managed properly, a board can be a competitive advantage – with the emphasis on competitive.

“Your competitors are addressing the same issues you are,” said Henry Essert, the leader of PwC’s risk practice in the insurance sector. “You need to thinking about whether you are doing it as well as they are. You need to be as good or better.”

Below are 10 questions director and CEOs need to ask – and answer – to de-risk boards.

DO WE HAVE THE RIGHT PEOPLE ON THE BOARD?

Gone are the days when board directors were cronies of the CEO, and celebrities picked for marquee value who served primarily as figureheads.

“The demands are different in terms of time and expertise,” said Brian Wanat, a managing principal for Aon’s Financial Services Group. “You need people with knowledge of different geographies, regulatory issues, and current events.

It’s also critical that people on the board know something about the company’s industry and have experience with the business model and the long-term strategy? If not, that’s a risk, said Beverly Behan, CEO of governance consultancy Board Advisor LLC. “Skills and background need to be clearly aligned with the company’s business model,” she said. “Otherwise, your board can’t help you do such basic things as evaluate potential deals.”

She also cautioned that companies think carefully about how they “spend” their board seats. True, there is a lot of legitimate focus on cyber now, but boards need to decide if their needs will be better served by a board member who is an expert in one area, or a well-rounded board member. “Just as every company faces cyber issues, every company has legal issues, but a lot of boards don’t have lawyers.” She pointed out that Amazon, which has myriad IP and legal issues, has a former U.S. Attorney General on its board. “Those issues are more fundamental to what the company does so its board clearly decided it was worth `spending’ a seat on a lawyer.”

Another way of determining if you have the right people on the board is if members are willing to be independent of management, ask tough questions, and push back when needed. “If you don’t have directors who are willing to challenge conventional wisdom, the CEO, or the status quo, you can wind up with an imbalance of power and an imperial CEO,” said Chris Davis, head of the M&A and shareholder activism practice at Kleinberg Kaplan. “Investors are counting on the board to be responsive and do the right thing.”

IS OUR BOARD DIVERSE IN THE RIGHT WAYS?

“Diversity” on boards has often been an exercise in ticking off boxes – finding women and minorities who were nominally qualified at best. Only in the last 10 years, with increased regulatory exposure and scrutiny, have directors been recruited for their skills and expertise – and what companies are looking for in the way of skills and expertise has changed dramatically. “A global company should now have someone who has actually worked overseas, who has extensive knowledge of how different countries operate,” said Wanat. “You also need people with experience in different industries, with other areas of expertise, and now someone with some knowledge of technology.”  

DO YOU HAVE THE RIGHT RESOURCES? 

Boards need often need access to additional resources, such as outside experts, to help them either react to a situation or even better, be proactive in dealing with potential problems. “Boards can’t rely only on input from management,” said Carrie Penman, chief compliance officer and senior vice president of advisory services at international ethics and compliance consultancy NAVEX Global. “Management lacks the objectivity and often the specific expertise needed to deal with certain issues.” Boards should never be unwilling to bring in outsiders – nor should management hinder the freedom to do so. “Directors are doing their job to bring in outsiders,” said Wanat. “A board that uses all the tools within their toolkit is more informed and is a better board.”

DOES THE BOARD GET FRESH BLOOD?

Typically, boards have a mandatory retirement age and unless a director does something wrong, he or she get automatically renominated at the end of every term. “You need a balance of fresh ideas with continuity and institutional memory,” said Behan. “If you turn over the board too much it is as big a risk as not recognizing that as companies morph, the needs around the board do too.”

“One of the key things a board can do is bring fresh perspective,” said Essert. “That’s why  you not only need diverse backgrounds but new people to participate in the process.”

Rotating directors among different committees can be a way of getting fresh perspective while still preserving institutional knowledge, said Penman. “As long as directors are serious about their responsibility, accountability, and liability, everyone – directors, the entire board, management and other stakeholders – will likely benefit.”

ARE BOARD MEMBERS STAYING UP-DO-DATE?

“Directors are judged in part on what they should have known,” said Penman. “It’s really critical they they not only stay up to date but ideally look ahead.” The move toward everything being digital raises new risks for boards and companies, said Wanat. “Boards need to worry about everything from how the company is going to deal with social media to the fact that critical business information is no longer locked away in a safe but is somewhere in the cloud or cyber realm,” said Wanat. “Certainly some industries are more vulnerable than others, but there isn’t a company that doesn’t have potential exposure to cyber terrorism and data breaches.”

Davis pointed out that while the average director may not by super-savvy on tech, they at least need to be aware of the risks created by the advances in technology. “It’s a different world than it was a generation ago, and it requires a new level of awareness.”

DO WE UNDERSTAND THE ROLE OF D&O INSURANCE?

Virtually every company will have D&O insurance to protect its board, but the board should ensure that the level and types of protection are adequate. “People are understandably concerned about liability, and certainly there have been instances where there hasn’t been enough insurance in place,” said Wanat. “You need to make sure the limit is right, that there is asset protection and indemnification.”

Directors “routinely” get sued, pointed out Davis, often without merit, particularly in mergers and acquisitions. “That’s usually not a circumstance where you’ll have real liability,” he said. “But the best protection is doing your job well. If you are, the court will go out of its way to protect you.”

Insurance is just one aspect of risk management, said Essert. “It’s part of the package, but it’s not a panacea.” If companies get sloppy and find themselves having to rely on D&O insurance to bail them out, eventually insurance will be too expensive a tool to be accessible.

DO WE HAVE WELL-DOCUMENTED PROCEDURES, AND ARE THEY BEING FOLLOWED?

Does your company have procedures in place for emergencies, whether brought about by a reputation issue, a succession crisis, or a data breach? Is there adequate protection for whistleblowers – and do employees know what to do if they suspect wrongdoing? “You want to make sure policies, procedures, and protocols are in place,” said Wanat. “You don’t want a team being rushed to make decisions.”  He also cautioned that it’s important that the board itself is following procedure, such as making sure matters are being dealt with by the appropriate subcommittees rather than being an inappropriate distraction for the entire board.

ARE WE CHOOSING THE RIGHT BATTLES?

According to Davis, boards need to decide what fights they are willing to wage. “If you have advisory teams always telling you to adopt defensive measures, you’ve should be thinking about  getting new advisors,” he said. “Too many law firms are being hyper-aggressive and directors now need to push back.” Two arenas of battle said directors should think about twice before they engage are controversial bylaw changes, such as the one that would shift fees in litigation to the losing party, and activists and proxy advisory firms. “Activism is increasingly a force that is here to stay,” he said. “While it is fair for a company to challenge an activist, I’ve seen boards do things that have given me pause.” Overall, proxy advisors and other shareholder activists have become more even-handed, he said. “When you’re allowing your advisors to attack, you are attacking the system.”

ARE OUR ETHICS AND COMPLIANCE PROGRAMS STRONG ENOUGH?

Pressure on companies’ financial performance is as strong as ever, if not stronger than it was before the financial crisis, noted Penman, and that pressure can challenge even the most robust ethics and compliance efforts. “Too often companies don’t make the connection between financial targets and financial pressure,” she said. “Boards need to look at how employees are rewarded, and what people are rewarded for. They can reduce risk by having an appropriate compensation plan.”

ARE WE DEALING WITH SUCCESSION PLANNING?

Succession planning is the “No. 1” duty of a board, according to Behan – and the one where boards are too often derelict. “A sudden loss of leadership is a huge risk for shareholders,” she said. Part of the reason for their dereliction is historical: Prior to 2000, CEOs ran the succession planning process; not it’s up to boards. Still, that’s no excuse for what she calls “woefully inadequate plan and due diligence on internal and external candidates.”