Governing Under Disruption: A Forward-Focussed List for Forward-Facing Boards

The following is a “top ten” list of forward-focussed governance issues, and what boards of directors should be doing – or are doing – to govern more effectively under disruption. References to book chapters from The Handbook of Board Governance, third edition (3E), second edition (2E), or first edition (1E), follow each item below.  

1.  Governing Disinformation

Chronic disinformation, which can lead to radicalization and conspiracy across the political spectrum, may reach into management and boardrooms, or be used to attack the corporation.   The cause of disinformation —which is intentional passing off of false information—, or misinformation —which is innocent or negligent passing off of what may be false information—, is social media companies not being treated as a publisher or speaker would, with exception of criminal and intellectual property-based claims. As a result, political, business and other leaders, and foreign governments promulgate disinformation.   What should boards be doing?

• Training on unconscious bias and techniques by threat actors to manipulate information, including by weaponizing artificial intelligence;
• Training on validated, accurate, and reliable information and work product, and disciplining by companies and professional bodies for employees or professionals who pass on disinformation;
• Counter-explaining and awareness training on any denial, non-facts, or conspiracy indicators;
• Requiring that regulated media (e.g., newspapers, TV, radio, journals) reach all directors and senior management, to balance social media algorithms, particularly for work from home or hybrid employees or directors;
• Requiring evidence-based and substantiated facts to ground all recommendations coming to the board;
• Being prepared to counter rumors, exaggeration, or lies promptly, concerning the company, its directors or senior management, through fact-checking, challenge panels, triangulation, table-top exercises, and litigation as necessary;
• Engaging in reputation and brand control over disinformation, for vendors, the company, and employees, before hire and ongoing, and reporting exceptions to the board of directors; and
• Recognizing and acting upon possible “tells,” if or when the board is being lied to.

See The Handbook of Board Governance, 3E, chapters 8, 64, 65; 2E, chapters 34, 35, 40, 45 and 48; and 1E, chapter 20, pertaining to information asymmetry, cognitive biases, group-think, stewardship, board-shareholder meetings, and long-term governance.  

2.  Governing Generative Artificial Intelligence Opportunity and Risk

  Regulation and internal controls over generative artificial intelligence, defined as machine based generation of new content, are weak in the following areas: algorithms, bias, buggy code, disinformation, ethics, explainability, interpretability, privacy, security, and transparency.   Boards in certain industries, including technology, consumer, financial and professional services, healthcare and others, should have (had) educational sessions with management and external experts on applicability of generative AI to the company and industry.   What should boards be doing?

• Reviewing auditing control standards adopted by management and tested by internal auditors as a condition of application of generative AI by the company;
• Having a line of sight to the controls, management competency, expected gains and opportunities, and peer industry use of AI;
• Ensuring the following occur: beta testing; enacting an AI usage policy; vendor validation; training dataset source and algorithm verification; human integration and limitation; audit trails; and confidentiality, privacy, copyright and compliance control assurance; which are all best practices being adopted and overseen by boards; and
• Recruiting and disclosing director competency and expertise in artificial intelligence, as applicable.

See The Handbook of Board Governance, 3E, chapters 12 – 14; and 2E, chapters 18 – 22, pertaining to the governance of artificial intelligence, the metaverse, blockchain, and other emerging technologies.  

3.  Governing Controls Over New and Emerging Risks

  Management and internal audit may lag designing and testing controls for new or emerging risks. Recent risks include artificial intelligence, biodiversity, disinformation, emergency response, financial distress, fraud, geopolitical, n’th party, regulatory, and wellbeing (or the equivalents), all of which are increasing.   New or emerging risks normally have immature controls and validation, which, if so, is the fault of audit committees and boards.   What should boards be doing?

• Approving a risk framework that is forward-facing, not retrospective (boards should look up and out, in other words);
• Requiring controls and resources to match the forward-facing risks, or not approving the risk framework;
• Ensuring auditor competency and resources match the control testing of forward risks in the work plan approved by the audit committee;
• Understanding the forward risks and controls, so they are cycled through at the board level, e.g., table-top exercises, mock exfiltration and bit-coin payment demand by threat actors for cyber and AI; scenario planning for sanctions, tariffs, trade restrictions, political regime change, upon the company and industry, for geopolitical risk, and so on;
• Responding to generative questions by directors; and
• Greater use of technology and dashboards for boards to oversee risks in real time.

See The Handbook of Board Governance, 3E, chapters 37 – 39, pertaining to the governance of new and emerging risks; chapters 24 and 25, pertaining to political risk; chapter 28, pertaining to regenerative governance; chapters 15 – 17, pertaining to cyber security governance; and 2E, chapters 24, 25 and 26, pertaining to populism, geopolitical risk, and deliberative thinking.  

4.  Financial Stress Testing

  Bankruptcies and office vacancies are steadily climbing. Because of high interest rates, inflation, and pressure upon employees, regulators, audit committees and boards are becoming more active in the following ways:

• Proforma financial stress testing for unfavorable conditions, to the audit committee and board;
• Training on director duties during financial distress;
• Audit committees recommending budget balance and debt policies to the board;
• Payback plan for capital expenditures, reviewed by audit committee in advance;
• Changes to delegated authorities to the CEO;
• Revenue diversification to avoid concentration or vulnerability risk;
• Full cooperation and transparency with external and internal auditors; and
• Audit committees reviewing expense, waste, cost management, and fraud controls.

See The Handbook of Board Governance, 3E, chapter 29, pertaining to director duties under financial distress; 1E, chapters 11, 13 and 18, pertaining to director misconduct, duties, and insurance; and 3E, chapter 29, pertaining to audit committees and their obligations.  

5.  Governing Agilely in Disruptive Times

  Partnering behaviours between the board and management requires trust, currency, credibility, and mutual respect for one another’s roles, and an orientation to consensus. Leadership behaviours during disruption for board chairs and directors include the right agenda, a bias to learn, preparation, and asking effective forward-oriented and contingent questions.   What should boards be doing?

• Strategic partnering, during business model and performance measurement development, and then pulling back to oversee execution;
• Revisiting committee and sub-committee structure, to oversee non-financial, core business performance, and emerging issues and risks;
• Revising calendars and work plans, to allocate appropriate items across virtual, hybrid, and in person meetings;
• Having futuristic, game theory, and scenario planning table-top exercises with the board;
• Greater use of shorter, more frequent micro meetings, with focus on pre-reads and discussion;
• Deliberative information layering, pre-narratives, hyperlinks, and consent agendas; and
• Greater availability and responsiveness for pivoting when required.

See The Handbook of Board Governance, 3E, chapter 28, pertaining to regenerative governance; 2E, chapter 33, pertaining to agile governance; and 3E, chapters 3, 51 – 53, and 2E, chapters 5, 6 and 7, pertaining to an outside-in view of the world, pivoting, and chair and lead director roles and responsibilities.  

6.  Governing Increasing Fraud and Corruption

  Opportunity, pressure, and rationalization, in work from home and high interest rate environments, have resulted in occupational fraud and corruption increases in organizations with weak controls, including criminal exploitation of disruption, and employee bribery.   What should boards be doing?

• Board refresh on anti-fraud, corruption, organized crime, money laundering, and terrorist financing;
• Investing in technology to detect hot-spots, collusion, and local or deep control over-rides;
• Re-resourcing internal audit and compliance groups with direct reporting to the board;
• Authorizing fraud audits under internal audit work plans;
• Using claw-back, malus, risk-adjusted pay, behavoural gateways, and just cause revisits in executive contracts;
• Background control testing for key employees, including links to organized crime;
• Strengthening of AML, procurement, cryptocurrency, and other fraud controls;
• Reviewing of management expense policies and controls; and
• Greater use of Special Committees (see my recent paper, here).

See The Handbook of Board Governance, 3E, chapters 6, 31, 32, 39, 49, 55 and 59, pertaining to CEO misconduct, fraud governance, IFRS governance, criminal liability, ethical governance, director checklists, and control governance; and 1E, chapter 16, pertaining to the role of internal audit.  

7. Governing Employee Wellbeing and Culture

  Investor pressure, legal changes, government mandates, and COVID-19 have all caused focus on employee wellbeing. Costs of flawed employee wellbeing may include absenteeism, brand and reputation impairment, coordination difficulty, mental health issues, morale impairment, productivity loss, succession difficulties, talent flight, and media leaks and adverse press.   What should boards be doing?

• Reviewing employee, wellness and exit surveys, and culture audits;
• Implementing or updating whistle-blowing programs to detect toxicity and wrongdoing;
• Overseeing mental health resources available to employees;
• Tours and walk arounds, and employee presentations at board meetings;
• Reviewing internal human resource governance structure;
• Reviewing training programs and policies;
• Reviewing talent management and succession plans, total rewards policies, and critical labor relations issues, including collective agreements;
• Reviewing base and incentive pay structure for key employees and functions; and
• Thanking of employees by the board.

See The Handbook of Board Governance, 3E, chapters 18 – 28, 40 – 46, and 50, pertaining to social governance, intangible capitals, workplace culture and trust; training, recruiting and mobility; measuring, assessing and incenting human capital metrics; alignment and well-being; and auditing, alignment to compensation, and board reporting.  

8.  Governing From Home and Meeting Effectiveness

  Just like most workplaces are not returning to exclusively five day office attendance, boards are incorporating a blend of in person, virtual and hybrid meetings, to enhance effectiveness, efficiency and output.   What should boards be doing?

• Approving virtual and hybrid board meeting policies, addressing equity, fairness, geography, effectiveness, and technology;
• Having robust books and records integrity controls for directors during hybrid and virtual meetings;
• Having cameras on during virtual meetings, with distraction restrictions;
• Investing in boardroom and director technology, including voice-activated, mobile or roving cameras and microphones; and
• Deliberative and flexible meeting agendas set by chairs.

See The Handbook of Board Governance, 3E, chapters 34, 56 – 58, and 75 and 76, pertaining to the aftermath of COVID-19, in camera sessions, virtual and hybrid meeting protocols, asking effective questions as a director, and assessing meeting and board effectiveness.  

9.  Refreshing and Offboarding

  Surveys, year after year, indicate that a many directors often believe that one (or more) directors should not be serving on their board.   Boards are, gradually, becoming less forgiving of director under-performance, in many forms, but especially in mistreatment of other directors or management.   What should boards be doing?

• Having term limits, with peer reviews to advance, and an overall cap in years;
• Having annual professional development plans for each director;
• Instituting deeper background and attribute checks for the director talent pool;
• Mentoring, competency, and behaviour upskilling;
• Appointing non-director committee members, to develop board-ready talent;
• Having larger, validated, and diverse prospective director evergreen lists;
• Setting less coaching time for director behavior issues or recidivism; and
• Elegant and respectful offboarding and tougher discussions should be more willing to be had.

See The Handbook of Board Governance, 3E, chapters 47, 60 – 63, and 66, pertaining to director responsibilities, competency, leadership, effectiveness, and board education and orientation best practices; and 1E, chapters 11, 13 and 18, pertaining to director misconduct, duties of directors, and D and O insurance coverage.  

10.  Governing Further Disruption Preparedness

  There are further disruptive risks that are not implausible in the medium or short term, including:   (i)      Coordinated threat actor ransom over critical regional or national infrastructure (e.g., commerce, energy, telecommunication, transportation, water);   (ii)     Depleted or inaccessible agriculture, emergency, financial, health, natural, or social resources, accompanied by predictive intelligence;   (iii)    Extreme high net worth individual influence over policy or national infrastructure; and   (iv)    Possible escalation of regional wars, or heightened civil unrest erupting in the United States. (See “Disruptions on the Horizon: 2024 Report,” Policy Horizons Canada, accessed 21 May 2024.)   Emerging risks, and how these risks affect the company and industry, are on good board’s radar screens.   What should boards be doing?

• Reviewing business continuity and disaster recovery plans, tailored to extreme weather, service disruption, power outage, supply failure, active shooter, cyber-attack, civil unrest, or possible terrorism (including CBRNE (chemical, biological, radiological, nuclear and explosive));
• Reviewing ransomware plans, including controls, penetration, backup, rebuild, and threat actor communication;
• Reviewing scenario planning and response exercises, of industry, sector and company impact, based on high impact and plausible risk or events, with a line of reasoning;
• Presentations to boards by intelligence firms on geopolitical risks, industry impacts, and company responses; and
• Media training for CEOs, so they are camera ready for any crisis scenario or event.

See The Handbook of Board Governance, 3E, part VI: Emergency and Crisis Governance, chapters, 33 – 36, pertaining to worst case scenario planning, targeted shooting of directors, emergency succession, coping with trauma, the post-pandemic world, complex disasters, knowledge systems, systemic migrations, and disaster management and risk assessment.  

Conclusion   Boards of directors should never be in denial to what is happening, or what could plausibly occur, and how the company must be protected. Companies do not fail. Boards do.

Richard Leblanc, FCMC, CMC-AF, BSc, MBA, LLB, JD, LLM, PHD, is one of Canada's leading experts on corporate governance and accountability. He is an award-winning teacher, researcher, lawyer, public speaker, consultant, and specialist on boards of directors.