Overseeing risk is no small task for boards as a company’s footprint is no longer confined to local or even national boundaries. The globalization of business—spurred in large part by the Internet—has simultaneously expanded business opportunities while also introducing new worlds of risk that an organization must contend with.
The National Association of Corporate Directors (NACD) invited Joan Meyer, a partner at Baker McKenzie LLP, and SecureWorks Chief Threat Intelligence Officer Barry Hensley to offer their insights on these issues as part of a larger panel discussion at the Leading Minds of Governance–Southwest event.
Highlights from their conversation with NACD Directorship Publisher Christopher Y. Clark follow.
What is your outlook on the complexities of being an international company?
Joan Meyer: It’s becoming extremely complex because there is increasing enforcement from other jurisdictions. Five or six years ago, the U.S. was the predominant regulator and multinationals only had to deal with certain European countries in addition to the United States. Now, we are seeing emerging markets that are getting extremely aggressive. They are also putting in more restrictive laws and data privacy rules about the transfer of data. It’s a real conundrum for companies because they not only have to comply with U.S. law but the more robust law of various regimes, which create conflicts. Some of that risk may be theoretical because certain jurisdictions have not begun enforcing these laws —but it’s out there.
If you are disclosing information to a U.S. enforcement authority but you can’t get information out of a foreign jurisdiction, a U.S. regulator might not care— they just want the information. In this situation, not only is executive management caught in a bind, but the board will be asked: “What do we do?”
The U.S. Department of Justice is also pursuing individual prosecutions of mid-level managers and the C-suite, and there is increasing pressure on companies dealing with U.S. authorities to get cooperation credit by identifying individuals who are culpable for the misconduct. And it’s not only in the U.S. where that’s happening. Because the government wants real-time cooperation in pursuing individuals, it’s frustrating for companies because they are being pushed to provide investigatory conclusions to the government which they may not have completed. On a global basis—whether it’s Saudi Arabia, China, Russia, or Brazil—individuals are being actively pursued. The problem is compounded if they are expatriates who are working in these foreign countries for a limited period of time, don’t understand the culture, and are suddenly being subjected to detention or prosecution. This puts managers working outside countries with an established legal system at real risk because they may be pursued by authorities simply for a perceived failure to exercise their supervisory responsibilities in the right way.
What questions should a board chair ask the chief information security officer [CISO]?
Barry Hensley: First: What are our top five risks? Only by thinking like the enemy can the CISO begin to itemize and categorize the company’s security risks. Consider the following ways you may be attractive to cyber threats: your brand and how you’re perceived on the world stage; your digital capital, such as intellectual property, electronic currency, and personal data and how it’s secured; and your internet-exposed vulnerabilities.
Second: Does our security program have the visibility to detect an advanced adversary whose work eludes security controls? The threat does not remain static nor does the network. While some tactics and tradecraft are well known, the adversary is innovating, always seeking opportunities to bypass traditional protections. For example, while implementing multi-factor authentication is important, bad actors are finding ways to impersonate users and hijack credentials. Does your risk assessment learn from the headlines and adapt? It’s important to keep risk assessments current and update your mitigation strategies and budgets against these threats.
Third: Does your staff collectively understand the term “breach” and the conditions that trigger a formal response? Are you prepared with a meaningful, rehearsed, cross-disciplinary crisis response plan? While no company wants to dwell on the potential for serious incidents and breaches, preparation is still essential. This requires a real understanding of what constitutes an addressable incident, what triggers it, the steps that must occur to resolve the incident, and the people involved. Key tenets should be established, such as: knowing who’s in charge, how the board contacts the key players, and what the measurable actions we take to address the incident are.
Fourth: Is security training tailored to ensure appropriate audiences are aware of threat actors and their tactics? Different segments of the workforce present different risks, and the CISO must make sure each segment is aware of the tactics being used to exploit all avenues of compromise. Boards need to ask: Do employees understand how phishing works? Do administrators know the value of frequently changed passwords and vulnerability scans? Do web designers understand the importance of secure coding practices? Do executives and financial managers recognize that they are extremely lucrative targets for social engineering? And remember: there is no such thing as one-size-fits-all security training.
Want more? A panel of Fortune 500 company directors and subject matter experts will offer their insights on issues ranging from cyber resilience to the latest regulatory trends at Leading Minds of Governance–Southeast. Join us on March 16 in New Orleans, LA. Space is limited—register today.
Click here to read addition coverage of the Leading Minds of Governance–Southwest event with highlights from a discussion on the board’s role in overseeing talent and tone.
The National Association of Corporate Directors’ (NACD) 2016-2017 Public Company Governance Survey reported that, according to the vast majority (96%) of directors, “big picture” risks are overseen at the full board level. The big-picture view of risks includes those with broad implications for the organization’s strategic direction, including issues that can create significant reputation damage.
NACD’s findings are complemented by a recent survey of more than 700 c-suite executives who were asked to identify the top risks for 2017. Conducted in the fall of 2016 by Protiviti in partnership with North Carolina State University’s ERM Initiative, the study indicated that the overall global business context is noticeably riskier than in the two previous years, while respondents’ results in the United States implied that the risk landscape is about the same as before.
The common risk themes were ranked in order of overall priority providing context for understanding the 10 most critical uncertainties companies face in 2017.
Economic conditions in the global marketplace may significantly restrict growth opportunities. There are many sources of economic uncertainty in the markets that companies operate within. Examples of factors impacting growth include market volatility, Brexit, a strong U.S. dollar, central bank monetary policies, the aftermath of the U.S. 2016 election, sluggish growth rates in various global markets, rising global debt, and the threat of deflation. Survey participants may have concerns about a “new normal” of operating in an environment of slower organic growth.
Regulatory changes and scrutiny may increase, noticeably affecting the manner in which organizations’ products or services will be produced or delivered. Ranked at the top in our prior surveys, this risk fell to the second spot for 2017. Companies continue to display anxiety about regulatory challenges affecting their strategic direction, how they operate, and their ability to compete with global competitors on a level playing field. This risk may be particularly relevant in 2017, given the climate of uncertainty surrounding the new U.S. executive and congressional administrations and their influence on the role of government and the business environment. Any major regulatory change—whether perceived as positive or negative—is of significant interest to executives and directors.
Organizations may not be sufficiently prepared to manage cyberthreats that could significantly disrupt core operations or damage their brand. Cyber risks have evolved into a moving target. Many factors are driving change, including the ongoing digital revolution, new innovations to enhance customer experience, cloud adoption, social media, mobile device usage, and increasingly sophisticated attack strategies, among others. The harsh reality is that new technology offerings and developments in organizations are quickly extending beyond the security protections that they currently have in place.
The rapid speed of disruptive innovations and new technologies within the industry may outpace the organization’s ability to compete or manage the risk appropriately. A company’s inability to respond in a timely manner to changing market expectations can be a major competitive threat for organizations that lack agility in the face of new market opportunities and emerging risks. The speed of change and development of emerging technologies can occur anywhere and in any industry, and this risk reaches far beyond the retail marketplaces. Disruption affects all industries. No company is immune.
Privacy, identity, and information security risks are not being addressed with sufficient resources. The technological complexities giving rise to cybersecurity threats also spawn increased security risks to privacy, identity, and other sensitive forms of information. As the digital world evolves and connectivity increases, new opportunities emerge for identity theft and for the compromise of sensitive customer information. Recent hacks exposed tremendous amounts of identity data involving large companies and the federal government in the United States. These underscore the harsh realities of this growing risk concern.
Succession challenges and the ability to attract and retain top talent may limit the ability to achieve operational targets. A number of factors are driving this risk—changing demographics in the workplace, slower economic growth, increasingly demanding customers, and growing complexity in the global marketplace. As a result, organizations are being forced to elevate their recruitment and retention efforts to acquire, develop, and retain talent with the requisite knowledge, skills, and core values to execute challenging growth strategies.
Anticipated volatility in global financial markets and currencies may create significant challenges for organizations to address. Given questions surrounding the United Kingdom’s eventual exit from the European Union, as well as uncertainties in China and other world markets, it is not surprising that this risk remains among the top 10 for 2017. Factors indicated earlier—including rising public debt, falling commodity prices, sluggish economic growth, the strong U.S. dollar, and uncertainty regarding monetary policies—all contribute to uncertainty in global financial markets and currencies.
The organization’s culture may not sufficiently encourage timely identification and escalation of significant risk issues. An organization’s culture has a huge impact on the manner in which risk issues are brought to the attention of decision makers when there is still time to act. Given the overall higher levels of risk-impact scores for all risks in 2017 relative to the year before, this cultural issue may be especially concerning to senior management and boards.
Resistance to change could restrict organizations from making necessary adjustments to their business model and core operations. The cultural issues noted above combined with a lack of organizational resiliency can be lethal in these uncertain times. Organizations committed to continuous improvement and breakthrough change are more apt to be early movers in exploiting market opportunities and responding to emerging risks than those companies that cling to the status quo.
Sustaining customer loyalty and retention may be increasingly difficult due to evolving customer preferences and demographic shifts in the existing customer base. Protecting the customer base is not easy in today’s highly competitive environment of disruptive change. This may be what is on the minds of the survey participants rating this risk.
The company’s directors may want to consider the risks ranked here when determining the organization’s “big picture risks” to be evaluated in 2017. Boards should be aware of the context of the nature of the entity’s risks inherent in its operations. If your board has not identified these issues as risks, your company’s directors should consider their relevance and ask why not.
Branding is the process by which a company establishes a significant and differentiated presence in the marketplace that attracts and retains loyal, long-term customers. A strong brand has a significant impact on the company’s shareholder value. As such, the board should dedicate some time to oversight of the brand’s reputation and stability.
Several thoughts on the board’s governance and oversight of the company’s branding and brand management follow that are based on my firm’s experience and a recent NACD Dallas chapter roundtable discussion I facilitated in September involving active directors and marketing executives.
Understand the brand and brand portfolio. While the board’s governance role is rarely involved in the intricacies of managing or communicating the brand, directors should understand the company’s positioning and related brand promise. This baseline understanding is the price of entry into any conversation about a company’s branding. For example, what expectations does the brand inspire in current and prospective customers that differentiate the company’s offerings from competitors’ offerings? Does the company deliver on that brand promise in every customer interaction? Most importantly, how does management know this vital alignment exists? Consider brand implications from other aspects of the business, too: employee relations, supplier interactions, quality processes, research and development, and advertising.
Ask management where and when they would value input. Does the board clearly understand the type of interaction management would like to have with respect to the brand management process? Executives and directors should have a mutual objective: engage in dialogue in the right way and at the right time, and focus on the issues that most demand board oversight.
Think strategically about branding and brand management. Brand discussions are tied inextricably to discussions about strategy and markets. Therefore, the board’s focus should be directed to strategic oversight rather than to the tactical, day-to-day nuances of managing the brand or brand portfolio. For example, one company conducts a two-day strategy retreat where directors and senior management focus on important questions about what the future looks like, the pain points that present opportunities, what the company is doing to face the future confidently, and the adjustments necessary to the strategy. Debates about strategic direction incorporate discussions about the company’s markets, key differentiators, and brands.
Measure the contribution of branding to shareholder value. The level of investment in the company’s brands, the return on those investments, and the process for monitoring each brand’s performance are worthwhile topics on the board’s agenda. How is the company measuring the return on investment (ROI) and sustaining and increasing the contribution of branding to shareholder value? ROI can be difficult to measure because customer loyalty, which helps to promote stable cash flow over time, is an integral component. That said, the math underlying the cost of winning new customers versus that of retaining existing customers is not difficult to understand. Neither is the contribution of effective brand management to reducing the volatility associated with future growth expectations and economic downturns.
Be involved in discussions about new branding opportunities and building value from acquired brands. How does management decide whether to build or buy a brand to diversify the brand portfolio? This conversation can evolve into a mergers and acquisitions (M&A)-type dialogue that, if the transaction is significant, should take on all characteristics of board M&A oversight spanning the pre-acquisition, acquisition, and post-acquisition integration phases of the process. If the company is acquisitive, the board should understand the possible strategic contribution of acquired brands when approving the company’s strategic plan. The board may also want to become familiar with the M&A pipeline and the potential targets in management’s line of sight. If brand acquisitions are an integral part of the strategy, directors need to ensure that the management team includes individuals with the requisite skills to execute transactions and integrate acquired brands into the company’s portfolio.
Oversee the management of how risks impact branding. There are many risks to consider with respect to brand image. Risk management is an important skill from a branding standpoint because severe unmitigated risks can erode the value of a brand if there are persistent headlines about a high-profile crisis (e.g., data breaches, pervasive quality failures, corruption violations, litigation, and egregious financial restatements). In addition, when there is a re-branding with a new “look and feel” to the brand, a thorough search related to the proposed brand name, word marks, logos, tag lines, and other intellectual property (IP) should be conducted to ensure the new brand is unique and does not infringe on another company’s rights. As the initial years of using a new brand are a period in which opposition can be raised, an effective search process is a prudent investment to undertake before the company spends heavily on the roll out and advertising campaigns. Once a branding architecture is established and protected by trademark, there is a need to monitor and protect the brand from other users to avoid dilution.
Periodically evaluate the board’s experience and diversity. Directors with a background in marketing and/or experience with brand-driven organizations are more likely to be comfortable inquiring and raising issues about management’s branding process. Even though industry experience helps, this is an area where perspectives outside the industry may contribute even more value. As in other realms of oversight, the more diverse the board members’ experience and backgrounds, the healthier the debate leading to a more robust branding strategy.
An important closing comment: The board can help temper the propensity of an aggressive management team to develop or acquire new additions to the brand portfolio. Management must have the capacity to manage new and acquired brands to deliver to ROI expectations. The board can help management frame a realistic portfolio diversification strategy. Then, it’s up to management to execute.
Jim DeLoach is managing director with Protiviti, a global consulting firm.