Tags

  • Published on

    Cybersecurity: is it time for a Goldilocks conversation?

    Accountability Decision Making Governance Leadership Performance
    Cybersecurity is getting lots of airtime at present, often for all the wrong reasons. Reports of leaks, hacks, and data breaches pervade news sites on an almost daily basis it seems. Sadly, many news articles are sensationalist: but that is what sells the news, I guess.
    Many studies have been conducted to try to understand the problem—most of which seem to offer little when it comes to meaningful recommendations for directors seeking to mitigate business risk. Consequently, most studies and reports go in one ear and other the other.
    However, a recent study by the Ponemon Institute does make interesting reading (link here). The purpose of the study was to determine if boards of directors are a help or hindrance to creating a strong cybersecurity posture. Significant differences between how boards and IT security folk perceive risk (especially cybersecurity risk) were exposed. The technical people tend to talk it up (validly or otherwise), whereas directors typically consider cybersecurity as one risk amongst many others. That directors and technical people have quite different perceptions about cybersecurity is hardly a surprise. However, it does highlight an operational problem. The perception gap has the potential to see either too much or too little invested in appropriate risk mitigation measures. Either way, the impact on the overall performance of the business is likely to be significant. How might this be addressed?
    Perhaps the answer lies in a candid Goldilocks meeting, whereby directors, executives and IT security folk meet together (for as long as it takes), to discuss and reach agreement on two things:
    • Understand cybersecurity from a risk perspective
    • The nature of cybersecurity risk and how it might be addressed
    A Goldilocks meeting should have the effect of ensuring that the board is suitably informed about cybersecurity matters, and the IT security people should gain an appreciation of the balance of the risks the board needs to consider. An appropriate action plan, agreed between the parties and based on a common understanding, could ensue.
    To have the board, executives and technical people working together with an agreed purpose and outcome in mind, rather than talking past each other as is typical in many cases I have witnessed, might sound fanciful. However, it's bound to do wonders for morale and culture. Perhaps it might be the most beneficial outcome!
  • Published on

    Boardroom behaviours: What role culture?

    Accountability Ethics Governance Leadership Performance Strategy
    I've been reading back through some older Musings this week, to review (and smile at) ideas that were front-of-mind a couple of years ago. Which ones have been superceded or discredited; which has been forgotten; and, which are still topical?
    This one, on boardroom motivations and habits, appears to still be topical today—perhaps even more so than when it was written in April 2012. How so? I was party to a discussion on boardroom behaviour today and a question of culture was raised. To what extent might culture drive conduct and ultimately business performance? The results of a recent survey conducted by Grant Thornton suggest that culture is a huge factor in corporate governance and strategy. There is much evidence to suggest that good business performance is an outcome of 'good' culture (here's one piece).
    However, culture is complex. Consequently, when one of the discussants said that a senior leader at ASIC is looking for policies and procedures to support [a positive] culture in boardrooms I was bemused, to say the least. How might one successfully codify—much less 'legislate'—culture, in pursuit of good conduct and presumably good business performance? 
    A long time ago, Drucker famously said that culture eats strategy for breakfast. Might the corollary be that a well-written code of ethical conduct that is periodically discussed, agreed and pursued by directors trump any attempt to 'legislate' any particular culture into being?
    Compliance-based regimes rarely achieve much more than to incur expense, resentment and, sometimes, avoidance. That is well-known. However, while codes are by no means fool-proof they can be helpful if every director 'signs up' and willingly embraces them. My research suggests that the key lies with director behaviour and social interactions in the boardroom, not the code per se. 
    That said, why all boards that are serious about creating a positive culture both within the boardroom and the wider business they govern have not implemented a suitable code of conduct is beyond me. It is a matter of accountability. Perhaps boards that decline to travel this path have not realised that the fish rots from the head!
  • Published on

    Seven days out ...

    Decision Making
    The final countdown to a busy speaking and advisory trip to the UK and Eire is now underway. That four presentation slide decks are now ready means just one more set of slides remains to be created ahead of a series of seminars, master classes, roundtable forums and private meetings starting 1 September. A wide range of topics will be discussed, including:
    To be a participant in what is shaping up to be an interesting series of discussions with leading practitioners and academics will be an honour. If you are based in the UK or Eire, I hope you can join the conversation. Regardless, a summary of the main discussion points from each public session will be posted here. If you would like more information, please get in touch.
    Now to finalise the remaining slide deck, and confirm the trip logistics...
  • Published on

    Research update + heartfelt thanks

    Governance Phd Research Research Update
    Over the last month or so, I've begun to receive questions—several per week—about my doctoral research. Most have been variations on these themes:
    • Has the thesis been examined yet / have you get your PhD yet?
    • Can I have a copy (or a summary) please?
    That people beyond close friends and associates might be interested in the status of the research and in reading the outputs has been gratifying. Sadly, process delays have impeded the provision of affirmative responses for the time being. The background and current situation is as follows:
    On the examination: I had hoped to have some news by now, as eleven weeks has passed since the dissertation was submitted for examination (oral examinations normally occur about 8–12 weeks after submission). However, there was a problem with the examiner panel and some seven weeks elapsed before it was resolved. I've now been told to expect to expect the oral examination during the week of 19 October—another nine weeks away! Thankfully, my head supervisor is trying to accelerate the process, and I've got other things to be going on with.
    On the request for a copy of the full dissertation: A copy of the dissertation (The influence of boards on business performance: Evidence from inside the boardroom) will be posted here after the examination and emendation process is complete. A copy will also be available via academic search engines in due course. In addition, I plan to consolidate the main research findings into a slim (but readable, with practical implications) volume. If you would like to be added to a mailing list to receive a copy when it is available, please let me know.
    Notwithstanding the rather annoying delay, feedback from several people who know about the research findings suggests it will be worth the wait, both as a useful guide for boards and as a basis for future research. However, such claims are preemptive and presumptive in my view: the dissertation needs to emerge from the examination process first! 
    My heartfelt thanks for your interest in the research, and your patience while the examination process runs its course. My hope is that your interest and patience will be satisfied soon!
  • Published on

    Director's fees: Please sir, can we have some more?

    Accountability Decision Making Ethics Governance Leadership Performance Strategy
    The results of the annual director remuneration survey are in. (Read the media release here, and press reports here and here.) Fees have climbed about four per cent in the last twelve months, slightly ahead of CPI. The survey results also indicate that director workload has increased by 41 per cent over the same period.
    A cursory analysis suggests that the workload increase is, to a large extent, a consequence of increased compliance requirements: more rules and regulations. While a 'more work, more pay' argument is eminently justifiable, is it fair? Moves to increase directors' fees as a consequence of increased compliance workload may deliver an unintended consequence: a back-to-the-future experience. Boards are likely to become more defensive and cautious, contributing relatively little to what they are there for—the pursuit of company performance.
    Rather than peg directors fees to time and compliance activity, it might be more productive to ask whether company value (however that might be expressed) is growing as a consequence of board contributions. Many leading commentators (Bob Monks, Bob Garratt, Morten Huse and Richard Leblanc, amongst others) have suggested that boards need to become more strategic, by looking to the future. Yet statutes and regulations cannot be ignored. Boards and shareholders need to wrestle with this tension. Questions of strategy, decision-making, division of labour, accountability and ethics need to be debated and resolved. Ultimately, viable resolutions are most likely to emerge from a joint commitment to the long-term purpose of the company.
    The board needs to drive company performance in pursuit of shareholder wishes, while also ensuring that statutory and regulatory requirements are appropriately satisfied. If the board demonstrably leads the company forward, and does so in accordance with both the agreed purpose of the company and relevant statutes, shareholders are unlikely to baulk at proposals to reward the contributions of directors appropriately.
  • Published on

    The importance of catching one's breath: time-out is not time wasted

    Decision Making Governance Phd Teaching
    Picture
    When I was in London most recently, in June, I fortunate to visit Greenwich. A friend had told me that Greenwich Village is 'different' and that a visit was in order. And it was! In contrast to the hustle and bustle of the City, Canary Wharf and the West End, the people of Greenwich are more laid back. They smile, they say 'hello' and they walk more slowly than their neighbours across the Thames. Many, like the twelve in the picture, happily sit and peer into the distance, taking it all in. Who knows what they were thinking or even looking at. It probably doesn't matter, I guess.
    Why am I relating this story? My short visit occurred three-quarters of the way through a hectic three-week multi-country trip. It reminded me of the importance of downtime. With hindsight, the interlude—to gather my thoughts—probably made the difference between just making it through the final week of the trip, and finishing the trip well.
    Today, as I was working on a presentation to be delivered on my next trip (1–11 September), thoughts of that Greenwich interlude entered my consciousness. The upcoming trip is packed with seventeen significant commitments including two master classes, three presentations, two important dinners and several planning and roundtable meetings; in London, Canterbury, Leeds, Wolverhampton, Dublin and Belfast. It'll be a busy trip. To top it off, our elder son, who is working in Germany at present, has just asked if we can meet up in London while I'm there. Of course, but when? Then the penny dropped. Rather than pursue two remaining 'pencilled in' meetings, why not spend an afternoon with Tim? Two carefully crafted emails later, some 'Greenwich Time' was locked in. I'm looking forward to it already.
    As you move through Friday, my hope is that you too will have the opportunity—better still, take the opportunity—to run on Greenwich Time this weekend. If we are to perform well when it counts, we need to set time aside to relax, recharge and to prepare—mentally, physically and spiritually—for that which lies ahead.