The Key Role of Boards in Identifying and Evaluating Risk: Insights from the RANE & Nasdaq Summit 2022

By Vanessa Mesics, Head of Director Experience & Co-Leader of the Nasdaq Center for Board Excellence, Nasdaq, and Greg Radner, Chief Marketing Officer, Risk Assistance Network + Exchange (RANE)

As the corporate governance landscape evolves, the board member’s role continues to expand. The rebalancing of board responsibilities, prompted by a variety of risk vectors on both macro and micro levels, has heightened expectations across the board. More than ever, directors and management teams are witnessing a compounding of risks and facing increased demands for transparency and disclosure. Effective management of such issues can help provide an understanding of operational performance, address resource inefficiencies, and forecast enterprise risk. It can also yield other benefits, such as lower costs of capital, reduced shareholder turnover, and enhanced talent recruitment and retention.

Adopting a Proactive and Prepared Mindset

In preparing for risk, management and boards must define roles and responsibilities. The full board maintains ownership of high-level discussions and decisions on the intersection of risk and strategy – and board members must continue to speak as a unified group. Expectations, accountability, tools, and resources to execute these responsibilities should be established early on. Answers to crucial questions — including when the board is going to be informed, what is the board’s role and what outside resources will come to bear, such as legal help, regulatory notification, or crisis communication — should be determined well before a crisis strikes. 

Tabletop exercises can help facilitate preparedness and alignment around responsibilities. While these may not anticipate every scenario, they do introduce a thought process on how to work through problems and ask informed questions. This is key to avoiding confusion when risks or crises emerge, and it helps management understand the board’s expectations. Management and board members can learn best practices and other lessons through these preparative exercises that may also apply to other areas of the business. 

Strong enterprise risk management teams can also be valuable in helping the board to identify, evaluate and prioritize risk. Each risk has a unique consequence – whether financial, reputational, or a combination of these – but all risks should be identified and communicated to the board. The board should also prioritize understanding of possible consequences of each risk and details on mitigation processes and their potential to lessen consequences. By understanding these elements, boards can ensure their responses are not reactive when approached by employees, stakeholders, shareholders, journalists, and others. 

Considering an Ever-Evolving Dynamic Environment

Companies are witnessing a broad set of transformative risks and issues. These range from global economic volatility and supply chain disruptions to geopolitical tensions and their impact on business, increasing threats of cyber security and financial crime, and digital assets and decentralized finance. In addition to these topics, boards must be attuned to industry-specific events that are happening to competitors. 

The regulatory environment is also changing. In this uncertain regulatory environment, shareholders may expect companies to go beyond compliance with existing disclosure obligations and expect boards of directors to have a greater understanding of environmental, social and governance (ESG), cybersecurity, and other issue areas. Regulatory bodies are increasingly imposing new expectations on public companies and their board members, proposing and passing regulations that are often unclear and difficult to follow. For example, which key performance indicators (KPIs) will be used to track ESG goals have not yet been confirmed nor communicated to companies and their boards, and the sheer scope of the expectations and work attributed to data governance regulations have not been clarified. To successfully measure and anticipate changes, the board needs to first understand what the baseline is. “In some ways, it’s going to defeat the purpose as companies will be less aggressive in the goals they set to ensure they don’t miss them,” says Frances F. Townsend, Senior Counsel, Activision Blizzard. Additionally, there is the challenge of performing data analytics as historical data no longer seems a good predictor in the current environment. 

Geopolitical events have also risen to the top of the board agenda. Board members should think about how geopolitical events and their possible implications might impact decisions, which can affect the share price for public companies and pose reputational consequences. It can also motivate shareholder activists to target the company, its board, and its executives. As witnessed through events in Ukraine, global disruptions can impact company operations, causing a chain of consequences throughout all company operations.

The recent global landscape has highlighted the importance of resiliency amid drastic global changes and intersecting risks while emphasizing how boards can be key to the mitigation process. Boards that establish good habits and a strong structure to respond to risks should be better positioned to act quickly and proactively by reducing the number of decisions made during crises. While it is impossible to mitigate every threat, board members should constantly be thinking about preparing, preventing, and managing any event while protecting all stakeholders, including clients, employees, and shareholders, to create a resilient corporate structure. 

Acting Quickly in the Age of Rapid Information

With a myriad of internal and external factors – from collective understandings to geopolitical developments – rapidly evolving, board members may not always know the right questions to ask or what their company should prioritize at any given moment. As greater, faster transparency and engagement from management and boards are increasingly expected, the need to remain informed is more important than ever before. Effective risk management shapes how boards operate. Board members should expect the unexpected and manage unknowns by identifying the downside risk, helping management brainstorm solutions, and anticipating the worst-case scenario.

Given the rapidity at which information and news travel today, boards need to be prepared to act when setbacks happen, and crisis management cannot be delegated to executive teams. Shareholders expect the board to actively help navigate all phases of a crisis, from the initial “hair-on-fire” through the post-mortem. One of the most important things for boards to do is to engage, as shareholders and stakeholders expect the board to ensure that appropriate processes are in place to successfully manage a crisis. 

The board’s role is to ensure the company has the right processes and people in place to effectively identify and evaluate risk, in addition to approving the risk appetite of the firm on behalf of stakeholders. Developing the risk appetite is critical as it frames how the board will react to any risk-related setback. Boards may consider collaborating with management to establish a risk appetite statement, approaching risk from a macro level. While identifying every single risk is unrealistic, this practice promotes discipline in setting a foundation for enterprise risk management, and it sets parameters on how board members should collectively think and react to risk. Furthermore, it allows for the flexibility to evolve those parameters as appropriate.

Dashboards can be an effective tool, acting as a living document that enables directors to focus on topics and effectively prepare for meetings. Trust, cohesiveness, and transparency among directors are key to avoiding fracturing of the board and becoming vulnerable to activist campaigns. Directors must feel empowered to speak freely and openly, with confidence that what is said in the boardroom stays in the boardroom. 

Understanding and questioning how information flows in an organization can help boards better anticipate the unforeseen. A piece of that journey is a cultural exploration that investigates whether information is welcomed from all viewpoints. An intentional and proactive attitude to seek outside views is critical as diversity of information from inside and outside an organization is an important part of identifying pain points early on. Additionally, boards need to invest in director education to stay ahead and retain an innovative understanding of current issues and different points of view. Boards need to be provocative when imagining the unimaginable to pinpoint what is around the corner both in the short- and long term.

Becoming Key to Risk Mitigation Success

More crises – and a broader array of them – are bound to happen. They will be disruptive to operations and business continuity at large, but preparedness will inform what changes should be made and which changes should be made proactively. This may mean bringing additional board members who have direct experience that could improve how an organization deals with the next crisis. How each company assesses, plans for, and deals with risks is going to be vastly different. However, what is certain is that boards that do not employ an agile mindset amidst an ever-changing environment will lose focus and efficiency when tackling issues and guiding strategy. 

To fulfill its duty of care in the oversight of company risks, the board must ask strategic questions to understand how management is approaching these risks while ensuring that the measures are sufficient and appropriate. As the role of the board continues to evolve, the true character of a corporation, its directors, and its management is how they respond to a problem rather than the nature of the problem itself. It is in the business’s best interest to proactively identify and mitigate issues to protect stakeholders, employees, investors, and its reputation. By planning, using good judgment, and seeking director education, board members can successfully oversee the risks facing a company while helping the company plan, mitigate, and respond to those risks proactively.

The views and opinions expressed herein are the views and opinions of the authors and do not necessarily reflect those of Nasdaq, Inc.

For more leadership insights and resources, we invite you to join the Nasdaq Center for Board Excellence, a community and collaboration environment in which board engagement is deepened and experiences are shared. Click here to join our community.

^{© 2023 Nasdaq, Inc. The Nasdaq logo and the Nasdaq ‘ribbon’ logo are the registered and unregistered trademarks, or service marks, of Nasdaq, Inc. in the U.S. and other countries. All rights reserved. This communication and the content found by following any link herein are being provided to you by Nasdaq Governance Solutions, a business of Nasdaq, Inc. and certain of its subsidiaries (collectively, “Nasdaq”), for informational purposes only. Nothing herein shall constitute a recommendation, solicitation, invitation, inducement, promotion, or offer for the purchase or sale of any investment product, nor shall this material be construed in any way as investment, legal, or tax advice, or as a recommendation, reference, or endorsement by Nasdaq. Nasdaq makes no representation or warranty with respect to this communication or such content and expressly disclaims any implied warranty under law. At the time of publication, the information herein was believed to be accurate, however, such information is subject to change without notice. This information is not directed or intended for distribution to, or use by, any citizen or resident of, or otherwise located in, any jurisdiction where such distribution or use would be contrary to any law or regulation or which would subject Nasdaq to any registration or licensing requirements or any other liability within such jurisdiction. By reviewing this material, you acknowledge that neither Nasdaq nor any of its third-party providers shall under any circumstance be liable for any lost profits or lost opportunity, direct, indirect, special, consequential, incidental, or punitive damages whatsoever, even if Nasdaq or its third-party providers have been advised of the possibility of such damages.}