In a recent article on Train Wreck, Steve Tobak put forward the idea that corporate governance is a myth. He based that hypothesis on the assertion that there are no consistent and effective laws, methods and metrics governing public companies.

From my years of experience with public company boards and directors, I would agree about the lack of consistently effective laws or methods for governance. But I would also give a bit more credit to those who serve on corporate boards. I have worked with quite a few in my day, and most have been peopled with ethical and hard-working directors and have managed good standards of governance, often under trying circumstances.

Through my work in corporate governance, I have come to view governance as a social system that is very dependent on the qualities and characters of the people involved. I have also come to recognize the key elements of a successful board – and a successful corporate governance program. While I have been fortunate to witness some real success stories, I do agree with Mr. Tobak that such stories are not nearly as common as they should be. For that reason, I’ve outlined below what I believe are crucial factors for a successful board that truly serves its shareholders.

Straight Talking. The first requirement for a successful corporate board is a willingness to tell – and hear – hard truths. Good governance requires guts, and good boards are made up of brave and courageous people. I know about the sorts of boards that led Steve Tobak to write his article – the very sorts who would never dare to hire a consultant (such as myself) who might tell them the truth.

Knowing the Goals. To discharge their responsibility to the shareholder requires a board to understand what type of shareholders they have and what type of performance the shareholders are looking for. For a large listed company, this is no mean feat. Responsible, successful boards invest time and effort on communicating with their shareholders to ensure that investors understand the company’s direction, goals, and likely outcomes – with a keen awareness of their responsibility to represent the interests of minority shareholders along with those of larger investors.

Planning Strategy and Execution. Once the board has worked out what is acceptable performance for their shareholders, they reach the real challenge: ensuring that the company has a strategy that will deliver that performance. It is imperative that the board should contain individuals with a deep understanding of both the company’s business and the industries in which it operates, as well as any geographic regions and key customer needs. It is also imperative that the board should be independent of management and capable of thinking through an independent line of analysis.

Defining Success. Boards must take responsibility for developing key performance indicators (KPIs) and ensuring that management report these diligently and accurately. Reporting must be comprehensive and timely enough to ensure that the board is aware of performance without being so cumbersome that it hampers management’s ability to deliver. Developing good KPIs is more of an art than a skill — something that boards get better at with practice.

Building a Team. When the board has endorsed the corporate strategy, they then have a responsibility to ensure that there are sufficient skills within the boardroom for appropriate oversight of the strategy as management set about implementation. Sometimes the best person to add to a board is one who makes the other board members slightly nervous. It requires courage to recommend such appointments to shareholders, but a good chairman will seek out such directors, confident that they add value to the board, even if they do make his job more difficult.

Leadership on Compensation — both for the board and for executives. Many people consider “independence” in this sense to mean sufficient personal wealth that board directors need not rely on fees paid for board appointments. That is a sadly deficient definition. It is not uncommon for board members to become almost addicted to the status of his or her membership. There is a difference between loyalty to the board and a slavish desire to remain on the board.

My personal preference is for a board fee that adequately compensates board members are the risks and liabilities of the position as well as the considerable time and expertise that it requires. Like Mr. Tabek, I have found that stock and options provide incentives for board members to further their own interests over and above those of shareholders, although I know many ethical directors are paid in that manner and would never do any such thing.

The board must also give thoughtful guidance as to executive compensation. Again the issue of options, whilst intended to align interests with those of the shareholders, can provide perverse incentives. Boards need to ensure that executives are paid sufficiently well to stay on board, without risking an unacceptable transfer of wealth from the shareholders to the CEO.

Effective Oversight. Having decided on the remuneration mechanism, the board must develop a close relationship with the CEO so that they can oversee performance and ensure that ethical behaviour in the best interests of the company and the shareholder, rather than incentive-driven behaviour in the best interests of the CEO’s pay packet. As Steve Tobak points out, it is easy for a board to condone behaviour that raises the share price in the short-term whilst undermining the long-term sustainability of the organisation. Good boards do not take the easy route, instead understanding the key attributes of the strategy and linking compensation to achieving strategic milestones.

These things can be consistently measured and compared across different companies – but of course they don’t tell you whether or not the board members are ethical, independent and fiercely committed to the success of the company. You cannot legislate for ethics or commitment. All you can do is hire the best available board members, support them in their endeavours, and hold them to account through appropriate disclosure. However, if you do that, my experience suggests that you will get good governance.

Tags: Tags: corporate boards, shareholder value, corporate governance

Julie Garland McLellan has over 20 years experience in strategic business development in resources, utilities and energy industries. She is currently a corporate governance consultant with Blackrock ITS, a leading Australian IT services and solutions firm. Previously, she served as associate director with McLennan Magasanik Associates, and a board member of the Victorian Minerals and Energy Council, the Victorian Energy Networks Corporation (VENCorp), the Melbourne University Engineering Foundation and City West Water. Julie has an honours degree in civil engineering from City University in London, an MBA from the leading Spanish Business School (Instituto de Empresa in Madrid) and is qualified in finance and corporate governance.

I was at a company directors’ conference recently where my colleagues and I began discussing how we anticipate that company directors’ roles will change in the future.

We all agreed that company directors are under increasing pressure to add value to businesses, and that there will be growing scrutiny about their impacts on the bottom line. Some of this discussion is already happening.

So where do board directors really demonstrate their value? My friends are all sure that their ability to develop and institute sound governance policies adds value by reducing risk. McKinsey & Co in their 2005 Global Investor Survey revealed a willingness by investors in Asia to pay up to a 25% premium for companies exhibiting good governance policies. You can bet that in the future, boards will be mindful of this in developing governance processes and procedures that instill confidence in the minds of investors and the public.

It is likely that the biggest value added by good governance practices is the time that is saved through automation and stream-lined processes; this can be put to use in the strategic performance related areas where competitive advantage is created.

Savvy board members will likely work to engage their communities in efforts to gauge how governance is measured – and track the value that the board has added in the process, so that it can be captured and reported to shareholders. This is no small task. In my experience, when boards do a 360 degree performance review they often find that the further from the boardroom, the lower the perceived value added by the board. The best boards are now focusing their performance review on specific activities and SMART metrics that ensure performance is recognized.

As companies begin to focus more closely on just what it is that board members do in their roles, these kind of value-add calculations will be important metrics that will impact the share-price in the same way as production data. Is your board ready that brave new world?

Tags: corporate boards, Controls Intelligence, IT, ROI, shareholder value

Julie Garland McLellan has over 20 years experience in strategic business development in resources, utilities and energy industries. She is currently a corporate governance consultant with Blackrock ITS, a leading Australian IT services and solutions firm. Previously, she served as associate director with McLennan Magasanik Associates, and a board member of the Victorian Minerals and Energy Council, the Victorian Energy Networks Corporation (VENCorp), the Melbourne University Engineering Foundation and City West Water. Julie has an honours degree in civil engineering from City University in London, an MBA from the leading Spanish Business School (Instituto de Empresa in Madrid) and is qualified in finance and corporate governance.

During a recent talk recently with some colleagues, we ended up in a lively discussion on how information technology is considered by – and presented to – corporate boards.

One of the key issues we discussed is the gap between the real-time, active reports on internal operations enabled by continuous controls monitoring and the static reports that are inevitably shown to corporate boards. Even at some of the most forward-thinking companies, where these solutions provide varied functions and departments with real visibility into internal operations, the board almost always sees a PowerPoint or Word summary of those operations, which they are expected to use to make strategic decisions.

These kind of static summaries are about as useful or representative as a single frame from a movie – yet the board is expected to make decisions on this information, which may already be outdated by the time it is formally presented.

The consequences can be serious. Given how long it can take to plan and execute a board’s strategic initiative, acting on information that is out of date can be disastrous. Consider, for example, a retailer whose most recent sales summary shows an increase in sales in an Indian market, prompting board decisions to invest additional resources in building a factory there. Implementing such a plan can take a year’s worth of work, from construction to hiring. Now consider that, two months into planning, sales in that market stagnate. In order to plan effectively and avoid wasting resources – perhaps put the project on hold for a bit – the board must have regular access to the real-time operational visibility available to company employees.

This is where boards could really benefit from continuous controls monitoring – and its capabilities for generating rules and exceptions to rules using real-time data. If boards were able to tap into this intelligence, they could make decisions incorporating these rules to allow for changes in circumstances. So, for example, they could plan to build a factory in India provided that sales stay within certain defined parameters – with sales below those figures to be flagged as exceptions and reviewed by the board.

By taking assumptions out of planning and instead hardwiring set parameters into a project plan, the board can be sure that key assumptions are always factored in, and that they are working with the most up to date, accurate intelligence possible.

We often hear talk of how investments in governance, risk and compliance can bring broader ROI to the enterprise, and this is a key example of how visibility into controls can have far-reaching positive impacts on a company.

Tags: corporate boards, Controls Intelligence, IT, ROI,

Corporate boards can (and should!) operate with a primary focus on revenue-generating activities. This is the bread and butter of any corporate operation, and the board’s duty to shareholders means that profit must be top-of-mind.

Unfortunately, at times boards and those with other fields of expertise – say IT or finance or HR – can seem to be speaking in different languages about the initiatives they are pursuing, and failure to map plans and ideas to the board’s priorities can cost an operation valuable time and resources.

Consider IT, for example. How a board considers IT expenditures can vary widely and ultimately impact how widely IT initiatives are deployed, how deeply they are supported, and whether they’re allowed to continue after initial roll-outs.

Oftentimes, boards will approach IT expenditures globally, establishing budgets for the entire enterprise without establishing criteria on how that budget can be spent. Many boards evaluate proposed projects based on the total project cost. Some boards will also consider the credibility of the IT department and past successes at coming in on budget, being installed on deadline, and that the implementation “worked” (defined as, “it did what it was supposed to do”). What these approaches fail to consider is the impact of IT expenditures on profit – and thus, the enterprise as a whole. When boards focus solely on IT implementation checklists, they fail to consider the truly important metrics – whether Product X or Software Y allow users to increase efficiency, improve speed, or compete in new sectors – and the ultimate impact of those IT expenditures on the company’s bottom line.

What boards should really be considering when evaluating IT expenditures is whether the proposed new technologies will allow the business to accomplish goals that it couldn’t before, along with the strategic impact on the company of accomplishing those goals. Factors like keeping up with the competition or avoiding being stuck with a legacy system are non-issues unless they somehow affect P&L statements.

The real concern for boards should be in accurately evaluating how IT will improve the business, how the success of IT initiatives will be evaluated, and what the return on investment will be. Boards should be calculating ROI for all of their decisions. Simply put, if something’s big enough to bring to the board, it’s big enough to justify an ROI calculation.

Information Technology has brought tremendous changes and benefits to corporations throughout the world, and we know that’s a trend that will continue. But to ensure that companies invest smartly in IT, it’s crucial to factor in ROI from the outset.

Tags: corporate boards, IT, ROI

My friends in the governance, risk and compliance world tell me that this year’s major industry conferences like SAP GRC 2008, COLLABORATE-08 and ASUG 2008 all point in one direction as far as continuous controls monitoring goes – companies are hungry for an end-to-end approach that goes beyond separation of duties (SoD) and Sarbanes Oxley (SOX) compliance to what we at Approva call an integrated Controls Intelligence strategy. What do we mean by that? Currently, a huge majority of companies are using the piecemeal approach to continuous monitoring, kind of like making sure the doors and windows of your house are shut and the fire alarm is working. But we all know that the ADT security system is the protection net that keeps you at peace while you are at the beach. The Approva Controls Intelligence solution is like the ADT system ensuring all critical company assets are protected, be it financial, IT, business processes.

But more importantly, have you switched to a controls intelligence platform that provides you an end-to-end solution to governance, risk and compliance? Most recently, Approva has developed the BizRights Version 4.1 that takes a targeted approach to user access and system configuration monitoring, whether they’re using Oracle, PeopleSoft, SAP, or another ERP system.

With Approva BizRights 4.1 Controls Intelligence Suite, we’ve given our customers access to something that no one else can offer – accurate, unified views of their enterprise-wide controls environment. This allows them to bring financial controls together with IT so that they can independently validate the state of their controls, without worrying about their ERP vendor’s release schedule.

This adds a one-of-a-kind element of speed and visibility to controls that helps our users reduce risk, speeds up operations, bolsters enterprise security and lessens compliance obligations. BizRights 4.1 also gives our Oracle and PeopleSoft customers something we think they’ll really appreciate – a performance-driven controls monitoring solution that bolsters enterprise security and protects the company’s resources from unmitigated risks. Here’s what Treasury & Risk Management magazine had to say about Approva’s BizRights Version 4.1.

So if your company is considering taking its risk and compliance strategy to the next level, please take a look at how some of our customers have optimized the Approva BizRights Controls Intelligence solution to achieve far-reaching results in their compliance efforts.

Tags: Tags: BizRights, controls intelligence, Approva

Is GRC a market category, or a set of features & functions within other existing market categories? That’s a debate for Industry analysts, which is what they do best. Frankly, I’m not sure Global 2000 companies are that worried about it. I think what they are concerned about is how to better manage the internal controls that help keep their businesses from veering off the highway and into a ditch of waste, fraud or corporate malfeasance.

Today, so many products get lumped into the category of GRC that it makes it hard for the casual observer to understand the differences.

Historically, I lump products into 2 simple categories:
1) Products that document and report on controls within a business and
2) Products that test & analyze controls.

Maybe an analogy will help; think of a student taking a class. All the materials the teacher uses to teach, from lecture notes and handouts to labs –even the student’s final report card — are the documentation products. Everything associated with the quizzes and exams the student takes, on the other hand, are the testing products.

The testing products determine what information a student should know about the class and measures how well they actually performed in meeting those objectives. Where this all gets more complicated are students or corporations take more than one class.

In today’s market, most “GRC” products support one student – one class, and the teachers have little input to the tests the student take to measure the effectiveness of the class and the teacher. In other words, the documentation products and the testing products are largely independent of each other and they tend to focus in subsets of business functions, control areas, and compliance programs.

You can probably guess how we need the “GRC” products to evolve. First, the two primary categories of products need to become more closely aligned and integrated. The tests need to reflect the documentation and vice versa. Secondly, we need an enterprise view; a corporation is not one student taking one class. The GRC products need to support controls across all business functions within the entire corporation including financial controls, operational controls and IT controls. Third, the GRC products need to support all compliance programs and transform the results into actionable business information that will support a diverse audience of executives, business process owners and auditors.

At Approva, one of our interests is in how to take testing to the next level. This means testing more controls, streamlining the processes for resolving and mitigating control weaknesses and using the results of the tests to drive business efficiencies and effectiveness.

Measuring against a control objective or standard is a problem that has been solved. The future lies in using information from controls testing to drive business improvement. How? Why not use the results from the tests to change the way the business operates so these problems can be prevented? Why not use the results to make predictions about potential future control breakdowns? Why not use the results to give business leaders better visibility into the areas of their business that needs attention? Better visibility makes for better decisions. Better decisions make for better run businesses. Now that’s a class that’s easy to understand but hard to get an A in.

Tags: GRC, governance, risk & compliance, controls intelligence

This is the most important aspect of board governance. The oversight function is the absolute minimum that investors and owners have a right to expect from boards. Some boards are too focused on simply providing the minimum.

Board members should, individually and collectively, have experience of business and community life that will enable them to add value to the organisation as well as to effectively monitor its operations. They add this value by the insights they bring.

Oversight is looking at a function and asking the compliance related questions:
• Should we be doing this?
• Are we doing this correctly?
• Are the right people doing this and do they have the right tools and training?

Insight comes when the board start ask questions about performance such as:
• Are these activities the best activities for generating the results we want?
• If they are the best activities, could we do them more effectively or efficiently?
• What would help our people to be more effective?
• Who does these activities better than we do and what could we learn from them?

An insightful board will challenge and support the President or CEO by helping to keep the organisation focused on outcomes rather than processes.

Foresight comes when the board can predict aspects of future performance by monitoring current KPIs. A board with foresight is able to look at the evolving corporate landscape and ask questions such as:
• What activities will be required in the future?
• What must we learn now to be more effective in the future?
• How will we track that our people are learning the required skills?
• When should we start to deploy new activities?

It is important to remember that the oversight role is the foundation for the insight role. No board can sensibly offer advice on improving performance if there is any doubt about the veracity of the information they are basing their insights upon. Similarly the board must have appropriate good quality data from their performance insight to be able to make any use of their instincts regarding foresight. Attempting to move to a higher level without the data from the lower levels is dangerous; it can leave a board exposed to making decisions that do not stand the test of later analysis.

Attempting to govern a successful company without progressing from oversight to foresight is also dangerous. The board can become trapped in old paradigm thinking and performance can deteriorate to a point where future options are limited by lack of resources. Boards must have confidence in their data to be able to move successfully through from oversight to insight and then to foresight so that their organisation moves from compliance to performance to sustained competitive advantage.

Tags: corporate boards, risk management, compliance

Have you recently read any articles about what your board should be focused on? Was it bird-flu, Internet portals, Terrorism or some other fad?

I wish I had a dollar for every article on the latest buzz-word that every board should worry about. Or fifty cents for every list of twenty questions board members should ask about the craze. I would hate to be on a board that was so easily sidetracked from their real concern; running the company so that it achieves what it was set up to achieve.

In some great research from Australia, Neil Buck surveyed real company directors on what risks they thought most likely to impact their companies. His initiative revealed 16 categories of risk which, when read by company directors, were recognised as things they worry about.

I have followed up on that research and interviewed 241 company directors on the big risks facing their company. Unsurprisingly the number one risk was financial but (sad news for the audit community) it was not financial statement misstatement or fraud, but simple cash flow risk that kept directors awake at night. Fixing this is a question of strengthening the business. Improving reporting or ticking boxes in the board room won’t help.

Directors the world over are focused (as they should be) on running businesses to generate wealth (or benefits in a not-for-profit context) in an environmentally and socially acceptable manner. If bird flu is important for the business they will focus on that. If not, they should focus on what is important for their business.

Directors can rely on their own judgement to help them to evaluate such things. They may get it wrong occasionally (all boards, when they are being honest, have a decision they regret in their history) but it rarely is so wrong that they can’t fix it. Unless, of course, they are rushing from one fad to the next without pause for thought.

Anyone who suggests that every possible risk should be a board focus is either totally inexperienced in the board room or hoping to sell your board something. For optimum results, focus your board on what is important for your organisation by holding an annual discussion of strategic aims and current targets. Forget the current fashion and just talk about what the organisation needs to achieve and what are the risks that threaten that achievement.

You will be amazed by the power that the board can generate and the value that they can add.

Tags: corporate boards, risk management

Julie Garland McLellan is a professional company director and corporate governance consultant. Her book “All Above Board” is a practical manual for government sector boards. Julie delivers practical boardroom training and performance assessments that empower boards to achieve results. Readers are invited to subscribe to her newsletter ‘The Director’s Dilemma” free of charge until 1 January 2009.

Governance relies on culture, and establishing an appropriate culture is one of the most important jobs for a board. Checking that the culture the board wanted is the culture they actually have is also important.

The board will get some idea of the culture within the organisation by observing the behaviours of the CEO and senior executives. Behaviours that are rewarded and recognised will be emulated and repeated and will eventually coalesce into ‘the way things get done round here’ or the basic culture of the organisation. Different departments will have slight variations on the basic culture but these must never stray so far from the norm that they become alien to the rest of the organisation.

A good indicator for boards is the relationship between the support and control functions and the line management within the core operations. If risk management, internal audit and human resources are generally welcomed as ‘people who help us get our jobs done’ then the culture is likely to be reasonably compliance focused. If there are strong tensions or a dramatic divide between “us” and “them” then the culture is probably not right. The board can find this out by seeking opportunities to meet staff from the support functions and asking these staff how they feel they are viewed by their colleagues in the line functions. This can happen in the boardroom.

First hand experience is better than any indicator. Boards should get out and about within the organisation as much as they can. Talking to staff about the control system and why it is important will reinforce the value of compliant behaviour and demonstrate that the board is genuinely interested in compliance.

There is a good reason that sayings such as “whatever interests my boss fascinates me” and “what gets measured gets done”; they are true! Boards need to show they are interested and measure compliant behaviour so that the staff are aware that their compliance is monitored.

Boards also need to pay attention to the mythology within the organisation. What are the things that make an employee a hero or heroine in the eyes of their colleagues? If gung ho risk taking and non-compliant behaviour are stuff that heroic reputations are built upon the board is not going to get much compliance from the best and brightest members of staff. Boards should be careful that they reward compliance as well as performance. Whilst many boards are wary of introducing complex reward systems if a company has a good controls system and monitors compliance it will be easy to pick an objective quantifiable indicator of good compliance and to build that in to the reward system.

Rewarding a manager, for example, on the reduction in non compliances by his or her direct reports will soon have managers focused on reinforcing the control system or changing it when it needs to be changed to support a better performance outcome. When the control system is viewed as something that prevents performance good managers will naturally try to find a way to operate outside the fetters the system imposes. When the system is designed to support performance and when rewards are attached to supporting and working within the system then the board can rest assured that the culture will have an adequate focus on compliance.

Julie Garland McLellan has over 20 years experience in strategic business development in resources, utilities and energy industries. She is currently a corporate governance consultant with Blackrock ITS, a leading Australian IT services and solutions firm. Previously, she served as associate director with McLennan Magasanik Associates, and a board member of the Victorian Minerals and Energy Council, the Victorian Energy Networks Corporation (VENCorp), the Melbourne University Engineering Foundation and City West Water. Julie has an honours degree in civil engineering from City University in London, an MBA from the leading Spanish Business School (Instituto de Empresa in Madrid) and is qualified in finance and corporate governance.

Tags: corporate governance, compliance

I so often hear (from auditors) that boards don’t listen to their auditors or (from boards) that auditors don’t talk in a way boards can understand or use. It really is sad that such an important conversation so frequently leaves both participants unsatisfied.

The best way to get the conversation started, in my experience, is for the parties to come together to discuss what are the key strategic risks and then what are the likely best key performance indicators (KPIs) to monitor these risks. As a general rule directors are more interested in the strategic information that will affect future performance than in the financial information that depicts past performance. Unfortunately most of the information directors get given by auditors or risk managers seems to be past oriented and financial rather than future oriented and focussed on the activities that will cause the financial performance.

Starting the conversation as an inquiry with both sides suggesting things topics for investigation and KPIs that would provide a meaningful indication of likely future performance is far better than starting the conversation with one party reporting to the other.

It is healthy for the audit committee or board to meet with the auditors and internal auditors without management being present. This does not mean that the board distrust management just that the conversation is different when management is not present. Simple measures such as inviting the internal auditor to accompany the board when they make a visit to an operating site will help to build shared understanding and common values. It is imperative the board meet the internal auditor more than once a year and that each meeting is constructed to achieve specific outcomes rather than just to wade through specific reports.

Tags: auditors, corporate boards, KPIs

Julie Garland McLellan has over 20 years experience in strategic business development in resources, utilities and energy industries. She is currently a corporate governance consultant with Blackrock ITS, a leading Australian IT services and solutions firm. Previously, she served as associate director with McLennan Magasanik Associates, and a board member of the Victorian Minerals and Energy Council, the Victorian Energy Networks Corporation (VENCorp), the Melbourne University Engineering Foundation and City West Water. Julie has an honours degree in civil engineering from City University in London, an MBA from the leading Spanish Business School (Instituto de Empresa in Madrid) and is qualified in finance and corporate governance.