Technology Risk Cloud Credit: Lightspring/Shutterstock.com
|

Companies today face significant and disruptive challenges, from increased disclosures and obligations in multiple jurisdictions to the ongoing COVID-19 pandemic and its unanticipated effects on business globally. To effectively and transparently manage an organization and ensure it is meeting these challenges, boards need an effective and adaptive corporate governance program. Corporate governance can be enhanced and improved by the explicit integration of a well-conceived information governance program—an efficient and cogent framework for enterprise information management—that will help companies lower risk and enhance their value propositions.

As boards and companies refocus on sustainability, they should look closer at the key areas that would benefit from a strong IG framework, including cybersecurity, regulatory changes, economic uncertainty, business continuity, and enhanced financial reporting. Boards need accurate and timely access to information to meet their responsibilities. As the NACD pointed out in a recent report, information mismatch often occurs between management and boards by not having equal access to internal and external information. With "enhance[d] operating processes," boards can develop "better situational awareness" with respect to risks. A strong IG framework can provide these processes, and ensure that boards and management have access to the same accurate, reliable, and timely information. It will also provide replicable processes upon which managers and boards can rely, supporting audit responsibilities, improving information access, and becoming more resilient and responsive.

Key to regulators, investors, and the markets' understanding of what a company does and how it operates are company reports and disclosures. While required or permitted disclosures vary, the common element is that they must be timely, accurate, and responsive. The UK Corporate Governance Code (Provision1) explains that the board must assess and describe in the annual report the "opportunities and risks to the future success of the business," the "sustainability of the company's business model," and specifically "how its governance contributes to the delivery of [the company's] strategy."

Annual reports are often the main source of information for shareholders and other stakeholders and the veracity and completeness of what is disclosed therein matters. Recognizing this, the ASEAN Corporate Governance Scorecard has over ten specific questions concerning the quality of companies' annual reports. Given these goals and requirements, an IG program can provide management appropriate access to information to be disclosed and increased confidence in the procedures that the company has in place to manage this information. For example, a requirement to annually review risk should include the explanation of how the board conducted its risk review, what material insights were gained from that review, and what steps the board is taking as a result of that review. An IG framework reduces the substantial information-related risk aspect of these disclosures and provides an efficient, repeatable, auditable process that can promote market confidence. We believe that exchanges, regulators, and advisory bodies should recommend a comprehensive, appropriate IG framework that will improve corporate reports and disclosures.

Countries and exchanges may differ on the mechanics of risk recognition and mitigation, but all agree that risk identification, assessment, control, and management are critical to a company's success. The positive effect of a thoughtful IG program on an organization's ability to plan for and respond to risk is evidenced by having good, clean, available and timely data upon which to base decisions during turbulent times. It is accepted that boards and management should pay close attention to risks which could have a significant, severe, and often sudden effect on a company's revenue, operations, profitability, competitive position, and reputation. See, e.g., Report of the NACD Blue Ribbon Commission On Adaptive Governance: Board Oversight of Disruptive Risks (2018).

Disruptive risks include near-term political challenges; significant market deterioration/industry disruption; natural disasters/man-made emergencies; and strategic/business model failure. Without access to fulsome internal and external information, boards will not be able to plan for or react positively to disruptive and other risks, and shareholders and investors who need to understand what boards and companies are considering will be underserved. As SEC Chairman Jay Clayton recently noted, how companies "plan for uncertainty and how they choose to respond to events as they unfold can nevertheless be material to an investment decision." Chairman Clayton was speaking of the coronavirus, but the concept remains true for all risks. Employing an IG framework over an internal control system to plan for risk mitigation will help a company weather anticipated and unanticipated storms.

Similarly, management assessments of business resilience—including supply chain, insurance and legal, technology and information security, customers and branding, talent and workforce—are enhanced by a strong internal IG strategy. IG enables timely, accurate information for management to plan for and react efficiently to business threats.

Among the internal control systems that boards and management should include are regular assessments of how the company manages its information resources and the processes governed by the company's IG framework. These will include reliably maintaining company-wide information systems and structures, documenting and conforming key data processes, and developing and evolving a master data management program. The IG framework straddles all areas of a modern business's operations and allows boards and management to reliably assess the adequacy of other internal control systems. Similarly, the repeatability of processes and auditability within the IG framework can help management and the board strengthen other internal controls.

A well-implemented IG program can also enable effective shareholder and stakeholder engagement. Shareholder engagement should be built on a relationship of trust and include outreach on topics including executive compensation, strategy, diversity and inclusion, risk management, and corporate governance. These discussions can ensure that the board, management, and stakeholders are on the same page with respect to company strategy, long-term value, and effective stewardship, and are particularly important when "activist" investors looking for short term gains and control are involved.

A proper IG framework will ensure that detailed operational information can be reliably summarized and presented for board and shareholder consumption without extensive interpretation and adjustment. It can also help streamline shareholder and stakeholder communications. Corporate governance guidelines generally recognize that timely, accurate information can nurture this trust relationship. Shareholder communications will improve with the application of the complementary IG principles – veracity and availability of information; dependable and repeatable reporting of information – and promote meaningful participation between a company and its stakeholders.

Companies can realize the benefits of a thoughtful IG framework now even before regulators explicitly require IG discipline. Recognizing that corporate governance is not a mandated "check-the-box" system, best practices can be adopted before they are required as an example of strong, competent leadership. Leadership is uniformly recognised as fundamental in effective corporate governance and risk management. As Peter Seah, the chairman of DBS Bank (Singapore), recently wrote, a "corporate governance framework [is] anchored on competent leadership, effective internal controls, a strong risk culture, and accountability to stakeholders."

The benefits of acting now to integrate IG into your company's corporate governance schema are profound. As laid out above, IG integration will benefit your company's risk identification and management, reducing the impact and costs associated with crises and unplanned events. IG can also add value to areas other than risk mitigation.

In M&A activity, due diligence review is more efficient when information is verifiable and available, the hallmark of a proper IG program. With consistent, auditable processes, the review cycle can be streamlined and its duration reduced, accelerating closing. Additionally, in recent years information assets (infonomics) have gained traction as an integral part of M&A due diligence and valuation. Properly valuing information assets can be achieved through a sound, evolving IG strategy and well-documented, auditable, and repeatable business processes around information management. This also allows a company to leverage business information that was previously not available.

Similarly, in financing/capital markets activity, good corporate governance can help a company attract outside investors and capital and reduce the costs of raising capital for the company in debt and equity financing. The due diligence processes conducted for these functions are heavily dependent on the company being able to accurately report on its business functions and the flow of information underlying these functions. A well-defined IG program can facilitate this process and inject a greater degree of transparency when seeking capital.

Even though forecasts for corporate governance trends in 2020 identified business resilience and disruption preparation as priorities, few imagined the pervasive and significant disruptions caused by the COVID-19 pandemic globally and locally. Undoubtedly many corporations and organizations have already recast their strategic plans and operational schema to incorporate this new economic reality, and where companies are able to employ their enterprise data with confidence, they are better positioned to evolve. Those organizations with robust IG programs are ahead of the curve, but there are opportunities for others as well. Implementing an IG program can yield immediate and longer term benefits.

In conclusion, effective corporate governance benefits from strong information governance. The type of transparency, measurability, and repeatability that comes from a robust IG framework enhances shareholder and stakeholder engagement, appropriate and fulsome disclosures, business resiliency, and risk identification. Companies and boards should integrate IG into their corporate governance systems. The upsides include mitigating risk, improving management of data and information, unlocking and leveraging information assets for business growth, and enhancing the ability to demonstrate good corporate citizenship.

Kristie Blase is a Principal at 64.9 Consulting, LLC, 64point9.com, a business and governance consulting practice, and a partner at CKR Law LLP, focusing on risk, management, litigation, and internal controls. 

Bryn Bowen is the Principal Consultant at Greenheart Consulting Partners, greenheartllc.com, a Governance Risk & Compliance information consulting practice and a Board Director of MCCG Guyana mccggy.com a management consulting company based in Guyana. Bryn is a Fellow of the College of Law Practice Management and a founding member of the Law Firm Information Governance Symposium.