The National Association of Corporate Directors (NACD) is considered by many to be the preeminent association supporting boards and directors “to stay on the leading edge of corporate governance.” NACD periodically creates Blue Ribbon Commissions, groups of experts that research and create recommendations to boards on best practices to stay relevant and “future ready.” Topics in the past have included risk governance and corporate culture. This year’s Blue Ribbon Commission is particularly relevant to the times we live in and of considerable interest to those of us who work in technology in a world where, up to a few years ago, the overall direction, strategy, and vision driving economic success was often more focused on the short term and did not include much about the technology operating the company or the potential impact of evolving or emerging technologies. Outside of significant cyber events, in the past those discussions had been delegated to the audit committee to ensure compliance with Sarbanes-Oxley and similar regulatory requirements. The 2024 NACD Blue Ribbon Commission Report, “Technology Leadership in the Boardroom: Driving Trust and Value,” was released in early October 2024. This report from the NACD examines the impact of technology and data on corporate governance. It argues that boards need to strengthen their oversight, deepen their understanding, and develop foresight regarding technology in order to remain competitive and create long-term value. The report includes ten recommendations for boards and management teams, organized around the imperatives of strengthening oversight, deepening insight, and developing foresight. It provides practical guidance on how to implement these recommendations, including tools and checklists. That last paragraph was AI-generated. Or was it? What is the impact of not knowing? Not caring? Would that answer change if you were fiscally and ethically responsible for a company’s success and reputation in an era where AI dominates the headlines? How does a board ensure that the duty of care exercised as a normal obligation of board service stays current in the face of the tumultuous rate of change and reliance on technology, a rate of change that far outpaces consistent definition of regulatory protections? This Blue Ribbon Commission report includes a call to action for boards to ensure that their practices and partnership with the C-suite and auditors form a foundation that strengthens oversight, deepens insight, and develops foresight of enterprise technology. Without adequate oversight, it’s impossible to get reliable insight. Without reliable insight, foresight of enterprise technology will be wrong, incomplete, a bad bet, a waste of money, or non-existent. This is not a good look for any enterprise and for a public company, profit, share price, and reputation are at stake. And the reality of cyber safety is even worse than the board and the C-suite believe. But far from the doom-and-gloom message just portrayed, this report should bring us hope by making the need transparent to those who oversee and those responsible for company success. The report gives a well-written rationale and game plan to get the improvement started. What do we mean by enterprise technology? It’s not just internal information technology; it includes any operational technology used to provide goods and services or within those goods and services. And for companies in the engineering and technology industry, enterprise technology is reflected in the products and services offered to customers. Consider the optics behind “do as I say, not as I do” as opposed to the visible benefit of “walking the talk.” The first group of recommendations provided by the report is designed to help a board strengthen oversight of the organization’s use of technology and data. Governance and control of assets is a standard practice for CIOs, whether the assets are standards and policies, hardware, software, data, staff, or time. Enterprise technology doesn’t stand still — there are always projects and services afoot to update, upgrade, replace, fix, protect, and so on. Projects have approved requirements, costs, and schedules that are monitored, and services typically have service-level objectives/agreements. “Unmanaged change is chaos” is a common belief among those responsible for enterprise technology. The knowledge of and active involvement in technology oversight practices is not yet customary within the C-suite, let alone at the board level. While the level of detail will be nowhere close to what CIOs and CDOs deal with on a day-to-day basis, the board must recognize the governance structures in use by the organization and define their own involvement in the decision-making process. It’s a fine line between “oversight” and “overstep,” and this may challenge the beliefs of board members of significant seniority, but the duty to protect all stakeholders demands it. The board needs to be convinced that this is a crucial part of the duty of care and have significant interactions with the management team to know what the enterprise has as far as the current state of policies, people, processes, and technology and how they are connected and protected along with the data consumed, integrated, or produced. The role of organizational culture cannot be ignored, nor can the state of the business processes. Both play a role in increasing technical debt, especially when they work in concert; “that’s the way we’ve always done it” can lead to customizations in off-the-shelf software or a part of the organization going rogue and bringing in their own implementations invisible to enterprise governance. As a part of reviewing the board’s practices for decision-making, the report suggests that boards request that “management explicitly state what technologies are used to create value, why they are used, what risks exist, and if they themselves understand the technology and why it was adopted.” That statement may rob many traditional management teams of a good night’s sleep. If they read it. Wherever the management team is in their ability to answer those questions is the starting point to assist the board in deepening their insight, the second category of recommendations. Board members need to come to terms with the fact that innovations are outpacing their experience on an individual basis and understand
