Dear reader,

Welcome to The Director's Dilemma April 2022

Each month this newsletter looks at a real-life scenario that happened to a board, perhaps to a board like yours, and considers a range of responses. The scenarios are de-identified to protect the individuals concerned. This month we look at how a board of 'non digital-natives' can bring a strategic approach to governing their organisation's information and data.

Of course, these scenarios are general, I work with boards and directors as a confidential mentor to help them build great companies and maximise their impact. If you would like personalised service, please call me.

To read this email in a web browser, go to www.mclellan.com.au/newsletter.html and click on 'read the latest issue'.  I hope you will enjoy the latest dilemma:

Qi'Ra was appointed a couple of years ago to a government sector board that oversees a wide range of community initiatives. Her background is in social service delivery. Other directors have backgrounds in health, accounting, education and commerce. However, they are all 'mature' and none of them has grown up as a digital native.

The company has moved a lot of service delivery and engagement online. This has included development of products that can be delivered online, records about people (including sensitive financial, educational, medical and physical information), payment gateways and links to other government and community websites.

The board is aware that they have a duty to ensure the appropriate development and security of the company's digital assets. They have undertaken some training on the new cyber-security regulations. However, they are not sure that they are up to the task of building a strategic framework for the development of digital assets in a balanced structure. What they have is really a result of ad hoc development. What they want is a way to make sense of that and then to develop a plan for continuing to build in a strategic fashion.

How can Qi'Ra's board lead when they have never themselves ventured into this territory?

The problem Qi'Ra faces is a fundamental one, which very often occurs when business requirements grow faster than the necessary operational and technological framework conditions. The migration from previous "analog discrete" processes to digital and sometimes disruptive processes, can often be implemented with simple means, so that quick successes become visible.

However, the perception that a quickly built website with corresponding order and customer management works, tempts one to think that one can move on to the next problem before a real blueprint has been created for a solid technological basis that meets both the future functional scope and the necessary technological security, especially against the background of processing personal data. Unfortunately, such systems grow faster than the "hardening" of the underlying infrastructure. The result is the well-known data breaches and successful cyber-attacks.

Since QiRa and her colleagues see the need for data security measures but cannot describe, evaluate and implement them themselves in any way, it is high time for a "make or buy" decision. Either setting up their own data & security organization or outsourcing to a suitably competent service provider who can take on these tasks comprehensively.

In view of the European General Data Protection Regulation (GDPR), the Board bears the ultimate responsibility for taking all practicable measures to protect personal data.

In the current case, I would recommend the involvement of an external service provider, because setting up one's own organization takes too long to be able to solve the current challenges in the short term and to avoid potential damage to the company through data loss and negative press.

Hansjörg Meine is Managing Partner at AltoPartners Germany - Alto Consultants GmbH. Hansjörg is an executive member of various leadership teams at IBM, T-Systems and SPIRIT/21 and has lead a pan-European team of experts for the automotive industry with deep expertise in the areas of PLM, Logistics, Mobility Services, Sales & Aftersales, Telematics and Diagnostics

Qi'Ra's board is not alone in facing this challenge; it is good that they are honest in admitting that they are challenged by it.

An excellent start is looking at their stakeholders and asking management to draw up a spreadsheet of their various needs. Work out who needs what from the company.

Then they need to consider each stakeholder group separately and ask, 'how will they benefit from moving to digital service provision?'. This should be followed by a process of investigation (sanity checking) to make sure that her board's ideas, and those of the management team, are shared by the stakeholders.

This process should also uncover the willingness and ability of stakeholders to make the move online. What are the impediments to digital service delivery? How can they be overcome? If management don't have the skill or time to do this work, a consultant can be brought in to help.

Only now can the board, management, and any consultants, sit down and work out what services to provide digitally, how these services combine or compete with physical delivery, and write the strategy.

Once strategy is in place the board should oversee implementation and ensure budgets and timelines are kept. They also need to ensure that stakeholders get the benefits envisaged.

Finally, the board needs to step back and consider what digital information they now hold, what hardware is it located on and what risks need to be managed, what software is it written in and how will they keep it up to date, and who has access and how will they ensure that only authorised access is obtained.

Good luck Qi'Ra and enjoy the learning process.

Julie Garland McLellan is an experienced non-executive director and board advisor based in Sydney, Australia.

"Ad hoc development". For management and the Board, this should be a scary term.

Scary, because development occurs:

• without context (it is a good idea!)
• in response to a squeaky wheel
• by an individual driving a particular solution

This usually results in misspent and misallocated resources.

However, the dilemma here is not about IT but on what basis decisions are made, and how an organisational direction is formulated and maintained, in a dynamic technological environment.

While a Board does not need to be an expert in IT, it does need to be aware of the opportunities and challenges associated and changes occurring over time. The Board (and maybe management, in this case) is inferred to be behind the times and needs to be more in touch with current developments. One way, of course, is to add more diversity to the Board in terms of age and skill sets (or have an external advisory).

Another way which I have used several times, is for the Board and management to jointly develop a vision of the organisation for a point in the future that ensures thinking is different to just an extension of what is currently in play. Such an exercise, involving both internal and external resources, can establish a prioritized context in which a future plan can be developed and executed. This also has the effect of educating the Board members and management as well as promoting collaboration and understanding between the two groups. Such an exercise is often a cathartic event for all involved!

The context so developed contains an agreed view on such matters as Board values on Government direction and policies, customer service values and priorities, program priorities, activities to stop doing, stance on security and privacy etc. It provides the background to the development of strategic and tactical programs.

Greg Porter is a company director and founder with background in information technology and its governance. He is based in Sydney, New South Wales, Australia.

Julie’s News

March is always a mad month and I have been haring around enjoying the AICD Governance Summit and other face to face activities as well as delivering a large (for me) number of education programs for boards and directors. I also enjoyed being interviewed about women on boards for the ABC radio on the International Women's Day. Listen to the interview.

Do you like video?

Readers who follow me on LinkedIn may have noticed that I have been posting short video insights. You might like to visit and subscribe to my YouTube channel to see a link to the channel whenever you visit YouTube.

The videos are in three lists:

• 'Quick Insights' up to three minutes long
• 'Board Thoughts' three to ten minute informal comments giving my take on current board issues
• 'Presentations and Classes' up to an hour long

Choose how much time you want to invest. Let me know of any topics you would like to see addressed.

Book Review - Corporate Governance Matters by David Larker and Brian Tayan

Do you ever wish you could get hard data on the impact of governance practices on corporate performance? Would it help you to know how other companies have fared after implementing changes to their board structure, processes, operations, and functional responsibilities?

This book is what happens when two Stanford faculty members decide to analyse the results of different governance choices. Using hard data.

Obviously, I liked this book from the moment I read the title. Then I discovered that it is mostly empirical studies rather than ideological exhortations. Then I loved it.

It is possibly a little Delphic on how to implement the practices that correlate with value creation or how to avoid being pressured or shamed into those that don't. Overall, however, it is a very valuable addition to the arsenal.

Available at Amazon.com

Inspirational quote for April

This month my favourite quote is:

 

It doesn't matter how good the model is, it will never be perfect for your company unless you tailor it to fit precisely to your stakeholders' needs. I have always been a picky audit committee member, reading every note and asking if the people who read the accounts will understand the way it is expressed or even be interested. So, I was delighted to hear this piece of wisdom in a recent audit webinar: Streamline, declutter, add in anything that will be relevant to our readers, and - above all else - write in words that everyone can understand. Don't just follow the model. Make it fit for purpose.

Do you know where to focus your director and board development?

Boards often struggle to get cut through and drive company performance. They work hard, then they work harder, then call in a consultant who recommends some changes, then they work harder still.

If that sounds like your board, don't worry. It is likely that you have simply been focusing on the wrong stuff. I have made a diagnostic tool that might help you to prioritise the actions that will free your board from the drudgery and allow you to maximise your impact. You can take the diagnostic here:
https://directorsdilemma.scoreapp.com

Call me afterwards for a personalised action plan to revitalise and enhance the impact of your board work.

A note on names - A few readers have asked me where I find the names for the protagonists in each case study; I 'borrow' them from people I meet or things that I read. Star Wars fans will recognise this one. Qi'Ra joined an organisation and quickly became its leader. If you are on a board, you need to be a leader too. Don't only go where you have already been. That is red ocean strategy. Boldly go where no board has gone before. But do it carefully and make a map so you can retrace your steps if you need to.

This newsletter - If you have any ideas for improving the newsletter please let me know. If you are reading a forwarded copy, please visit my website and sign up for your own subscription.

Suggestions for dilemmas - Thank you to all the readers who have suggested dilemmas. They are greatly appreciated. I will answer them all eventually. I could not write this newsletter without your help and without the generous help of all the experts who respond each month to the case studies.

Be a contributor - if you would like to attempt a response to the dilemmas for publication you will be most welcome. Simply reply to this email and let me know. I am always on the look out for new talent from around the world so please reach out if that sounds like something you could do. I am also always grateful for the generous sharing of the current and past contributors. I couldn’t create such an engaging newsletter without their help.

Let's connect - I use LinkedIn to share information about boards and directorship with my friends and acquaintances. If you use LinkedIn and we are not yet connected I will welcome a connection from you. You can find me at linkedin.com/in/juliegarlandmclellan.

Let me help you - I would be delighted to speak for or train your board, staff, audience and/or group. If I can help, please contact me at julie@mclellan.com.au.

Farewell until the next issue due 1 May 2022. I look forward to greeting you again then.

Enjoy governing your companies!

Best regards,
Julie

Main Photo by Mikael Blomkvist from Pexels
Quote Illustration by Julie Garland McLellan

Disclaimer: The opinions expressed above are general in nature and are designed to help you to develop your judgement as a director. They are not a definitive legal ruling and do not constitute legal advice. Names and some circumstances in the case study have been changed to ensure anonymity. Contributors to this newsletter comment in the context of their own jurisdiction; readers should check their local laws and regulations as they may be very different.

Privacy: I am privileged to have your contact details and keep them as safely as possible. I will alert you if they are ever accessed by any unauthorised person (the technical staff at ayuda help with publishing and issuing the Director's Dilemma and have access so they can send the newsletters to you). I do not sell your details to anyone; they are kept only for the intended purpose - sending you this newsletter and helping to build the judgement of company directors by providing a safe way to consider potential responses to real life events.