Norman Marks on Governance, Risk Management, and Internal Audit

Both internal audit and risk functions have to be cognizant of one significant fact when it comes to providing their periodic reports to the board (or to an audit or risk committee of the board).

Members of the board are being overwhelmed by a ton of information prior to and then at each board or committee meeting.

Consider this piece from Board Intelligence, Directors say board packs are worsening. Here’s why and how to fix it.

Their key findings (I have changed the order) include:

• The average board pack is now 213-pages-long (up 22% in three years).
• Only 28% of directors and governance professionals get value from board papers.
• 66% must dig to find the key messages within their reports.

When you add the fact (and I have seen this many times) that board members are sent the 213 pages (on average) only a few days (sometimes less) before the meeting, you can see that there’s a crisis: the board is not getting the information they need, when they need it, in a readily consumable and actionable form.

This obviously has serious ramifications for the effectiveness of the board, and possibly the organization as a whole.

Add some additional facts from the report to the toxic mess:

• …nearly a third find their papers to be a hindrance (30%). In other words: for the first time since the launch of these tools, more board members and governance professionals get negative value from their board papers than positive value.
• Overall, 80% of board members and governance professionals now score their board packs as “Weak” or “Poor” (up 10% since 2019).

How can the board, or either the audit or risk committee, be effective under these circumstances?

Too often, board time is taken up by reading management reports rather than discussing what they mean.

So what does this mean for practitioners?

1. We need to limit what we provide in the way of reports to what board members need to know, rather than trying to show how much we have accomplished. It’s not about us, it’s about their effectiveness as a governance body.
2. Send our reports early, so they have time to consider them. While management may ask that we include our reports in their board package, we should not wait if it appears likely their reporting will be late in arriving. It’s also to our advantage as board members are more likely to pay attention to our short reports when they are delivered separately and ahead of the rest of the herd.
3. Consider our responsibility to the board and the fact that excessive and delayed board books are a risk to effective governance. Work with the board and top management to set the clear expectation that board books are:
   1. Concise
   2. Strategic
   3. Timely
   4. Easy to absorb
   5. Actionable

One of the audits I have often included in my audit plan is of the controls over the production of the board book, ensuring that the information it includes is reliable as well as timely. Too often, it is aspirational and optimistic rather than supported by facts.

What is your experience?

What is your opinion?

What do you think?

#risk #audit #GRC #IIA #governance #ERM