The Board’s Role in Resilience: A Limited One

Yesterday I had the privilege to participate in a corporate governance forum in New York, talking about the board of directors’ role in building corporate resilience. Resiliency is a popular buzzword in governance circles these days, so I want to recap some of the main points here—because while I agree that the modern company absolutely must improve its ability to withstand sudden shocks, best practices for the board (and there is no shortage of best practices for boards) can sometimes ignore the reality of how resilience happens.

For a while our group—who were generally senior-level governance officers at large businesses; or governance consultants at well known and respected firms; or sitting directors at large organizations—talked about the “mechanics” of corporate resiliency. That might be anything from spreading key employees among multiple locations, or establishing backup IT systems in separate facilities, or ensuring proper records retention programs. (I was mildly surprised to hear from one executive at a large insurance business, who said that his firm does specifically consider concentration of key employees these days when setting premiums for business continuity policies it sells to Corporate America.)

Is the board’s job to put all these elements in place? Not at all. The board’s job is to choose a CEO who ensures all those elements are in place, and to quiz that CEO in board meetings about how well he or she is meeting those goals. The board’s job is to ask about the risks the business faces, including unexpected disruption, and tell the CEO how much he or she should worry about resilience.

In brief, the board’s job for resilience is to ensure that the company is acquiring all the tools it needs to survive. The board itself doesn’t build those tools; it ensures that employees (above all, the CEO) do the necessary building. That’s not a complex governance concept to grasp or to put in motion, really.

Then something happens: a cyber-attack, or the sudden death of a CEO, or the collapse of corporate headquarters, or a gigantic product failure. As one roundtable participant phrased it, “something happens that puts a spear through the heart of your company.”

And all those mechanics the board worries about are useful, yes—but a company needs something very different to be resilient.

That insight came to me as I listened to another roundtable participant tell how he helped his firm recover from the Sept. 11 attacks on the World Trade Center. We had gathered under the principle of Chatham House Rules, so I cannot name him nor his firm. Suffice to say that his firm endured a disaster. A large number of employees died in the attacks. Its offices were physically destroyed. Records, IT systems, institutional knowhow; a huge portion of it all was tragically lost in less than two hours.

As this person talked about how his firm gathered its surviving employees and clawed its way back to survival, I noticed—he didn’t really mention backup IT facilities, or records retention policies, or CEO succession plans. He talked about senior executives telling job applicants that the firm was still worth considering; that it planned to rebuild and continue. He talked about the CEO meeting with the families of employees who died. The closest he came to any technical issue were thoughts about the firm’s compensation policy to make sure employees stuck with the business.

Quite simply, this participant’s story about resilience in practice was all about leadership, culture, tone at the top, and keeping people together.

Now, I have no doubt that resilience in the moment—when your data is in shreds, or your physical office is in ruins, or your reputation is skewered in the press, or your employees are in the morgue—is far easier to accomplish when your board does its job to ensure the apparatus of resilience is properly prepared. Taking those steps is important corporate governance. But the board’s planning to survive a shock is very different from actually surviving a shock.

In fact, I can’t help but recall George Washington, who had to be more resilient than just about any CEO today. Washington’s paramount strategy during the Revolution was to keep the Continental Army together, because without that, his decisions about specific battles were pointless; he had no soldiers to fight the battles. When he became president, his strategy was to keep the states together, because without that, decisions about trade policy or Indian relations were pointless; he had no country to implement his policies.

Keeping the team together—that is resilience in action. How can a board nurture the right leaders for that test? That’s the question directors need to be sure they can answer.