Since there is not an organisation, in either the public or private sector, whose existence and success does not depend on information technology, it is reasonable for investors and regulators alike to expect that all boards would make it a priority to include a technology-savvy director.

Pervasively, that is often not the case despite history’s lessons.

With Y2K came the first realisation that boards were generally unprepared to anticipate, plan for and avert systemic IT infrastructure risk. I saw that first-hand when I served as special counsel to the Ontario Securities Commission on the legal implications of Y2K for the companies that the OSC regulated.

Soon after Y2K, as legal and audit professionals were still formulating their Y2K “lessons learnt” guidance, the “year of the accounting scandals” (2002) arrived. The broad and instructive inquiries into those scandals threw a very bright light on the inseparable relationship between sound financial management, data integrity and IT governance.

In the years that followed, a great deal of debate ensued about the need for IT business experience to be represented on boards.

From the Ivy Business Journal article (September-October 2004), titled “What Boards Don’t Do But Must Do About Information Technology”, to the 2005 Harvard Business Review article on the need for increased IT governance, titled “IT and the Board of Directors”, it had become clear that boards of directors needed to embrace the fact that their IT infrastructure was a critical dimension of their operations that had previously been overlooked.

The second era of IT governance arrived in the 2010s with the advent of cybercrime, malware, digital sabotage and attacks on businesses of all types.

In 2016, Dambisa Moyo’s Harvard Business Review article, titled “Does Your Board Need A Tech Expert?” reviewed the inherent benefits of IT expertise on the board and concluded, in part, that “… as businesses derive a more direct or significant part of their inherent value from technology, they’ll need access to independent experts (on the board) with deep understanding of technology as a key driver of the company’s fundamental value proposition — people who can check and challenge management’s recommendations”.

It was the paradoxical juxtaposition of companies that had a critical dependence on IT yet had little IT experience on their boards that led securities commissions and other regulators to address that governance deficiency head on.

For example, Britain’s Financial Conduct Authority has called on boards to be far better equipped to oversee IT risk (speech of the FCA’s COO to the 2017 Cyber Security Summit), and the Canadian Securities Administrator’s 2016 Staff Notice 11-332, calls on registrants to manage all forms of IT risk with accountability at the board level.

The Bermuda Monetary Authority has issued similar regulations that require direct board oversight of IT, third-party IT services, data, cyber and related operational risks by the financial service enterprises they regulate.

Over the past few years, IT operations have only become more complicated. Cloud solutions come in many different types and risk profiles, and the contractual requirements for the delivery of software solutions and IT infrastructure “as a service” bears no resemblance to a licence agreement.

The highly beneficial uses of intelligent systems, such as AI, simply increase the stakes of operational risk, and access to data for advanced analytics is now highly encumbered by regulatory restrictions as well as data protection and privacy laws.

Yet many corporate boards still do not have the resident IT business and governance expertise that is commensurate with their enterprise’s reliance on IT to survive and flourish, let alone to better evaluate and oversee transformational IT projects that are undertaken by management.

As well, many risk management board committees have also failed to retain IT business professionals to assist them in their IT oversight functions.

The Corporate Governance Institute’s November 2023 report, “Adapt or Perish: The Technology Challenge for Boards”, concluded with this guidance: “The demands on board members have never been higher. Securing good standards of corporate governance have never been so challenging — including governing technology.”

Does it make sense to have a qualified director on the board who also has technology business experience and expertise? If not now, then when?

First Published in The Royal Gazette, Legally Speaking column, January 2024

Twitter LinkedIn Email Save as PDF
More Publications
21 Feb 2024

Bermuda Privacy Law Compliance: Pitfalls to Avoid

Although members of the Chamber are aware that Bermuda’s Personal Information Protection Act, 2016...

19 Feb 2024

Bermuda: An Introduction to Dispute Resolution in 2024

International business is the primary area of economic activity in Bermuda, as a result of not just ...

15 Feb 2024

Preserving wealth in a Bermuda dynastic trust

The Vanderbilt family gained prominence through shipping and railroad empires and eventually various...

8 Feb 2024

Bermuda’s promising telecommunications future

Last year was a stellar one for Bermuda’s positioning in the global array of telecommunications se...

25 Jan 2024

Fund Finance Laws and Regulations 2024 – Bermuda

The Bermuda fund industry sees investment predominantly from North America and Europe, and therefore...

24 Jan 2024

Chambers Insurance & Reinsurance Guide 2024: Bermuda

This guide provides the latest information on sources of insurance and reinsurance law, overseas-bas...

23 Jan 2024

New Limitations on the Length of Stay for Visitors to Bermuda

In November 2022, The Minister of Economy and Labour, the Hon. Jason Hayward, JP, MP, announced that...

11 Jan 2024

ILS Steps Up When Needed Most

After a robust 2023 for ILS, five experts in this space debated the changing role ILS is playing in ...

10 Jan 2024

The Global – your offshore corporate law questions answered

The Global is Appleby’s quarterly collection of expert insights and analysis on the latest develop...

3 Jan 2024

Bermuda: Cat Bond Market Momentum to Persist After Year of Surprises

It’s been a record breaking year for the catastrophe bond market, and the momentum is having a pos...