Since there is not an organisation, in either the public or private sector, whose existence and success does not depend on information technology, it is reasonable for investors and regulators alike to expect that all boards would make it a priority to include a technology-savvy director.

Pervasively, that is often not the case despite history’s lessons.

With Y2K came the first realisation that boards were generally unprepared to anticipate, plan for and avert systemic IT infrastructure risk. I saw that first-hand when I served as special counsel to the Ontario Securities Commission on the legal implications of Y2K for the companies that the OSC regulated.

Soon after Y2K, as legal and audit professionals were still formulating their Y2K “lessons learnt” guidance, the “year of the accounting scandals” (2002) arrived. The broad and instructive inquiries into those scandals threw a very bright light on the inseparable relationship between sound financial management, data integrity and IT governance.

In the years that followed, a great deal of debate ensued about the need for IT business experience to be represented on boards.

From the Ivy Business Journal article (September-October 2004), titled “What Boards Don’t Do But Must Do About Information Technology”, to the 2005 Harvard Business Review article on the need for increased IT governance, titled “IT and the Board of Directors”, it had become clear that boards of directors needed to embrace the fact that their IT infrastructure was a critical dimension of their operations that had previously been overlooked.

The second era of IT governance arrived in the 2010s with the advent of cybercrime, malware, digital sabotage and attacks on businesses of all types.

In 2016, Dambisa Moyo’s Harvard Business Review article, titled “Does Your Board Need A Tech Expert?” reviewed the inherent benefits of IT expertise on the board and concluded, in part, that “… as businesses derive a more direct or significant part of their inherent value from technology, they’ll need access to independent experts (on the board) with deep understanding of technology as a key driver of the company’s fundamental value proposition — people who can check and challenge management’s recommendations”.

It was the paradoxical juxtaposition of companies that had a critical dependence on IT yet had little IT experience on their boards that led securities commissions and other regulators to address that governance deficiency head on.

For example, Britain’s Financial Conduct Authority has called on boards to be far better equipped to oversee IT risk (speech of the FCA’s COO to the 2017 Cyber Security Summit), and the Canadian Securities Administrator’s 2016 Staff Notice 11-332, calls on registrants to manage all forms of IT risk with accountability at the board level.

The Bermuda Monetary Authority has issued similar regulations that require direct board oversight of IT, third-party IT services, data, cyber and related operational risks by the financial service enterprises they regulate.

Over the past few years, IT operations have only become more complicated. Cloud solutions come in many different types and risk profiles, and the contractual requirements for the delivery of software solutions and IT infrastructure “as a service” bears no resemblance to a licence agreement.

The highly beneficial uses of intelligent systems, such as AI, simply increase the stakes of operational risk, and access to data for advanced analytics is now highly encumbered by regulatory restrictions as well as data protection and privacy laws.

Yet many corporate boards still do not have the resident IT business and governance expertise that is commensurate with their enterprise’s reliance on IT to survive and flourish, let alone to better evaluate and oversee transformational IT projects that are undertaken by management.

As well, many risk management board committees have also failed to retain IT business professionals to assist them in their IT oversight functions.

The Corporate Governance Institute’s November 2023 report, “Adapt or Perish: The Technology Challenge for Boards”, concluded with this guidance: “The demands on board members have never been higher. Securing good standards of corporate governance have never been so challenging — including governing technology.”

Does it make sense to have a qualified director on the board who also has technology business experience and expertise? If not now, then when?

First Published in The Royal Gazette, Legally Speaking column, January 2024

Twitter LinkedIn Email Save as PDF
More Publications
10 Jul 2024

Bermuda – Women in Hamilton: Cathryn Minors

Appleby Counsel Cathryn Minors knew she wanted to be a lawyer from the age of 13 and that self-belie...

10 Jul 2024

Bermuda – Women in Hamilton: Josephine Noddings

Appleby Counsel Josephine Noddings says Bermuda gives access to the some of the best minds in the re...

5 Jul 2024

Balancing innovation and stability: Bermuda Monetary Authority’s stance on affiliate investments

A new approval process for affiliate investments forms a key part of the Bermuda Monetary Authority�...

2 Jul 2024

Bermuda: Good Chance Cat Bond Issuance Hits $20bn in 2024

Significant catastrophe bond issuance at the halfway point of 2024 means it’s already the third hi...

27 Jun 2024

Bermuda: Crypto Assets in Trusts and Foundations

Published in association with STEP, Crypto Assets in Trusts and Foundations features an in-depth e...

24 Jun 2024

High-level overview of Bermuda Monetary Authority’s three-tiered capital system

Insurers and reinsurers are faced with uncertainties relating to the timing and scale of future loss...

10 Jun 2024

Bankruptcy & Restructuring – Planning for Failure

The sudden collapse of Lehman Brothers in September 2008 sent shockwaves around the globe. As the la...

4 Jun 2024

Bermuda’s cybersecurity law transformation is well underway

We are almost six month into 2024, and this year has already been transformative for IT and cyber se...

23 May 2024

Regulatory oversight is key for Bermuda’s insurance sector

Bermuda’s thriving insurance and reinsurance sector requires effective regulatory oversight if it ...

9 May 2024

It is all about the data

All successful enterprises have a voracious appetite for data. The advanced abilities of IT systems ...