Internal Auditor’s blogs reflect the personal views and opinions of the authors. These views may differ from policies and official statements of The Institute of Internal Auditors and its committees and from opinions endorsed by the bloggers’ employers or the editors of Internal Auditor.

​Effective but Unprepared

Comments Views

Last month, in a blog post about what we may or may not have learned from the pandemic, I alluded to a National Association of Corporate Directors' (NACD's) report titled 2021 Governance Outlook: Predictions on Emerging Board Matters. I mentioned that I would have more to say about it and promised a follow up. Well, never let it be said I don't fulfill my promises. (That is not to say I always follow through on my promises, I would just rather it not be said.) So, here goes.

Actually, before diving in, a thought about surveys. Good surveys do two things. The most obvious is that they provide valuable information. I know, Captain Obvious strikes again. But it is easy to find oneself enmeshed in survey results that, while interesting, are providing no value. So, No. 1: a good survey provides good information.

However, the second measure of a good survey is that it raises as many questions as it answers. That may seem counterintuitive, but there is only so much that can be achieved with the type of survey questions that make up most of the reports we read — yes/no, agree/neither agree nor disagree/disagree, on a scale of one to five, select any of the following, etc. They are questions designed to be easily answered, input, and analyzed.

The best reports are those that take these surveys and dig deeper, following up with respondents to determine why those answers exist and what lies beneath them. But it is also the nature of most surveys that the results must be reported timely and, while deeper research is good and proper, time, tide, and typos wait for no man. Such reports will leave the deeper questions for readers to ask of themselves and of their clients.

So it is with NACD's report. Some interesting information. And so many questions.

What in this survey caught my attention, caused me pause, and made me go "Awhaaaa?!" Germane to the preceding, what in this survey made me want to go back and find out exactly what in the wide, wild, and wacky world of governance the respondents were talking about?

From the survey, Question the first: "Our organization's existing crisis plan has been effective in responding to the COVID-19 crisis." Seventy-four percent agreed.

As contestants on The Family Feud and the Animaniacs would say, "Good answer, good answer!!"

I was happy and surprised to see this. I think the reason for my happiness is obvious. The reason for my surprise is the result of discussions I've had with internal audit departments where I see little indication that organizations do a good job of building crisis management plans. In this case, it could be that board members thought of any response as a "plan." Nonetheless, a decent set of positive response.

Question the second: "Prior scenario-planning exercises prepared the board for the COVID-19 crisis." Fifty percent disagreed, while only 41% agreed. And with that answer, we begin to see why attention was caught, pause was caused, and "Awhaaaa?!" was uttered. Nearly three-quarters of respondents thought the plan was effective while, at the same time, half felt planning exercises had not prepared them for the crisis.

How can they be ready but not be ready?

This illustrates the issues that can come up related to surveys, question design, and perceptions. The first question effectively asks board members if their organization responded well. "Why, of course we did! Harrumph, harrumph, harrumph!" The latter question asks about preparedness specifically related to the COVID-19 crisis. No one can predict the future. (Sit down Nostradamus! I'm not talking to you.) And, since the question is so specific, it may be that no one wanted to be considered a sayer of sooth.

Here's my guess. Yeah, some organizations have crisis plans. And some of them are probably pretty good. But I'd guess that such plans are relatively scarce —especially the good ones — and this is a case of board members wanting to look like they did not mess up in relation to an important aspect of governance.

(Quick aside to the auditors in the audience. Yeah, I know you're kind of busy right now, but maybe a sneak peek at your organization's crisis plans, including the existence of lessons learned from this last year, might be worth including in the next quarter's audit plans.)

And when it comes to scenario-planning … Let me honest, I'm not much of an optimist related to this category. As noted, I've heard too many stories of too many organizations that seem to have next-to-nothing in place. Accordingly, I think that even the 41% positive response is a case of rose-colored glasses being worn by color-blind board members.

(Another quick aside for our internal audit audience. When you take that sneak peek at the crisis plans, see if there is anything about scenario planning, and see if there is anything in there about testing out those scenarios. Related question — and, trust me, this is related — before the pandemic, when was the last time you had a fire drill.)

Question the third: "Traditional board responsibilities were deprioritized in favor of immediate crisis management." Only 32% agreed with that statement. As always, a lot of different ways to look at that question, but here's my interpretation. Two-thirds of the board members just kept doing their jobs the way they had always done them. Now, I realize that board members may have been trying to show they understood their role in governance and how they were able to maintain those responsibilities. But the pandemic was/is/will continue to be kind of a big deal. And it doesn't make sense to me that a board would not change some of its priorities, including setting aside some of the less important board responsibilities, to ensure a proper response to the situation.

Which leads us to question the fourth: "The board has overseen crisis management effectively without overburdening management." A rousing 87% patted themselves on the back about this one. (Full disclosure, I don't think I can really figure out what is being asked here. But let's persevere.) Board members previously said they kept up traditional board responsibilities. And they said they oversaw the crisis effectively. How could this not have impacted management's responsibilities to the board? I think the answers are a reflection of the word overburden — a loaded word if there ever was one. No board member wants to be accused of overburdening, so the results get skewed.

Finally, question the fifth (and when I started this affectation I had no idea how many numbers I was going to wind up using; sorry): "Ad hoc or special crisis committees have been a valuable component of the board's crisis response plan." Fifty-eight percent agreed.

What a long, strange trip it's been. Let's try to put this all together. Three-quarters of board members felt their crisis plan was effective, but only one-third said the planning exercises prepared them for the crisis. Then less than half felt traditional board responsibilities were reprioritized, and almost 90% felt they had overseen the crisis management without overburdening management. And yet, ad hoc and special crisis committees were part of the board's successful crisis response. Please show me any ad hoc or special committee that does not result in reprioritization or overburdening.

So many follow-up questions to be asked.

There's a lot I may have gotten wrong here — the context, the meaning, the understanding of those answering the questions, what it means to actually sit on a board. And within the framework of the survey, the questions may have meant something else entirely. Further, I know what it's like when I'm answering these surveys; the answers make sense when I answer, but later I'm not sure why I said what I said.

But that is why I started all this by saying I have a lot more questions. Behind every set of responses are questions that need to be asked. How effective is your crisis management? What does the crisis recovery plan look like? Even if COVID-19 wasn't mentioned in the crisis plan (because it wouldn't be) was that plan adaptable enough to handle the current situation? And what do you see as the board's role in crisis management and crisis preparedness?

And then there is the big question: What do you mean by saying the plan was effective while, at the same time, saying you weren't prepared? What did you need to be prepared for, why was it missing, and why is this not a problem with preparedness?

I've probably been too harsh in this assessment of one section of a very good report. And I can't tell you what prompted me to spend just shy of 1700 words dissecting this one section. If you can get a copy, take a look and see if it doesn't provide insights into not only how you work with your board, but how you work with all of management. (And even if you are just a lowly auditor, these are insights that can help you work with any client.)

Internal Auditor is pleased to provide you an opportunity to share your thoughts about these blog posts. Some comments may be reprinted elsewhere, online or offline.



Comment on this blog post

comments powered by Disqus
  • GAM-February-2021-Blog-1
  • CIA-February-2021-Blog-2
  • CIA-Learning-System-February-2021-Blog-3