Being tech-savvy has become an essential capability for today’s board. It’s important for boards to look beyond the defensive applications of cyber risk to embrace the role of technology in driving new opportunities, business models, and revenue sources.
Smart, connected, and disruptive technologies can transform organizations—and in doing so, they offer an array of both opportunities and risks. There’s a fast-growing recognition that board members need to develop a much deeper understanding of technology, including how it integrates with and can drive—or disrupt—strategy. It’s critical that boards understand not only the broad set of risks technology creates but also the potential upsides it presents—and the role they play in overseeing management’s actions in addressing those implications effectively.
How can boards do this?
In short, boards can strive to become more “tech-savvy.”
This article, which synthesizes insights and recommendations gathered from interviews with board members and CIOs, will explore corporate boards’ engagement with technology. It will focus on the integration of technology and strategy, defensive vs. offensive applications of technology, the role of committees, and engagement with CIOs and other technology leaders.
Companies use technology both defensively and offensively. Defensive applications are related to the protection and preservation of the organization’s business and assets. Offensive applications consider how technology can create and enable new opportunities, business models, and revenue sources.
Cyber risk, primarily a defensive technology option, is one of the top-three risks today’s boards are focused on, according to Deloitte’s research.2 The attention is understandable. “Every day, the board is hearing about some other company being hacked,” says Owen Williams, Insurance CIO at Everest Reinsurance. “So they're naturally going to ask, ‘Are we as secure as we think we need to be, and what do we need to do to remedy that?’ That's a purely defensive conversation.”3 While these conversations are important and need to be part of the board agenda, many board members acknowledge that defensive conversations eat up the bulk of the time allocated for technology-related discussions—often leaving little or no time for offensive conversations.
However, because boards also have an obligation to guide the company toward growth and innovation, offensive conversations need to be part of the board agenda, too. Particularly with today’s exponential pace of change, technology is an enabler of strategy, new business models, innovation, disruption, and more efficient and effective execution. “There isn’t a single strategy in any business that isn’t enabled by technology,” says Sheila Jordan, SVP and CIO of Symantec. “Technology is the common denominator in every single key strategic imperative in every company.”4
Technology can also cause disruption within a company. For example, 64 percent of survey respondents in the 2019 Deloitte Global Human Capital Trends report see growth ahead in robotics, 81 percent say the same about artificial intelligence (AI), and 80 percent foresee growth in cognitive technologies. Yet despite the predicted growth in adoption, only 26 percent say their companies are “ready” or “very ready” to address the impact of these technologies, which are expected to include job design, reskilling, and work reinvention as people and machines are more extensively integrated across the workforce.5
The strategic implications of using technology offensively are significant—perhaps staggering. Today’s business environment is characterized by rapid change, the advent of AI and machine learning, and the fact that technology is embedded in almost everything. This requires a holistic view—combining conversations about technology enablement and strategy—to lay the foundation for growth, operational efficiency, and better business performance.
Many technology projects—particularly those that have the attention of the board—involve large capital expenditures. Overall, companies spend 3.5 percent of their revenue on technology—and for some sectors, such as banking, this number can be as high as 7.5 percent.6 These are significant investments, so it’s important for boards to understand whether and how investments in technology will generate greater returns than alternative uses of the funds. Yet only 36 percent of participants in Deloitte’s 2018 global CIO survey say that their organizations have a well-defined IT investment process, and only 35 percent say that there is a clear process for prioritizing IT investments. Less than a third (30 percent) report there is a structured process for measuring the value of IT investments.7
Despite these statistics, additional spending on technology may represent a better use of capital than alternative investments. “What’s the opportunity cost of not doing a particular project, of not moving ahead?,” asks Phyllis Campbell, chairman, Pacific Northwest, JP Morgan Chase. “If we don’t make a particular technology investment, what are the risks, and what is the actual long-term cost to the business?”8
Today, many boards tend to focus more on defensive applications of technology. The challenge is to find the appropriate balance between offense and defense for the company—and to be aware of how technology can be integrated into discussions of strategy, capital allocations, and more. Whatever the balance, it’s critical that technology not be siloed from other big-picture conversations.
As boards and technology leaders engage more, the depth and breadth of these conversations are also changing. The CIO survey found that an increase in interactions between CIOs and boards can lead to a more balanced mix of conversations about defensive and offensive technology opportunities.9
Most boards and technology leaders strive for increased engagement, and many believe that engagement needs to continue outside of the boardroom. Many of these conversations only focus on a subset of issues and topics; however, boards have an important role to play in engaging with the CIO and management across the major domains of strategy, risk, and performance (see figure 1).10
To guide business strategy, board members need to understand the strategic impact and potential risks of technology. For example, two multinational companies merged recently. Even though both are in the same industry, they have very different business models. Business leaders assumed that one company could simply adopt the use of the other’s technology—an assumption that was flawed. As a result, the newly merged company has had to do a significant amount of work to align its technology models—an effort that might have been less cumbersome had management and the board considered technology more carefully as part of the initial merger research.11
Similarly, established brands are using technology to augment their existing market penetration. One Harley-Davidson dealership uses an AI platform to identify customers most likely to buy its products and then looks for people with similar attributes to identify additional potential buyers. With this strategy, the dealership was able to increase qualified high-value sales leads by 2,930 percent in three months.12
Most boards realize that cyber risk is important to address because of its potential to severely disrupt business operations and reputation and to generate costly remediation expenses. A Deloitte study found that 48 percent of board technology conversations were centered on cyber risk and privacy topics, while less than a third (32 percent) were concerned with technology-enabled digital transformation.13 In addition, it’s wise for boards to look at overall resilience—the ability to respond and get systems up and running quickly—as well as business continuity and disaster recovery.
Some examples of technology-driven disruption are well known: the sharing economy’s disruption of the transportation and hospitality industries; the impact of autonomous vehicles on long-haul trucking; streaming entertainment’s effect on traditional cable TV packages; and blockchain’s potential to disrupt banking, health care, real estate, education, nonprofits, and many other industries. With this in mind, boards can ask themselves: If we don’t innovate, what’s the potential cost and impact? How could industry disruption affect us?
Technology can be a net benefit—or detriment—to business performance across the enterprise. It can enable or transform business operations. For example, a new enterprise resource planning (ERP) system can enable better visibility across the network, leading to decision-making that can increase profitability; and a warehouse management system can give a distributor a competitive advantage that may deliver revenue increases. That said, it’s also important to remember that every innovation that increases performance comes with a new set of risks that must be managed.
Consider operations technology (OT), or industrial control systems—the hardware and software tied to a company’s physical devices and processes. “Most people think OT, and they think utilities like power and water, or manufacturing sites,” says Robert M. Lee, CEO of Dragos, in a recent Deloitte podcast. “But really, just about all companies except banks and insurance companies are industrial companies.”14
OT—from robots in manufacturing to sensors on drilling rigs and remote switches in electrical grids—helps to make jobs safer and outcomes more reliable. If OT goes down, billing systems won’t work, worker safety can be affected, and intellectual property can be stolen—whether it be medicine and research in the pharmaceutical field or patented recipes for food and beverage companies. “A lot of the resource investment is on the enterprise side of the house, but actually most of the risk is on the industrial side of the house,” Lee says.
Deloitte’s Technology-Board Engagement Index can help boards identify areas that may benefit from deeper discussion and engagement. The index helps board members and technology leaders assess personal tech fluency, frequency of dialogue, alignment of management and board, and quality of decisions in 10 topics related to strategy, risk, and performance:
There is no one-size-fits-all approach; each organization will have different priorities for each of the engagement areas, depending on business strategy, industry trends, and other factors. It can be helpful to have all board members and technology leaders participate in the assessment and compare scores; the resultant variations may lead to a richer dialogue.
Take the assessment here.
Boards function as a team and are reliant on the skills and capabilities of their members. Today, there is an expectation that board members understand technology at an appropriate level. The board should be able to provide a credible challenge to recommendations from management, which obligates a board to remain informed. While external and internal advisors can bring useful knowledge to the board, it is imprudent for boards to rely exclusively on advisors.
The following steps can be considered to help boards be more tech-savvy.
Build intellectual agility. One quick fix could be to add a tech-savvy board member who can bring knowledge and expertise to board conversations around technology topics. However, this may not always be possible to do quickly. It’s a good idea for boards to consider the need for technology skills as part of their succession planning activities, although being conversant with technology is not the only criterion for new board members; director candidates will ideally have a variety of skills and broad general business knowledge.
Over time, demographics may help boards address the need for tech-savvy members. According to the 2018 United States Spencer Stuart Board Index, 17 percent of the incoming class of directors are aged 50 and younger, and more than one-third of these next-gen directors have backgrounds in the technology/telecommunications sector. The challenge, the report suggests, is finding experts who have a broad business perspective as well as technical expertise.15
In fact, many board members are very conversant on technology topics because they have made a conscious effort to seek out knowledge on issues and trends despite having no background in technology. There are many ways for directors to develop greater technology knowledge, including reading in areas relevant to the company and industry as well as attending training and development programs and technology conferences or trade shows (see sidebar, “Proactive approach to technology trends”).
Today, every company is a technology company. Whereas a decade ago, many companies could achieve competitive advantage by embracing innovations and trends that were already underway, this kind of reactive approach likely is no longer enough. To stay ahead of the game, companies can work methodically to sense new innovations and possibilities, make sense of their ambitions for tomorrow, and find the confidence to boldly go beyond the digital frontier.
We have identified three major phases of technology impacting businesses today: foundational forces, digital pillars, and emerging technologies. As boards think about business strategy and technology governance, they can keep this progression in mind and push management and CIOs to consider the specific relevance and business impact of each of these trends.
Organizations typically need a robust foundation and assurance of reliability and operational excellence. Three foundational forces make it possible for organizations to harness innovation while maintaining operational integrity:
These formative macro forces have been important in the pursuit of digital transformation, guiding how (and if) existing assets can serve as a foundation for innovation and growth, and reengineering an organization’s technology function to quickly and impactfully deliver against the promise of current and future technologies.
Over the past 10 years, three trends have steadily disrupted IT operations, business models, and markets. Though these now-familiar forces may no longer qualify as “trends,” their impacts cannot be overstated, and they are the pillars upon which many future ambitions are built:
Today, digital is increasingly used in tandem with experience, to describe all the ways people engage within digital environments. Think, for example, of how health plans are deploying new tools to simplify the preauthorization of claims. Behind the scenes, cognitive algorithms, robotic process automation, and predictive analytics tools are approving more of the simple and rote use cases that used to dominate many employees’ workdays.
Despite their ubiquity and demonstrated value, these technologies’ full potential remains largely untapped. Investments in them are often departmental and limited in scope. Likewise, in some companies, initiatives driving analytics, cloud, and digital are disjointed, even competing, efforts. And even this old guard of emerging technologies continues to evolve at an astounding pace—in capabilities, in business models, and across broader marketplace dynamics.
Recently, three new technologies have taken up the “disrupter” mantle. Today, each is poised to become a distinct macro force in its own right:
These newer trends are growing rapidly in importance. VR and AR are redefining the fundamental ways humans interact with their surroundings, with data, and with each other. Though breakthroughs in wearables, “smart” objects, and sensors sometimes dominate mindshare, the hero is not the device itself but the interactions and experiences unlocked that would otherwise be impossible. Blockchain has experienced a meteoric rise—from bitcoin enabler to purveyor of trust. And cognitive technologies have moved from fledgling siloed capabilities to tenets of strategy—with profound potential for business and society. These three trends, though still emerging, are poised to become as familiar and impactful as cloud, analytics, and digital experience are today.
There is no definitive place for each of these technology trends in relation to a particular company. But one of the most pressing challenges that technology and business leaders face—and that boards should consider—is how to excavate and harness the value these forces can collectively deliver to move their organizations forward.
“Intellectual curiosity is no longer enough,” says JP Morgan Chase’s Campbell. “It’s certainly important to be intellectually curious, read, learn, and go to technology trade shows. But you must also be able to move from intellectual curiosity to intellectual agility, which is a very different concept. You might even find yourself in a situation where your technology director brings their technology and digital and innovation piece to the table, but not necessarily in the context that other board members and/or management can absorb. So I think the intellectually agile director is one who can not only be curious but who can interpret and apply.”16
Symantec’s Jordan emphasizes that getting educated is a time commitment for board members. “One option I’ve done a couple of times is to fly the board out to visit one of the venture capitalists, and we have an all-day meeting with new and interesting technology presentations and demonstrations by start-ups,” she says. “It’s a full day, and board members get to see a lot of technology from small start-ups that people haven’t heard of yet.”
Leverage committees to take deep dives on technology issues. Savvy boards can also use committees to their advantage when it comes to technology. Committees typically can engage in deeper dives on a topic than the full board.
Boards can keep an eye on a number of risk areas—from new disruptive technologies such as AI, blockchain, and IoT to technology’s impact on risks to brand, reputation, and culture. Many boards are already engaged in understanding cyber risk, and perhaps to a lesser extent, regulatory risk—and many have already assigned oversight responsibility for cyber risk to the audit and/or risk committees. But it’s less clear that boards are making similar committee assignments to consider and address the risk of industry disruption.17
The role of board committees in addressing technology and surfacing and discussing important technology issues is something for each board to determine, based on its membership, the company’s industry, and other factors. There is no single correct solution. Some companies, for example, heavily leverage the audit committee or risk committee to handle technology. However, this can lead to too much focus on defense and technology risks (e.g., cyber) or compliance (see sidebar, “Role of the audit committee”).
Audit committees are frequently tasked to dive deep into a broad range of risk and control issues. To help identify risks and provide insight, audit committees need to consider the different ways that technologies help protect and grow the business. For example, the deployment of cloud computing, digitalization, embedded systems, robotic process automation, AI, and other technologies increasingly compels the audit committee to understand IT governance frameworks, data models and bias, acceptable tolerance for error, control activities that respond to identified risks, and other related topics.
To get started, audit committees can work to understand:
A more in-depth exploration of the impact of technology on audit committees can be found in the Center for Audit Quality’s Emerging technologies: An oversight tool for audit committees.18
Although specific technology committees offer the opportunity for members to develop a degree of expertise and take deeper dives into issues, only 9 percent of companies had either a separate technology committee or a science and technology committee in 2018 (up from 8 percent in 2013), according to a recent Spencer Stuart analysis.19 No matter where the committee-level conversation about technology takes place, it’s important to remember that the overall responsibility—particularly for opportunity- and growth-related (offensive) technology discussions—remains with the full board.
“The committee is an incubator,” says Michael Toelle, a director of Nationwide Mutual Insurance Company. “We typically discuss strategic technology projects at a committee level, and staff presents some information from the industry, such as trends. Then we narrow it down and bring it to the full board six months later.”20
Encourage ongoing conversations with technology leadership. Boards and management usually have the same goals, but can sometimes appear to be two separate teams. Ongoing technology conversations with management, particularly when tied to business strategy and outcomes, can help bring down walls between the two and help raise the awareness and knowledge of board members.
The board can set clear expectations with management on how and at what cadence it wants to receive information. The best communication scheme will depend on the particular company, board structure, and the individuals involved. Deep-dive sessions with the CIO or others in between board meetings and extra development sessions tacked on to board meetings are possible options.
“Interactions outside the board room enhance director effectiveness, and the technology committee is certainly an example for that to happen,” says Jessica Blume, director at Centene Corporation and Publix Super Markets. “For example, members of the technology committee have the opportunity to go deeper with the CIO into technology strategies, learning the plans and challenges, and can also bring their experiences into the conversation. Some companies may appreciate this approach to information exchange and learning, but others may find it too freewheeling.”21
CIOs can play an important role in helping educate and develop the board and can be a source of information such as dashboards, education programs, and exercises. Boards can work with CIOs to determine the amount of material to put in a pre-read versus what to present in the meeting, how much individual directors should rely on committees to help bring the rest of the board up to speed on particular topics, and whether to invest in group trips to relevant technology trade shows and meetings with experts. Boards and management can work together to find a solution that works for everyone—for example, by putting in place a formal plan for how members can obtain internal and external perspectives on key technology topics.
Help develop tech talent and skills—in the C-suite and beyond. Boards have a responsibility to monitor and advise on whether management—including the CIO and other C-suite executives—has the necessary technology skills. It’s important for boards to convey their expectations for those skills.
“The emerging CIO is less a career-deep technologist and more a technology-savvy business manager,” says Rae Parent, CIO, Mass Mutual. “It’s an incredibly complicated space, but the adept CIO of the next 10 to 15 years needs to have a deep understanding of business context and be able to synthesize it across all of the different and evolving technology domains. It’s not so much about going deep into IT as it is about customer experience. It’s about understanding organizational strategy and how technology enables that.”22
Another CIO skill for boards to keep in mind is executive presence. “It sounds simple, but it’s extremely important,” says Charles Holley, retired CFO of Walmart and independent senior advisor to Deloitte’s CFO Program. “Anyone interacting with the board should make sure they have the appropriate training and practice to communicate effectively.”23
The importance of talent goes beyond the C-suite. Technology skill sets are changing rapidly; not having talent with needed skill sets could mean falling behind the competition or not leveraging technology effectively. Boards can be actively involved in understanding the current talent pool for technology and helping CIOs recruit talent to support current and future business mandates for innovation, growth, and transformation.
Boards can also take succession planning into account and can help determine succession planning processes and responsibility for technology leaders such as CIOs. Succession planning can be challenging, but there are many benefits—including a more diverse portfolio of leaders, development opportunities for emerging leaders, a stronger organizational culture, and a future-proof workforce.24
Being tech-savvy has become an essential capability for today’s board members. It’s important for boards to expand their focus beyond the defensive applications of cyber risk to embrace the role of technology in driving new opportunities, business models, and revenue sources.
In the ongoing journey to be more tech savvy, boards can consider the following questions for CIOs and other board members.
Ask CIOs:
Ask other board members:
Savvy boards can learn to engage with CIOs and management to assess the role of technology across the realms of strategy, risk, and performance. They can assess and update their succession planning, leverage committees, and strive to discover the optimum method of engaging with management. Now is the time for boards to challenge their blind spots and begin the process of increasing their tech-savviness.
Deloitte Risk and Financial Advisory helps organizations navigate a variety of risks to lead in the marketplace and disrupt through innovation. With our insights, you can learn how to embrace complexity and accelerate performance.
Learn more
