Technology Leadership in the Boardroom: Driving Trust and Value

Each year, NACD leverages the perspectives and experience of its members and appoints a Blue Ribbon Commission, an experienced collective of directors, investors, subject-matter experts, and leading governance professionals. The Commission examines and develops recommendations and tools to address the most challenging issues facing boards.

Blue Ribbon Commission Reports (BRCs) have been strengthening corporate governance for three decades. In recent years, Commissions have developed comprehensive guidance to significantly rethink or elevate topics such as board oversight of corporate culture, talent, and new disruptive risks. These reports helped set the standard for effective board practices in these areas and have been used by investors and policymakers.

BRCs play a key role in helping to empower directors and transform boards to be future ready.

Recommendations for Action

The Commission’s recommendations focus on building technology governance capabilities and leadership across three key areas: oversight, insight, and foresight. Strengthening performance in these categories helps each director fulfill their fiduciary duty by supporting the firm’s ability to stay competitive and advance long-term value creation. Some recommended actions will fit seamlessly within current board and committee responsibilities and tasks, while others will challenge board and committee leaders to revise and refine practices.

• Strengthen Oversight: Revise board processes, practices, and structures to oversee how technology will impact the way the company creates value. The board’s work to strengthen oversight reinforces its role as a thoughtful management advisor and authority.
• Deepen Insight: Gain a more robust understanding of complex new technologies and management’s plans to take advantage of them. Deeper insight enables the board to have fuller, context-driven dialogues with management about technology opportunities and risks.
• Develop Foresight: Pressure test assumptions about beliefs, plans, and investments related to technology, and dedicate resources to forward-looking discussions. This practice allows the board to form a trusted partnership with management in their joint discovery of new technology opportunities and outcomes.

Strengthen Oversight

Boards need to strengthen their oversight of the organization’s use of technology and data. This includes driving stronger alignment between the company’s purpose and values and its technology strategy and growth plans, considering changes to the oversight structure, and clarifying critical decision-making roles for the board and management.

RECOMMENDATION 1: ENSURE TRUSTWORTHY TECHNOLOGY USE BY ALIGNING IT WITH THE ORGANIZATION’S PURPOSE AND VALUES.

Boards and management teams need a single vision for how the organization uses technology to create long-term value. NACD’s 2022 Future of the American Board framework highlights that management and the board should develop a shared view about the company’s unique purpose and that this purpose should inform decisions around strategy and risk. [1] The goal of operating value-creating technologies with purpose and integrity is trust, which can be won or lost through corporate decisions. Defining the firm’s relationship to technology through the lens of its core values establishes parameters for acceptable use and provides the necessary reference point for boards to oversee technology in a complex regulatory environment.

Ensure stakeholder trust is part of technology decision-making

Digital trust can be defined as “individuals’ expectation that digital technologies and services—and the organizations providing them—will protect all stakeholders’ interests and uphold societal expectations and values.” [2] Boards and management need to discuss trustworthy use of technology and data before making decisions to capitalize on new technologies. While the board’s primary obligations are to the company and shareholders, dispatching these responsibilities is critical to accounting for the interests of various stakeholders: customers, employees, the communities in which they operate, and others. As one Commissioner stated, “We need more discussion on alignment [between strategy and technology] with values. It’s about what you can do, but also what you should do.”

Technology and data use can fundamentally shift the type of business, products, and services that an organization chooses to operate and sell. Such changes alter relationships with customers, supply chain players, partners, and other stakeholders. In context, the acceptable use—or the “social license” around the use—of technology between firms, vendors, suppliers, and customers is highly fluid and interconnected. There should be regular, candid dialogue between boards and management about shifting expectations, value creation, impacts on stakeholders, and entrance into new business lines and how they affect company decisions, strategies, and tactics. These regular conversations can allow management and boards to revisit decisions that might harm longer-term stability, trust, and value for stakeholders. As one Commissioner framed it, “We must ensure that we make good decisions now and apply best practices for decision-making to ensure technology use is trusted in the future.”

The board and its technology leadership (for example, a technology committee chair, the board chair, or other board leader) can work with the CEO, other key management (such as the ethics and compliance officer), and third-party experts to explore critical questions about the firm’s use of technology. This exercise would promote a common understanding of the board’s oversight role for technology trust and ethical matters.

Questions to guide alignment on trust and value Boards and management should explicitly discuss questions such as these:

• How do our values influence how we use or develop technology?
• Has the risk of damaging customer or public trust been incorporated into the enterprise risk management framework?
• What are the expectations of our customers, business partners, and key regulators for how we use technology and data?
• Have product development, review, and acquisition processes embedded trust into associated design, launch, update, and contract operations?
• Are trust-centered technology approaches and decisions being communicated transparently to investors, regulators, and other stakeholders?
• How will the company balance revenue growth and operational efficiency with its values?
• About which values-centered decisions must the board be informed? On which policies will the board either advise or decide?
• What information must the board receive from management to be able to execute its agreed governance role?

Aligning on these issues will enable boards and corporate leaders to effectively build their companies’ purpose and values into major business decisions about technology and data.

RECOMMENDATION 2: UPGRADE BOARD STRUCTURES FOR TECHNOLOGY GOVERNANCE.

Boards should assess if their current oversight structure and practices effectively support robust governance of technologies at the necessary pace. Board responses to the COVID-19 pandemic led to more fluid governance, with boards meeting more frequently, adapting committee remits, and becoming comfortable with advising management more frequently on major decisions. This agility can be applied to technology oversight.

As defined in the 2022 Future of the American Board report, “board agility is the capacity of a board to attend to and address critical issues as they arise in a decisive, efficient, and well-informed manner, and to pivot from a course of action when it is apparent that change is necessary.” [3]

Ensure effective committee delegation

The nominating and governance committee chair can lead a review of charters and responsibilities through the lens of technology governance. The goal is to ensure that technology-related matters are assigned either to committees or to the full board as appropriate.

As technology and data are now core drivers of business success across many domains (including strategy, risk, compliance, finance, brand, sales and service, human resources, and procurement), technology oversight must become a recurring, mandatory responsibility within each standing committee, where applicable. In specific instances, it may be necessary to redistribute expertise across committees or modify committee leadership, and associated management reporting may require rearrangement. The board also should consider whether and how the firm will disclose to investors and shareholders that it has taken actions to strengthen its technology oversight structure.

The table below provides examples of how technology oversight responsibilities could be allocated among board committees.

TECHNOLOGY COMMITTEE TYPES Boards have a variety of potential committee options that might fit their firm’s needs: A technology-focused board committee chartered with specific decisions and responsibilities A technology-specific board subcommittee of another standing board committee that can focus on and report up to the committee or full board on specific issues such as major technology investments, technology M&A considerations, monitoring technology compliance efforts, and major technology transformations A technology advisory board that advises the board and C-suite on emerging technologies and business processes

Consider whether a dedicated technology committee, subcommittee, or advisory board is needed

The overall technology-driven strategy is and should always be a full-board responsibility, but from time to time the board may determine that a dedicated technology committee, subcommittee, or advisory board is appropriate. Such a decision should be informed by the firm’s relationship to technology and strategic needs.

A dedicated technology-focused committee can be particularly useful when an organization is facing significant disruption or undertaking a major digital transformation. Companies across industries have established these committees, often in response to technology developments that are fundamentally impacting how the company can deliver value. In these instances, the boards determined that a dedicated technology committee would provide the right forum to enable “technology deep dives” and management oversight. [4] In addition, the committee’s creation clearly signals to investors, shareholders, and employees that the board is focused on technology transformation.

Using committees, subcommittees, or advisory boards in the earlier stages of a major technology-driven transformation can also bolster overall levels of board knowledge on complex technology matters. One Commissioner mentioned that the rest of the board routinely elected to sit in on the firm’s technology committee meetings for ongoing education about the evolving technology landscape. Whether or not the board determines that it requires a new committee, it should regularly review which outside expertise should be brought in to educate the board and close any gaps in understanding that might exist.

Clear scope, roles, responsibilities, and authority for the committee should be outlined, recommended to the full board by the nominating and governance committee, and agreed upon by the full board. Commissioners stressed that the technology committee charter should include a responsibility for capturing external and forward-looking perspectives to help the firm stay ahead. As one Commissioner warned, “If you don’t explicitly plan to stay ahead, you will fall behind.” 

RECOMMENDATION 3: CLEARLY DEFINE THE BOARD’S ROLE IN DATA OVERSIGHT.

Boards need to understand the systems within their organization that use data and what is done to create value from the data. Management should define and communicate to the board the strategic value it intends to derive from the organization’s data, sources of which could include such disparate text-based and numerical forms as reports from HR systems, customer transactions, “crown jewel” data, and others. The board can then consider what oversight structures must be in place over the current and potential value of the data.

Critical areas for oversight include ensuring the data is protected, tracking how the firm is ensuring trusted and ethical data use, and clearly understanding data risks and opportunities. “Right now, the companies that are harnessing and securing their data are the ones that are winning in the market,” one Commissioner said.

The National Institute of Standards in Technology defines data governance as follows:

“A set of processes that ensures that data assets are formally managed throughout the enterprise. A data governance model establishes authority and management and decision-making parameters related to the data produced or managed by the enterprise.” [5]

Boards will not be involved in the operation of data governance programs. Rather, the board’s role is to ensure that the data governance function is effective and managed appropriately. The board’s oversight of data governance work should focus on four core goals: [6]

• Alignment: Assure that the use of data aligns with desired business outcomes and strategic objectives.
• Accountability: Hold the chain of command established within the organization responsible for data decisions and the value created or lost as a result.
• Transparency and ethics: Review that the firm is openly communicating and holding itself accountable to data practices that mirror its own ethics framework and values.
• Quality: Review the standards set for data quality and whether the company is meeting them. Controls can and should be in place, and the board can review their success.

Some specific actions that strengthen board oversight include these:

• Audit committee reviews internal audit’s own data governance audit. Data audits happen over time and track controls, ethical use, and other facets of data use within an organization.
• Review by full board or the audit committee of the risks associated with specific projects tied to data use—notably, breach and privacy risks associated with specific national, state, and local laws.
• Review whether data is included in the firm’s strategy and track progress of its use against specific, aligned outcomes.
• Consider whether a new management role, such as the Chief Data Officer, should be added to the C-suite.
• Request contract reviews to determine which business partners have access to data, and if those contracts need to be renegotiated to protect it.
• Ensure oversight of data governance and data use is clearly aligned to committee charters (for more on committee alignment, see Recommendation 2, page 18.)

Data-related matters are likely to be reported to the board already through the scope of security and privacy, and boards can and should think of this process as an on-ramp to deeper data governance oversight. The board can request management to broaden the aperture of reporting to move beyond traditional risk reporting and include opportunities around data, review of its use, and discussion of its ownership.

RECOMMENDATION 4: DEFINE DECISION-MAKING AUTHORITIES FOR TECHNOLOGY AT BOARD AND MANAGEMENT LEVELS.

It is important to define and respect the roles of the board and management in governing transformative technology and data. Research suggests that few boards have assigned clearly defined roles to themselves that ensure technology oversight. [7] Management is responsible for executing the technology plan and the strategy it supports, while the board needs to be informed by management on critical decisions and matters that require approval.

Ahead of reviewing decision-making authorities, boards can request that management explicitly state what technologies are used to create value, why they are used, what risks exist, and if they themselves understand the technology and why it was adopted. Boards should be ready to focus on technology decisions that materially impact a variety of stakeholders within and outside the firm. From there, the board should determine what decisions it might need to be involved in and which can remain with management.

Below are key steps boards can take in partnership with management to clarify the distinct technology-related roles and responsibilities of the board.

Redefine thresholds for board and management technology decisions

Guidelines or thresholds for board review of technology decisions may have to be modified to strengthen board oversight. Up for review are actions that require board approval, and which issues the board must be notified of, as well as the form or cadence of reporting by management. A key driver for review is that dollar thresholds for board approval may no longer be sufficient for complex technology and data governance matters.

For example, pilot applications of new technologies are often at a dollar amount that falls well under the review threshold set by boards. Strategic, operational, reputational, and legal considerations—many of which may be qualitative in nature—may need to be more heavily weighted than purely financial or quantitative criteria.

Examples of thresholds and review criteria that may be reconsidered for stronger oversight of technology include these:

• Dollar amounts or percentage of revenue tied to innovation and investment that trigger board involvement
• Accepted risk levels for data or technology use
• The strategic road map and timing of a company’s digital transformation
• Shifts in use of technology and data that may impact the trust relationship with customers, employees, and other stakeholders
• Impact on customers and business processes
• New competitive threats and how to respond to them
• New business models and value creation opportunities

Deepen Insight

Boards need to be equipped with sufficient insight to guide their companies through an increasingly complex technology environment. Gaining insight into the workings of technologies with significant relevance to business is far from easy. It demands commitment from every director and the board to learn and raise their proficiency levels, and it requires that the board receive relevant and digestible information from management. The following recommendations focus on actions boards can take to accelerate their technology proficiency and establish the right board-level metrics in partnership with management.

RECOMMENDATION 5: ESTABLISH AND MAINTAIN NECESSARY TECHNOLOGY PROFICIENCY AMONG THE BOARD.

Boards should define and agree on what technology proficiency means in the context of the business, and how proficiency and continuous education will be attained collectively and by individual directors. Directors have noted that inadequate technology proficiency is a critical barrier to effective board technology and data governance. [8] “There’s got to be a minimum standard of technology proficiency for all directors,” one Commissioner noted.

How to define technology proficiency

There is no single definition of director technology proficiency. Board-level technology proficiency will vary, as each business has a unique remit and mix of technologies in use. However, as one Commissioner noted, “Technology proficiency is not dictated by experience with any one technology, but by proven experience and capabilities to understand and build and create value with technology.”

Additional attributes to consider in building technology proficiency at the board-level include these:

• The ability to enable and not impede progress by the management team
• Sufficient fluency to ask questions about second-, third-, and fourth-order implications around technology strategy and risk
• Continuously learning about technologies
• Leaning into curiosity about the projects and innovations that will drive short- and long-term value at the firm
• Being attuned to the changes in industry associated with technology evolution, including shifts in workforce requirements and attitudes and new processes

Develop and sustain an effective learning plan

Boards must develop a collective and continuous learning strategy that equally builds proficiency across the board and C-suite, and then the board should hold itself—and future board members—accountable to it. Establishing and maintaining proficiency together allows boards and management teams to create a consistent level of understanding and a common vocabulary. The board chair or lead director can collaborate with the nominating and governance chair to make sure that the right learning approach and priorities are in place.

Each firm and board’s learning needs will be unique, but there are several shared attributes for an effective learning program.

• Focus on technology trend lines affecting the company’s industry as opposed to every new technology “shiny object.” Identification of the trends that are materially impacting both the growth and risk profile of the business and sector is the starting point of a learning plan.
• Define the specific, strategy-relevant technologies that the board needs to be conversant in, and build and maintain the board’s learning plan against those requirements. As emerging technologies threaten disruption, reevaluate and supplement the plan accordingly.
• Set the framework and context for individual directors’ commitment and approach to building technology fluency and proficiency.
•  Allow for varying director needs. For example, directors who are not active executives in other organizations may benefit from refreshing their knowledge on core technology functions (like e-commerce and technology infrastructure). Onboarding programs for new directors should include a detailed overview of the firm’s technology capabilities, ambitions, and operations.
• Include programming that uses a range of formats and resources. For example, one Commissioner’s board sets up a series of bimonthly emerging technology webinars for directors—outside of board meetings with nonmandatory attendance—to allow directors to develop a common basis of knowledge in key technologies.
• Build a common technology language for the board and management. This can be achieved through joint external technology trainings or internally delivered sessions, and co-attendance of training can help executives understand the specific barriers to understanding and questions that their board members might pose to them.

An effective learning plan can include resources from the following:

• Third-party subject-matter experts who are vetted to ensure current knowledge
• A technology advisory board of experts to inform and educate the board on emerging, strategically important trends
• Management and other internal subject-matter expert presentations being included into board agendas
• Self-directed technology- and data-related research
• Accredited outside events and conferences that meet standards set by the education program

MOST PROMISING TECHNOLOGIES TO WATCH The White House identified a set of most exciting technology to watch and boards and directors can use this list to guide their own education plans. Advanced Computing Networked Sensing Generative AI Biotechnologies Clean Energy Information Security Technologies Autonomous Systems and Robotics Human-Machine Interfaces Directed Energy Semiconductors and Microelectronics Space Technologies Quantum Computing and Technologies Advanced Engineering and Production Source: 2024 Critical and Emerging Technologies List Update

While it is important for directors to be up to speed on current technologies, it is equally important that they focus their learning on emerging technologies tailored to the industry, stage, or type of company that is relevant to the board. As one Commissioner noted, “Board education should bridge the current to the future.” One approach is bringing external advisors into the boardroom to discuss the emerging technology landscape affecting the organization’s industry. Nearly a quarter of directors report that they leveraged either an external advisor or recruited a director with technology and innovation expertise to the board to help maintain proficiency. [9]

RECOMMENDATION 6: EVALUATE DIRECTOR AND BOARD TECHNOLOGY PROFICIENCY.

Recruitment and evaluation processes should focus on individual directors’ and collective boards’ engagement in continuous learning about the technologies that create value or risk within their enterprises. “Technology change is never ending,” one Commissioner said. “As a result, directors’ commitment to learning and change must be never ending.” Director, committee, and board assessments should incorporate the board’s definition of technology proficiency, and new director recruitment should consider these standards and fill critical skills gaps in the board’s composition.

Revise current evaluation processes to include technology proficiency

Technology proficiency should be built into the board’s individual director and overall evaluation processes. Evaluations of current and incoming directors can be reviewed against expected behaviors and skills that are built around depth of knowledge, engagement, curiosity, and other factors in step with the firm’s strategy. The nominating and governance committee typically leads and maintains this evaluation process.

Many Commissioners noted the value of 360 assessments to help evaluate board knowledge and areas of improvement based on desired skill sets. One Commissioner said that their board “[has] a third party do the 360 assessment every other year,” and that this Commissioner’s board rotates the external providers performing the assessments to prevent bias.

Ensure the board recruitment process considers the necessary level of technology proficiency of new director candidates

As part of its refreshment and assessment policy, the board should define the baseline technology proficiency and experience required from potential new director candidates. Just as every director is expected to understand how to read a balance sheet and other key financial reports, they should now also possess technology proficiency relative to the firm’s needs. Depending on the skills and behaviors the organization needs to fulfill its technology and data ambitions, new directors should be recruited with these skill sets and behaviors to fill in gaps where needed.

The board should have a dynamic talent strategy to ensure it has diversity and depth of relevant knowledge and experience in technology. An ongoing review of the board’s talent mix will ensure an effective board composition while reinforcing a culture of self-reflection about technology blind spots. One Commissioner explained that their board uses a skill matrix to assess technical proficiency of the board, its peers, and for refreshment purposes, and noted that the tool is also valuable for succession planning.

RECRUITING FOR SPECIFIC EXPERTISE Organizations cannot rely on a designated director to serve as the “technology expert” to educate the board on an ad hoc basis. In fact, that may create risks if boards start to overly rely on the expertise of one individual to fulfill its governance duties on technology matters and unduly burdens that director. As one Commissioner observed, “Get someone from Silicon Valley is not a solution to increasing board technology fluency.” Before recruiting to fill a gap in the board’s understanding of technology, consider asking the following questions excerpted and adapted from the NACD-ISA Director’s Handbook on Cyber-Risk Oversight [10]: How are we defining technology expertise? Consider the firm’s needs and strategy and align accordingly. By hiring a director with specific expertise, is the board deferring to one individual a responsibility that the full board should undertake? Might it be more appropriate for the full board to increase their understanding of technology? How does having a single technology expert on the board mesh with the cross-functional technology practices and structures that are becoming increasingly common? Does placing a technology expert on the board set a precedent for assigning seats to other specialized oversight areas?

RECOMMENDATION 7: ENSURE APPROPRIATE AND CLEAR METRICS FOR TECHNOLOGY OVERSIGHT.

Boards and management should partner to review and refine what critical technology information is being provided in board materials. In a recent survey, more than a third of directors reported they receive inadequate metrics to assess the impact of technology on enterprise performance. [11] No two firms’ people, processes, or technologies will execute the same strategy—and all will choose to move at varying speeds based on their strategic needs. Metrics should be aligned with the unique strategic requirements of the firm.

Refine reporting on technology strategy

Boards need greater visibility from management about the organizations’ overall technology readiness and impact. However, management reports must be thoughtfully designed to enable insights into the progress on work without excess granularity. Types of reporting include these, among others:

• Progress metrics tied to time-bound goals (e.g., critical decision milestones, time to launch, etc.)
• Financial metrics (e.g., onetime costs, ongoing costs, budget burn rate, etc.)
• Reviews of current capabilities (changes to technology adoptions, technology road map progress, etc.)
• Reports on the durability of existing “legacy” tech systems (e.g., uptime, error reports, technology debt, etc.)
• Insight into data cleanliness and usability (e.g., volume of mapped data, data anomalies, validity, accessibility, etc.)

Boards should expect transparency from management into the following areas:

• Opportunities and risks associated with adoption, use, and retirement of technologies
• Investments made on technology adoption and returns measured in an appropriate format for the stage of the project
• How technology and data are being used within the company to drive value and links to the organization’s key performance indicators
• Understanding which individuals are ultimately responsible for technologies and data
• Whether the use of technologies and data is measurably trustworthy and aligned to the company’s values
• Whether its technologies and data are secured in alignment with law and regulation, and resilient enough to protect the company’s, shareholders’, and stakeholders’ long-term interests
• How technical debt is being addressed to allow for future innovation and technology adoption [12]

Depending on the organization’s technology oversight structure, this information might be reported into one or more appropriate board committees and reviewed by the full board against the firm’s progress in executing its strategy.

The board should also consider who is presenting the information. If the board is hearing reporting on technology matters only from the CIO, CTO, or other technology executives, this may be an indicator that the CEO and other members of the C-suite are not fully embracing technology as a strategic, enterprise-wide matter. Metrics should also support the information tied to technology incentives for executive compensation.

Prioritize outcome-centered metrics reporting to enable technology innovation

Boards should ensure they are provided with leading indicators to gauge early progress and outcomes of technology-driven innovation. Defining the metrics and dashboard for product pilots or exploratory innovations can set the tone for the initiative—either nurturing or quashing an innovative culture. Commissioners cautioned that innovation metrics that are not customized to the firm’s unique situation, or setting the wrong metrics, such as specific return-on-investment metrics for pilot initiatives, can hinder progress for fledgling high-potential business lines.

As firms pilot new technologies with strategic significance, their board should consider the following types of reporting from management. This information should provide insights to ensure innovation processes are well-managed, consistent, and progressing, and are in alignment with the company’s values—all while allowing the experiment to move ahead.

• Hypotheses for value. Ahead of taking on new projects, the board should work with management to identify the technology use case and value, and how the value will be captured by the organization. For example, consider mining data on emerging customer patterns to identify potential new service offerings. Will the technology that is to be adopted change market share? Will it be disruptive? It is important, however, to remember that hypotheses frequently fail. Boards should expect management to learn from the experiment and move forward.
• Progress against milestones. What has been achieved against the strategic innovation goal that was set for this innovation project? What setbacks have occurred, and how has the timeline adjusted as a result?
• Investment. How much of the allotted budget for the project has been spent, and what returns are projected to come against it? Are these returns considered flat, minimal, significant, or exponential in value? Has our investment outweighed projected returns? If so, what steps, if any, can be made to correct course? “Great R&D teams show experimentation milestones along the way to see if they need to continue and get more funding,” one Commissioner noted.
• New and emerging opportunities. What new business lines or opportunities has the team uncovered? How are other firms in our space, and outside of it, using this technology in ways that could shape our strategy for it? Boards should consider that some nascent technologies might not have immediate impact on current business models but could be hugely disruptive in the future. Consider how innovating ahead of the curve could help the company position itself for success.

Boards and management should continuously return to these metrics and question if they are providing the information they need to spark insights and improve oversight and decision-making.

Develop Foresight

In an environment of rapid technological change, boards need to adopt an explorer’s mindset, becoming curious and asking the right questions at the right times to help management test assumptions and, if needed, chart a new course. Boards need to partner with management to jointly discover the possibilities of overthe-horizon technologies. This report defines foresight as the ability to see around corners, understand which nascent technologies could challenge existing strategies, consider alternatives, and work with management to plan new investments. Recommendations to develop foresight include a robust process to integrate technology considerations into strategy development, the use of exploratory discussions as tools to consider different scenarios and developments, and effective board calendar and agenda management.

RECOMMENDATION 8: RECOGNIZE TECHNOLOGY AS A CORE ELEMENT OF LONG-TERM STRATEGY.

Boards must explicitly recognize technology as a core component of their firms’ long-term strategy. In effect, much of the board’s oversight of technology is now often equivalent to board engagement on strategy. But traditional strategy-setting is disrupted by shrinking horizons and shifting competitive advantages. Boards need to be sure that management is continually assessing the efficacy of current technologies in creating value for the company. This includes the means to identify potential new and disruptive technologies and ensure the organization can innovate and adapt to rapid change in the business environment. By doing so, boards can provide permission for continuous evolution.

To assess the integration of technology into strategy, boards can take the following steps.

Continuously monitor emerging technologies and their implications

The Commission emphasized the importance of setting aside time to focus on emerging technologies—both learning about them and having intentional “blue sky” conversations about impacts on firm strategy, products, and service lines. These discussions should happen more than once a year.

Regularly review emerging competitors, including if and how they change the nature of the firm’s business

When boards review management’s strategy and assumptions against technology changes, they need also to consider how competitors are exploiting those technologies and if they are keeping up with or exceeding the value and pace of the competition. Indicators that might lead to a change in strategy include a competitor’s leading-edge use of a new technology to improve products and services, use of an emerging technology to improve customer service, or a competitor breaking into a new line of business based on proprietary data.

Frequently review management’s technology-and data-driven assumptions underlying strategy

A critical challenge to strategy oversight in the age of technology disruption is that everything is moving all at once, and at a speed far greater than board meetings can keep up with. As such, boards need to carve out time to review and interrogate strategy and underlying assumptions at a cadence that matches the speed of disruptions in the company. For example:

• Examine how management is developing a strategic outlook that scans the horizon for new innovations and systematically links these back to business strategy.
• Review management’s outlook, consider alternatives, and pressure test assumptions about the use and expected value of new technologies and different scenarios, while applying insights the board have drawn from their knowledge, experience, and work on other boards.
• Applying scenario planning and other forecasting tools allows management and the board to collaboratively explore potential risks and opportunities over multiple scenarios and time horizons. “You must be good at strategy, and it must accommodate different technology curves. This makes assumption building and testing even more critical,” one Commissioner noted.

Determine new ways to win through technology and data

Emerging technologies and new and evolving data present possible areas in which to compete, but not every field of play will fit each company’s strategy or purpose. A key element is to review if the firm can make inroads into new areas by prioritizing investments in new technologies, sunsetting technologies or business lines that may be dragging on the business, and determining the trade-offs required to enter the playing field and win. Several Commissioners emphasized that not taking any technology risk was a risk itself. While the continual pace of technology innovation can represent a threat to traditional operating strategies, boards must become more comfortable with innovation being critical to strategy. As one Commissioner said, “Innovation is the ability to see change as an opportunity—not a threat.”

Establish multiple, horizon-based visions on technology to protect future innovation

Commissioners observed that “Big companies tend to quash early projects before they mature. We never let the young things be nurtured . . . and as soon as a crisis occurred it caused the company to cut funding and experimentation focused on longer-term horizons.” It is important to consider multiple time horizons, such as immediate term (the next quarter), short term (the next year), and longer term (three to five years). Boards should recognize the importance of maintaining investments across multiple time horizons and establish policies that protect these investments. For example, one Commissioner suggested that trade-offs only be made within common horizons instead of across horizons. Without this protection, companies will be tempted to prematurely cut off funding for projects in a longer-term horizon that could be the base of the company’s future innovation and competitive edge.

Along with this, well designed executive incentives are critical to driving long-term success around technology strategies. Thoughtfully designed incentive plans that include technology behaviors set accountability for management to achieve both short- and longer-term innovation and value creation. By building in value drivers tied to technology into incentive plans, boards can observe the leadership skills and attributes required to create long-term value.

Review whether the business is prepared to take on new, transformative technology initiatives—and whether it has the right talent to reach the goal

Big strategic plays require investment, leadership, time, and persistence. Before signing off on a significant strategic shift, boards should work closely with management to determine if the firm has the right people, process, technologies, and funds available to meet defined outcomes over a reasonable period. One Commissioner shared that a strategic bet to transform from one company type and strategy to another required the reevaluation of management, board leadership, IT-function talent, and technology debt before the board even signed off on the process.

Technology progress requires high-caliber talent in the C-suite and throughout the organization, and acquiring and retaining the right people can be challenging. The board should review that it has the right management talent in the C-suite to shape the right technology strategy for the firm. The board should ensure that management is identifying and nurturing rising executive talent. Management should also review what retraining, reskilling, and upskilling is planned for the broader workforce to prepare to execute new technology strategies.

RECOMMENDATION 9: ENABLE EXPLORATORY BOARD AND MANAGEMENT TECHNOLOGY DISCUSSIONS

Commissioners noted the importance of a board culture that allows both directors and management to ask candid and forward-looking questions about technology. It is important to create a culture where management and the board are allowed to note that, “We don’t know,” especially around technology evolutions. The Commission recommends that boards ensure a working environment where questioning is expected, and long-held beliefs are challenged.

The Commission identified recommendations that can help boards build their capacity and comfort to have open dialogue about the future of technology and how it fits into the firm’s strategy.

Set the culture for penalty-free discussions

The board chair, CEO, and other board leaders play important roles in setting a “penalty-free culture” for questions about technology and management’s strategic technology assumptions and planning. The leaders should also be mindful of creating an environment where the board and management can pull back from assumptions and challenge concepts that have been long held as “truths.” As one Commissioner stressed, the board meeting is not the place for “gotcha” moments or to unduly test management.

The board chair, lead director, and/or CEO can work together to ensure a dialogue that captures insights from the full board that might otherwise be unvoiced. [13]

Plan “blue sky” conversations

Whether a board chooses a pre-meeting dinner or a strategic off-site meeting for the time and venue, so-called “blue sky” conversations are meant to explore “what-if” scenarios about strategy. Foundational rules for this exercise typically include ignoring current limitations. Particularly within the context of technology-related strategy, it might also be helpful for the board to host a guest speaker about a relevant technology and then have a facilitated set of questions to guide the board and managers through “what-if” questions. The goal is to imagine a new future, move to a phase of questioning why it might be possible—and why not—and eventually decide if the idea could be incorporated into longer-term strategic plans.

Permit early experiments

Boards should expect their management teams to experiment with new technologies, engage with members of the technology or innovation ecosystem, and present lessons learned to the board about potential opportunities or risks. Boards should be open to unanticipated findings and potentially counterintuitive recommendations from management. As one Commissioner noted, the board’s approach to these topics and the focus of discussions with management are vital to setting the “permission” and guardrails to explore new technology strategies.

RECOMMENDATION 10: DESIGN BOARD CALENDARS AND AGENDAS TO ENSURE APPROPRIATE FOCUS ON FORWARD-LOOKING DISCUSSIONS.

Boards must revisit how they set their annual board calendars and meeting agendas to allow for robust discussions and decisions about technology. Commissioners observed that current agendas are too crowded and focused on backward-looking discussions with little time for forward-looking conversations about technology and strategy. One Commissioner stated that the “biggest challenge is carving out the appropriate bandwidth and time and space to have the right conversations.” The Commission identified ways in which the board could create this additional space while continuing to fulfill their overall expanding board responsibilities.

Establish a new agenda approach for the annual board calendar

Boards should continuously recalibrate the agenda and time commitment expectations for the agenda year and allocate time for technology and innovation strategy, risk, and oversight discussions. For example, using last year’s agenda and calendar as a framework, one board color-coded agenda items to understand how much time is dedicated to hindsight and foresight, and what the percentage looks like for both. This data allowed them to recalibrate the overall approach to the annual board agenda setting process. Other boards embed conversations about technology strategy throughout the year, as well as at strategy off-site meetings. In this way, the board avoids a significant time gap between strategy reviews and annual plans.

The board can work with the corporate secretary to review what changes can be made to the board calendar within the confines of listing and regulatory standards, among other requirements.

Refine individual meeting agendas

Board leaders should work to design meeting agendas that reserve sufficient space and time for technology discussion and oversight. Board and committee chairs can drive real change through rigorous agenda setting and assessment of critical and necessary information flows and decisions. This will ensure movement away from procedural, check-the-box compliance conversations and toward discussion and outcomes on critical technology issues. One approach is “zero-based board agenda setting.” This strategy asks the board, if we had to throw out our typical meeting agenda model and create a new one, what would it look like? The zero-based approach allows directors to identify where technology and data discussions belong in the board agenda to enable meaningful conversations.

Boards can also explore willingness to host more ad hoc meetings between formally scheduled meetings to address governance matters when they arise. The same goes for interactions with management as needed.

Link to full report can be found here.

---

1NACD, The Future of the American Board (Arlington, VA: NACD, 2022), p. 17 in the full report.(go back)

2World Economic Forum, Earning Digital Trust: Decision-Making for Trustworthy Technologies, November 2022.(go back)

3NACD, The Future of the American Board (Arlington, VA: NACD, 2022), p. 29 in the full report.(go back)

4See also, “Boards Need a New Approach to Technology,” Tarun Khanna, Mary C. Berkerle and Nabil Y. Sakkab, Harvard Business Review, September–October 2024 issue.(go back)

5See the definition of “data governance” in the Glossary available at csrc.nist.gov.(go back)

6For more on the board’s role in data governance, see NACD’s Director Essentials: Data Governance and Oversight (Arlington, VA: NACD, 2024).(go back)

7According to NACD’s 2024 Board Practices and Oversight survey, only 12 percent of respondents claimed to have assigned clearly defined roles to the board to ensure technology oversight within the past 12 months. Data reflects responses from both the Public Company and Private Company surveys.(go back)

8Figures represent data from privately held and publicly traded companies and can be found in the 2024 Private Company Board Practices and Oversight Survey and the 2024 Public Company Board Practices and Oversight Survey.(go back)

9Figures represent data from privately held and publicly traded companies and can be found in the 2024 Private Company Board Practices and Oversight Survey and the 2024 Public Company Board Practices and Oversight Survey.(go back)

10For more information, see the Director’s Handbook on Cyber-Risk Oversight (Arlington, VA: NACD, 2023).(go back)

11Figures represent data from privately held and publicly traded companies and can be found in the 2024 Private Company Board Practices and Oversight Survey and the 2024 Public Company Board Practices and Oversight Survey.(go back)

12Gartner defines technical debt as follows: “Technical debt is accrued work that is ‘owed’ to an IT system, and it is a normal and unavoidable side effect of software engineering. Teams ‘borrow’ against quality by making sacrifices, taking short cuts, or using workarounds to meet delivery deadlines.” For a fuller definition, visit https://www.gartner.com/en/information-technology/glossary/technical-debt.(go back)

131 Directors seeking further guidance on culture can consult the 2023 Report of the Blue Ribbon Commission on Culture as the Foundation: Building a High-Performance Board.(go back)