For the Board, the Right Kind of Filters

For the Board, the Right Kind of Filters

In my role, I have seen board members get frustrated when they get lengthy reports. And if something serious goes wrong, the board chairman might ask the CEO: ‘Why didn't you tell us?’, to which, a CEO might respond: ‘Well, it was flagged on page 8 of the risk update last quarter’. After which, the chairman might say: ‘We are going to need a better way of handling information being sent to the board; few of us appreciated that it was going to blow up in the way it did’.

Here, there is a dilemma to resolve: on the one hand, the board has been ‘spooked’, so there is an interest in receiving more information. But, on the other hand, the board is often overwhelmed with information. So, how might the quantity of information presented to the board be reduced while not losing the critical warning signs?

One large organisation I worked with had a finance and business reporting department that produced pages of information every month detailing financial and customer data, and progress reports on more than a dozen significant change projects.

This information and data were supplemented by a quarterly risk report covering the status of around 30 key organisational risks. But it was clear that board members were getting tired of what they were receiving. Also, the executive was finding they were getting questions from the board on details they genuinely didn't think were important. However, they felt obliged to deal with them, so they did not come across as defensive.

It was agreed to start using a new risk rating scale using the Failure Mode and Effects Analysis (FMEA) framework to strike the right balance.[12] This risk rating framework challenges decision‐makers to be more discerning in relation to what is really important.[13]

Applying the FMEA rating scale helped us identify the risks most critical to this organisation’s survival. We were able to halve the number receiving regular board attention. For the remaining risks, we clarified what early warning signs (e.g. KRIs) we should track to see if the risks might earn more executive, or board, attention in the future.

Thus, it was agreed that if there was a risk with a dangerously high impact, then, even if it's very unlikely to go wrong, senior executives and the board needed to know it was on someone's radar screen. They also need to understand what will trigger the next update regarding how it was being managed. The aim was to avoid a common problem; a risk arises that management hope they can fix without ‘making a big deal of it’ to more senior executives. But sometimes, they find they can't resolve it the way they hoped. At which point, senior management and the board get a nasty surprise, often worse than if they had been involved earlier.[14]

[Table 5.2] is described as filtering issues by impact and likelihood: a sufficiently high-impact risk could require executive reporting even with a remote likelihood (less than 5%).[15]

Table 5.2 Disciplined filtering upwards including FMEA ratings

The table itself is not reproduced in this excerpt; the description below gives examples of its thresholds.

The table shows a matrix with impact levels (Very High, High, Medium, Low) and likelihood levels (Almost Certain, Likely, Possible, Unlikely, Remote). For each combination, it indicates whether the risk is reported to the executive team, board, or both. For example, a risk with Very High impact and Remote likelihood is reported to the executive team, while a risk with Very High impact and Almost Certain likelihood is reported to both.