Audit committees exist to flag dangers. And they are seeing a new series of threats to enterprise looming ahead in the next year.
Egon Zehnder gathered two groups of audit chairs from some of the country’s largest companies, spanning multiple industries, for teleconference calls in June to discuss the ways in which COVID-19 has impacted their work. Many raised concerns about enterprise risks that are emerging from the pandemic – and the pandemic response.
Most pressing, committee members said, is the COVID-created cyber security hazard. While relocating workers into home offices was a necessary safety measure at the start of the pandemic, now the security dangers are emerging as a substantial exposure.
Hackers are taking advantage of the global business disruption. “There’s been a discernable uptick in attacks, such a phishing” said one board member. The board has been briefed on a series of “near misses” in which infiltrators gained entry but were thwarted by internal controls, he said.
The remote workforce remains a vulnerability, said another who is on the board of a company with more than 100 million members in its customer base. The move to home offices exposed the firm. “There is so much personal information. It was hard enough to control in call centers. Once you push all that out into people’s homes, the risk goes up exponentially,” he said.
Another agreed, listing home office printers and laptops as a rising security issue. “People are printing and saving on their hard drives at home. They can’t use a VPN because of technical difficulties. Internet services aren’t that great. We have to remind people to clean their hard drives because they’re vulnerable to intrusion. It’s a big issue for us.”
In addition to outside actors, companies need to be on the lookout for security risks from within. With remote work still the norm for many companies, audit committee members say enterprises can’t rely on traditional methods to notice disgruntled employees. “When you’re not able to pick up on the normal cues, how do you find the internal problems?’ said one.
Another looming source of concern: eager regulators. Audit chairs report governmental authorities, empowered to take steps to protect health and safety, are flexing their muscles and pressuring companies in new ways.
“We’re seeing regulatory creep because we do a lot of business in China,” said one. “We’ve had calls from the White House about selling in China. The White House is not happy about this.”
Another board member worried about the ripple effects of governments taking on more power. “Government has gotten back to regulating more than they used to,” he said. “It harkens back to periods when governments overstepped and created a backlash.” As an example, this board member cited ex-New York City Mayor Michael Bloomberg’s efforts to regulate soda sizes in city restaurants. “That kind of outlook could lead to more regulatory risk in social and work environments,” the board member said.
To be sure, some notable positives emerged from the lockdown. The use of remote meetings expanded participation and laid the groundwork for exploration into new work habits. “Using Zoom for everything meant we could include a whole bunch of people who wouldn’t necessarily travel for a board meeting,” said one. “It allowed the board to be more inclusive.”
The completion of a full virtual quarter proved inspirational, said another. “It opened up a number of opportunities,” she said. “Things we were fearful about in the past are now not as scary.”
But while initial remote work proved successful, now it is showing its challenges. The lack of regular contact, in meetings and less formal settings, is limiting to professional advancement. “You can have a job working from home, but I’m not sure you can have a career working from home,” said one board member.
Looking ahead, audit chairs expect a period of near-term turbulence and hard decisions. Companies will need to take action regarding staffing levels and compensation in light of the new economic realities. Many have had to close operations. Some will have to make “quick, hard decisions,” said one. The questions will be challenging ones. “What is the reputational impact on how we treat our people now? What can we afford? What is the right thing to do?” she said.
Almost everyone has seen business drop and that will have impact going forward, said another. “We’re going to have some really hard calls to make. The next quarter or two, there will be really tough conversations at the board level.”
