Corporate governance during a crisis: board responsibilities and areas of focus

Specific board actions will vary, depending on the size and general nature of the business, its industry, geographic location and countless other variables. Likewise, the particular areas in which the board is most actively involved will vary from one organization to the next. In general, however, the specific areas of board responsibility can be organized into three groups, beginning with those areas where directors traditionally exercise the closest and most direct supervision: financial management, financial reporting and risk management.

Financial management

Board members should take special care to understand how the pandemic and the resulting economic shutdown are affecting the financial strength of the organization. This includes closely monitoring the organization’s cash reserves and assessing how they will change depending on the degree to which the organization is able to continue basic operations. Directors also should review the organization’s overall capitalization plan, cash sources and needs, available lines of credit and any upcoming debt service requirements and loan covenants.

The best time to undertake aggressive steps to deal with financial distress is when the organization still has flexibility and options, such as modifying dividend strategies or taking other steps to preserve the organization’s cash position. It also could be prudent to bring in qualified legal and financial professionals to help develop a more comprehensive strategy, and to help directors understand their specific fiduciary duties in these circumstances.

Financial reporting and disclosures

The board of directors has a clearly defined legal responsibility to provide adequate disclosures about what the organization knows regarding the ongoing impact of the pandemic on its operations and financial stability. Specifically, the board should focus on the logic behind and support for key estimates and assumptions. This is most obvious in the case of publicly traded companies with mandated Securities and Exchange Commission (SEC) filings, but directors also have comparable responsibilities to shareholders or prospective investors in privately held organizations.

Directors should inquire of management about the effectiveness of the control environment and whether there have been changes or overrides that could negatively impact the financial close and reporting process.(1) They also should confirm that management has reviewed the organization’s risk appetite and enterprise risk management program and understand any adjustments made.

The board of directors should carefully review all public management discussions, earnings guidance, financial statements and other relevant documents to be sure they appropriately disclose known risks, trends and uncertainties. They should pay particular attention to any updates or guidance with regard to compliance with the Coronavirus Aid, Relief, and Economic Security (CARES) Act and other stimulus programs. Boards also should assess whether current circumstances merit an update to any earlier guidance, and should review any cautionary language for forward-looking statements.

Risk management

For many organizations, the COVID-19 crisis could have an impact on the functioning of internal controls and audit processes. In public companies, any material changes in internal control over financial reporting will require disclosure in the next periodic report. The coronavirus shutdown is also likely to increase an organization’s vulnerability to criminal activity, so directors should question management directly about what steps they are taking to assure data security, particularly if employees are now working remotely.

In addition to reviewing the organization’s overall exposure to fraud, and maintaining necessary controls and insurance coverage, board members also should review their own indemnity agreements along with the terms and limits of their directors’ and officers’ liability insurance to confirm sufficient coverage.

Beyond the financial management, reporting and risk management functions where boards traditionally exercise close control, there is a second group of more general issues where boards also must be involved in responding to the coronavirus pandemic. These issues relate to various business continuity concerns, including employee wellbeing, operations and supply chain management.

Employee health and safety

Boards and executive teams alike should take care to set a tone of concern at the top, with messages and policies designed to protect the health and safety of employees and their families, not to mention their customers, suppliers and the public at large. Depending on the nature of the organization’s operations, consider the need for protocols for testing employees for exposure to the virus, along with plans for responding if employees test positive.

Directors have a clear responsibility to monitor management’s consideration of both the financial and health effects of various responses such as layoffs, furloughs, staggered shifts and total or partial shutdowns. In addition to inquiring about the adequacy of the technology infrastructure, security and data management systems that let employees work remotely, board members also should inquire about any adjustments that may be needed to supervisory and compensation programs to reflect the current work environment. 

Operations

Boards always bear responsibility for monitoring management’s efforts to identify, prioritize and manage potentially significant risks to business operations. In the specific case of the COVID-19 outbreak, directors should satisfy themselves that management is adapting to the crisis appropriately, changing processes, products and services as necessary, staying engaged with customers and continuing to meet contractual obligations.

Board members also would be wise to seek more frequent updates from management between regularly scheduled board meetings. Depending on the nature of the organization, this might be handled by the audit or risk committee, or it could be undertaken by the full board.

Supply chain and logistics

While management works to respond to any immediate supply chain disruptions that could interrupt operations, boards also should ask management to review and report on relevant language in both supplier and customer contracts, including force majeure, default and termination provisions to determine available recourse.

In the longer term, it also might be prudent to support a broader, more comprehensive review of sourcing strategies and general supply chain issues. High on the list of concerns is the identification of alternate sources of supply, particularly for businesses that are heavily dependent on overseas suppliers whose resilience and stability were challenged by the virus. Such an overall re-evaluation of sourcing strategies could be essential to mitigate future risk.

Strategic goals and objectives

There are some organizations who will not survive this crisis, others will persevere through a long and difficult recovery period, while others will prosper and emerge stronger and more resilient. Boards should ensure that executive leadership has their finger on the pulse and is properly managing the organization’s strategic goals and objectives. Organizational strategy may require a complete facelift, redesign, slight revision or no change at all. Those organizations that make the right choices will endure.

Another general area of board involvement and supervision relates to concerns that are specific to the coronavirus crisis itself, such as compliance with shutdown orders and participation in various stimulus and recovery programs.

Virus-specific regulations

Board members should be especially careful to avoid trying to micromanage the company’s response to various local, state and federal shutdown orders. Boards are not structured to respond rapidly to continually changing rules. At the same time, however, directors should continue to monitor management’s overall response to the relevant orders and see to it that those charged with specific responsibility for compliance have the support and resources they need.

Stimulus and recovery programs

Here again, the specific requirements of the CARES Act and other stimulus programs vary widely and change frequently, making active board participation impractical. Nevertheless, board members should familiarize themselves with the various application deadlines and qualifications, as well as specific employment-level requirements, reporting milestones and other particulars related to qualifying for loan forgiveness or other benefits, and should verify that management actively manages its participation in such programs.

In addition to addressing these various areas of focus, boards should also continue to practice basic good governance. Above all, they should contemporaneously document everything, taking special care to verify that board minutes and other materials demonstrate their careful consideration of the relevant issues and risks, and that their actions are consistent with the company’s public disclosures. This may help earn cooperation with regulators.

Finally, as the economic crisis evolves over the coming months, directors and executive teams alike should start thinking about how well their organizations’ crisis management plans functioned in the face of this unprecedented – and largely unanticipated – challenge. In time, as the immediate damage caused by the pandemic is mitigated, boards in all types of organizations will need to review what worked, what didn’t and what other steps they can take to be better prepared for the next crisis – whatever its cause and nature may be.

For more on compliance and crisis management from Jonathan Marks, download his e-book “The continued evolution of best practices for compliance programs” here.

(1) The Committee of Sponsoring Organizations of the Treadway Commission (COSO) defines control environment as “the set of standards, processes, and structures that provide the basis for carrying out internal control across the organization.” The COSO framework goes on to note that “the board of directors and senior management establish the tone at the top regarding the importance of internal control including expected standards of conduct.”