Abstract

Boards must make sure they abide by their regulated agenda, while steering clear of a checklist mentality and, most importantly, determine what they will spend their time on.

How does a board go about determining its scope?

Charles M. Elson: First of all, a board's scope is legally determined. The board has a duty of care, which is to effectively monitor management for the benefit of the shareholder.

What do I mean by monitor? The monitoring role is two-fold. Phase one includes identifying the company strategy. Where is the company heading long term? Obviously that is something that management formulates with the board, and that the board must continually review. Phase two deals with how good a job management is doing in implementing that strategy. In short, is it headed in the right direction? And is it doing so effectively?

Those two obligations will shape the rest of the agenda and, in essence, dictate how the board functions. It is not there to micromanage, it is not there to run the company day to day, nor is it there simply as a policymaking body to set general policy or to support management's general policy. It is there to review policy, review how that policy is being implemented, and review operations. The board must set its agenda around the goals of policy review, strategic direction and operational monitoring, which collectively determine how board meetings should proceed.

Garrett L. Stauffer: Before a board can establish the scope of its agenda, it must understand the environment it is in. It has to understand the risks the company faces, it has to understand the regulatory requirements, it has to understand the strengths and weaknesses of management and the board and it has to understand the agenda of its investors. Once it puts those together, the board, with full consideration of the statutes that apply to it and the requirements that the articles of incorporation place on it, can sit back and formulate an agenda.

Jay W. Lorsch: It depends on how the word agenda is used. Typically, that term refers to the docket of a particular meeting. The law is pretty broad and unspecific about what boards are supposed to do. The Delaware statute basically says the board's duty is to manage the corporation, although it may delegate that responsibility to the officers. And then there are things like the business judgment rule, but that is also very broad. Some responsibilities are defined in the corporate bylaws or the corporate charter, some are within the board's latitude to effect - and it is in that regard that directors really need to think carefully about their role.

I agree that much of deciding scope has to do with the company's situation, but boards also have to determine the extent to which they are going to be an active participant with management in making decisions and the extent to which they want to be a watchdog. They need to figure out which decisions they will be involved in and which decisions they will leave to management, and how far down the line they want to act as a monitor. Do they want to monitor the results of every business unit in the corporation, or do they just want to look at total corporate performance? These are choices boards make and should make. My concern, frankly, is that most boards don't think about it. They just go in and do what they did last year and the year before, and they're caught in a rut.

Steven N. Kaplan: I agree with Jay, and I'd like to expand the point a bit. There is the monitoring piece of the board's scope, which Charles mentioned, as well as the advising piece, which Jay mentioned. Sometimes they conflict, sometimes they are complementary; it's tricky to manage.

The advisory role is a constant. Sometimes people say what the board should do is situation-specific. I think it should be less situation-specific than perhaps it is.

Boards often get more involved during a crisis, but they can create more value by getting involved when things are good rather than waiting for a crisis when a lot of value may already have been destroyed. The board's scope is constant diligence, constant advising and constant monitoring. The board's scope is nose in, fingers out. It should be looking at everything, helping where it can, monitoring where it must, but not running the company.

Audit committee responsibilities have greatly increased. The phenomenon of the "audit creep" is making it more difficult for audit committee members to oversee effectively all that is on their plate, as new items are continually added to the committee agenda. What is the secret of the best-run audit committees?

Stauffer: Hard work. You are right, audit committee members are under a lot of stress with the new requirements and are spending much more time and meeting more frequently to accomplish their tasks. The question is, "How do they do all this and still maintain a normal lifestyle?"

First of all, you have to ask, "Is the audit committee overseeing things that it shouldn't be?" Over the years, audit committees have assumed more responsibilities that are outside the financial areas of the company. Compliance areas such as health, safety and environment have sometimes been pushed onto the audit committee's plate. It's time to remove them so the committee can focus on just the meat that it must deal with - auditing financial statements, internal controls, and handling all the communications and financial information that goes on in corporate America. So how do you do that, and how do you draw some reasonableness around the time needed to do that?

To start, the director of internal audit should be the audit committee's best friend. That person becomes the eyes and ears of the audit committee on a day-to-day basis. As that relationship strengthens, the audit committee will gain information and capabilities that it did not draw on before.

There also has to be a stronger relationship with external auditors and substantial participation by them in meetings. As we all know, the audit committee is now responsible for hiring and firing the auditors and determining their fees. This puts an auditor in a different position, and that relationship must be strong so that the audit committee can count on the auditors to provide them with all the necessary information and insights.

One other tool that is a leading practice and can be used at the board level is an annual meeting planner. There are so many things that must be covered by an audit committee due to the Sarbanes-Oxley Act that I fear it becomes form over substance. An item is checked off because it was covered in a two-minute discussion when, in reality, that item may have required an hour of discussion. This happens due to poor planning. Certain things must take place during certain periods of time by an audit committee. If that process and those time requirements are laid out in a proper meeting planner, it will keep the audit committee on track and keep it from going to a checkthe- box approach.

Lorsch: Much of what has been said is correct. There is no question that Sarbanes-Oxley has required audit committee members to spend more time on their duties and to meet more often. It has also raised audit fees. All this extra work may be in the interest of protecting shareholders and providing more assurance that the financial statements are accurate and transparent, and that is probably to the good. As we gradually get more comfortable with what is being asked of audit committees, we're going to find that the time spent is going to diminish as people figure out better ways of managing the auditor relationship.

The thing that really needs to be worked through is Section 404. It's expensive. Over the last few weeks, I've interviewed 10 audit committee chairmen to try to get a sense of what is going on, and the news is pretty good. People feel like Sarbanes-Oxley may actually turn out to be a good thing, but they are still concerned about Section 404. The term mentioned, audit creep, is an interesting point. If the board can't figure out where to put something, there is a tendency to put it on the audit committee, and that requires some thought on the part of the other directors about whether or not these additional responsibilities must go to the audit committee or perhaps to a finance committee.

Kaplan: The audit committee's responsibilities will become less of a burden. When something changes, initially you put a lot of energy into it, and then you figure it out, so I'm optimistic that time and costs will go down.

First, there is a size issue that we have not yet talked about. There is a difference between multidivisional, multibillion-dollar companies and middle-market or smaller companies where you can get a better sense of what is going on inside the company and where there's less unknown. At both big and small companies, the best-run audit committees must start off with a CFO and an auditor that they trust, which may be a funny thing for an economist to say. It's important that you believe the CFO and auditor are doing the right thing, and that is a bit easier now because the outside auditor reports to the audit committee chairperson, thus he or she is naturally going to be more loyal and more open to the audit committee chairman than the CFO.

Second, what do audit committees do? They work through the processes with the auditor and the CFO. Sarbanes-Oxley has been positive in the sense that companies are going through their processes and understanding the business better than they did in the past. Audit costs are up, but on the other hand, you are getting new information, and some of that will turn out to be valuable.

Elson: I'd like to second everything that has been said. We've had some very perceptive views of the audit committee and its future. Prior to Sarbanes-Oxley, the audit committee chairman had a very important job - setting the committee's tone and agenda. Today it is a different story. With Sarbanes-Oxley, the audit committee's tasks and responsibilities have become federally mandated. The committee's agenda then is primarily dictated by federal law and from that perspective, there isn't much wiggle room for the committee chair, which is both good and bad. If you assume that the requirements of form lead to a better audit, then requiring everyone to go through the same form makes sense.

Our research reflects that the audit committee will see no relief as a result of Section 404. In fact, audit committees will face many challenges that will take more time and a lot more energy. What are your thoughts on Section 404 and the impending burden it places on directors?

Elson: The intent of Section 404 is to ensure that a company's internal controls are appropriate, and a review of internal controls is viewed as the way to do that. Unfortunately, that opens a massive can of worms because once you begin evaluating internal controls, the questions that come out of that review must be addressed, and no company is going to walk away from that saying everything is fine. Any time you review internal controls, something will be discovered. A telling sign is that new firms are emerging to advise companies on Section 404, which suggests that there is a lot of work to do. When these advisory firms come back with their recommendations, it will be a lot for the audit committee to review and consider. The Section 404 review is not an end in and of itself. It is the beginning, frankly, and the cost and time that it requires will be substantial. The big question is, once that review has taken place and problems have been identified, will the solutions result in a better audit and in better controls, or are we in just another form-oversubstance review? I do know it will not be cheap, and it certainly will not be quick. It will be a challenge for everyone involved.

Kaplan: We just don't know what the effects of Section 404 will be, and that it is definitely a concern. The first concern is cost. There will be a lot of onetime costs, but the ongoing costs should be much lower. I'm assuming there are going to be some ongoing benefits as a result of Section 404. The second point is that the SEC and Public Company Accounting Oversight Board commissioners are aware of the challenges and if they become worse, then there will be some regulatory help. I would like to think that there would be, at any rate.

Lorsch: The difficulty in complying with Section 404, which is still a moving target to some extent, depends on the company. I just spoke with an accounting audit committee chairman who said, "We have a relatively good set of controls; the whole thing wasn't a big problem for us." But if you are running a company with inadequate controls, you've got a bigger problem. The larger companies presumably have better control systems, are in better shape, and will not find Section 404 so onerous. The companies that will really struggle with it are those without adequate controls. You may be getting complaints from them, but the fact is, maybe it's a good thing that they are complaining because they are fixing a problem that should have been fixed. Yes, it is going to cost money, there is no question about it, and it is going to be difficult - but once you get it right, it will be more manageable.

Stauffer: From a first-year perspective, I think Section 404 is bigger than most people realized. I had a conversation with a controller of a Fortune 50 company who said it very well: "The more you know about 404, the bigger it gets. The more you know about 404, the less control you have." What is taking place for the first time in most of these companies, outside financial institutions that have had the fiduciary requirements for many years, is a deep dive into their internal control environment.

Control environments aren't developed overnight. They develop over 10, 15, 20 years; they develop through a number of different CEOs and CFOs, a number of different acquisitions, a number of different systems changes, and a number of different internal auditors and controllers. To put a stake in the ground and measure control environments at a specific point in time on a deep-dive basis will result in more concerns than people are actually focused on now.

One reason for that is the standard itself puts a very low hurdle on some of the areas that can trip you into an ineffective system over internal controls. So I agree that the larger companies have it a bit easier. Many of them are well controlled, which will help, although even they wouldn't be devoid of having potential problems in their systems of internal controls. The small to medium-size companies, the ones that either don't have internal audit departments or have small internal audit departments and haven't spent a lot of time developing good control environments, clearly will suffer in the early stages of developing controls and putting them into a proper framework. Time will tell, but if a company hasn't yet started the process, it will regret it because we are within seven to eight months of the deadline for completing the process, and there is a lot of work to be done.

Surveys show that original estimates of time spent on this effort have more than doubled in a number of situations. It's a big animal, though, and I think it will settle down after we get through the first few years. The idea is to find your control weaknesses, remediate them, and then you will have a good, strong control environment, which should make life easier as companies move forward. But early in the process is when there will be some surprises that people just aren't ready for.

As you look into the future at the effects of corporate reform, what concerns you the most? Will the checklist mentality put boards in a situation where they are not spending enough time on strategy? Will corporate reform end up pushing the board and management further apart?

Lorsch: There is no sense in sitting around, rubbing one's hands together and saying, "Woe is me, Sarbanes-Oxley is a bad thing," or "The new listing requirements are a bad thing." They have imposed additional work on boards, there is no question about that.

But they have also had a positive effect in that they have enhanced the board's power vis-à-vis management fairly clearly. With this empowered audit committee that Sarbanes-Oxley has created, any CEO who doesn't think the board is responsible for auditing and monitoring financial performance has his or her head in the sand.

There have been some good things happening, but boards are being asked to do more, and in order to get that extra work done or to do the same thing more carefully, whichever way you choose to think about it, boards need to be much better designed to use the limited time they have together. They need to be sure they have adequate information and are focused on the right roles and activities to get the job done. I'm worried because boards have never done that, and I think they need to.

The other thing that worries me is that we have a situation in which there is no question that if you look at who has the power and influence in the American system of corporate governance, the board's role has been enhanced. Shareholders are now complaining about that enhanced power, and the way they are gaining control can be counterproductive. Take, for example, the vote against Warren Buffet at Coca-Cola.

There are some crazy metrics out there. In that regard, ISS [International Shareholder Services] is as bad as any. It is measuring things that don't have a thing to do - or have very little to do - with board performance. Why? Because it can uncover them by reading proxy statements, annual reports and so forth. If you get boards and corporate secretaries focused on these things, you are wasting everyone's time because they have very little to do with what makes boards effective.

It worries me that the institutional investors feel disenfranchised and disempowered. It also worries me that they are continuing to pursue this really unproductive path to board improvement. In the end, they are doing the only thing they can, and I understand that; but it gets boards focused in the wrong direction.

Another thing I worry about is, given the American capital system where we have changing ownership and large institutional ownership by basically anonymous owners, can we find more constructive and positive ways for shareholders to express their voice rather than just sort of shaking trees and trying to irritate the board and management to see if they can get their attention?

Kaplan: I agree with Jay. Sarbanes-Oxley and the new listing guidelines have enhanced the board's power. The good provisions are those where you have a specific outcome or a process, but you also have a lot of leeway as to what you do within that process.

For example, executive sessions are required, but what you do in them is up to you. Signing off and certifying financial statements is required, but how you get there is up to you. The audit committee chair is responsible for hiring the auditor and has more power and should be able to do what he or she wants to do in that situation, which is good because it would have been very hard to get that to happen without an outside voice telling company management to do so.

As an example, Jack Welch, former chairman and CEO at General Electric, was once asked, "Would you have ever let your board meet in executive session?" He was quoted as saying, "No. The second they told me they wanted to meet without me, they would be telling me they don't trust me, and I'd resign." And so being told that you have to do this gives you cover to allow you to do it and break the equilibrium that you might have had.

The bottom line is that many of the provisions tell you to do something, but don't tell you exactly what you have to do in every situation. Overall, these have been positive and have enhanced the board's power.

Elson: The positive has been the broad acceptance in the last few years of the idea that an independent, longterm, equity-holding board as a counterweight to management makes some sense and that the way to create good monitoring on the part of the board and longterm, productive relationships with management comes from the idea of director independence and director ownership. They are both critical. And as you look at all the reforms, that's really the core.

That being said, there is a problem with form over substance that has gone hand in hand with these developments. Whether it's the listing standards or Sarbanes- Oxley or even some of the guidelines, they encourage people to look at the form. "Oh, we're complying with the ISS recommendations as to form, we must be OK. We got a high rating and we complied with the form, isn't that great?" Well, the issue wasn't complying with the form, it was the spirit behind the form, and if you are wrapped up in checking off boxes without understanding what they really mean and how each box is assembled into the broader picture, then you have gone far astray. But I'm heartened by the general direction we're moving in.

Stauffer: I pretty much agree with everyone. I'll focus on one area that concerns me that really comes out of the form-over-substance issue.

I don't believe you can rate a board unless you can sit in and watch it work - see the directors, hear the challenging and tough questions they ask, or see if they just sit back and listen and nod and raise their hand to vote yes. So rating concepts and rating boards based on form, as Charles has said, troubles me because you may have met the form or you may not have met the form, yet your board is the most challenging, thoughtful board out there.

That also raises the issue of when you get the independence, do you lose the knowledge of the business? Are you taking away knowledge from the board relative to the business and industry that it is in? Directors may not be as informed as they once were, and that concerns me. Not that the board shouldn't follow an independent process, but there is the fear that you are going to get marked down due to having a director who may not be viewed as independent.

And then the last thing we saw early on, and I'm still not sure we're over it yet, is the risk issue. The lack of willingness to take risk is a result of everything that has come down the ladder over the last year and a half, and early on, that was especially the case. There are some comforting signs that indicate that the willingness may be waning, but I'm not convinced we are out of the realm yet and that people are willing to take the necessary business risks, given the current outcomes and the shareholder activist groups, and the ratings and concerns they place on boards.

About the Author

Charles M. Elson, The Edgar S. Woolard, Jr. Chair of Corporate Governance, John L. Weinberg Center for Corporate Governance, University of Delaware

Jay W. Lorsch, Louis E. Kirstein Professor of Human Relations, Harvard Business School, Harvard University

Garrett L. Stauffer, Partner and US Leader for Corporate Governance, Pricewaterhouse Coopers LLP

Steven N. Kaplan, Neubauer Family Professor of Entrepreneurship and Finance, Graduate School of Business, University of Chicago

T.K. Kerstetter, Corporate Board Member

Acknowledgment

Reprinted with permission. This discussion first appeared in the Corporate Board Member's 2004 Academic Council Supplement, Emerging Trends in Corporate Governance.