Reporting on risk to the board of directors: Finding the right altitude

  • ServiceNow Blog
  • 2019
  • Now on Now
  • Solutions
September 10, 2019

Two ServiceNow leaders explore the approach of giving board members the right level of information when reporting on risk

The regulatory and compliance landscape has been an ever-moving target, and growing in complexity. Organizations are dealing with cybersecurity, data privacy (General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA), third-party risk, and government contracts to name a few. The complexity of providing governance over these critical areas has drastically expanded as organizations extend the boundaries of their environment to areas outside of their direct control.

This heightens overall corporate risk and exposure and has become a persistent topic among executive staffs and board of directors. Take cybersecurity. A cyberthreat can happen anywhere within or outside the organization. As we’ve seen in recent news headlines, a single attack or breach can wreak havoc, resulting in the loss of revenue and goodwill, regulatory inquiries and fines, and stock price declines. Board members are asking what measures the organization is taking to prevent, detect, and respond to attacks and how they are abiding by regulatory and compliance requirements.

Ben de Bont, Chief Information Security Officer (CISO), and Andrew Wheatley, ServiceNow’s VP, Audit, Risk, and Compliance, talk about their approaches to reporting to the board of directors recently as they prepare for an upcoming Now on Now webinar, “Threading the needle - Presenting risk to the board of directors,” on Thurs., Sept. 19, 9 am PT/noon ET.

Ben and Andrew share insights
Ben joined ServiceNow as CISO in July; Andrew has been regularly reporting on audit and compliance to the board during his five years working at ServiceNow.

Andrew: Ben, on your second day at ServiceNow, you attended the board of directors meeting and saw our security, risk, and compliance update to the board. What did you think? Anything you would do differently?

Ben: The presentation had key elements necessary for a successful narrative: messaging was concise and relevant, structured to a common framework, and supported by the right level of data. When you can communicate risk consistently to a board, the narrative is more likely to be meaningful and resonate with the audience. This was very much the case in my first board meeting at ServiceNow.

Andrew: It’s easy to go deep into the weeds. We love data, so we like to talk about how many vulnerabilities we identified and how fast we resolved them or our compliance using controls. But the board really wants to hear about outcomes and trends so they can see the program maturing over time.

Ben: Andrew, I agree. When possible, the conversation should be kept at a high-level to avoid us tumbling down a rabbit hole and dwelling on a single issue that eats up precious time. It’s important to stick to the key narrative, but have details ready in your hip pocket if needed. Introducing new initiatives or data can be tricky, so always ensure you have a consistent format, and understand your audience.

Andrew: I like that adage: know your audience. Our board members bring a remarkable business acumen. They look at risk and compliance from the business perspective. We need to show them how issues impact the business as a whole and how we are protecting against risks. I want them to understand and validate our compliance strategy, raise their concerns, and, then buy into our vision of success. We all want the same thing: for ServiceNow to be successful in managing risk.

Ben: I find that the most interesting comments often come from board members that serve on other boards. They bring those experiences that we can learn from. Security is an evolving landscape. We have to be ready to learn and adjust. I learn from board members as much as they learn from us.

Andrew: Dating back 5 years, reporting to the board was a heavy lift. We had to engage multiple stakeholders, align on data, determine what was relevant, and then prepare our presentation. It was a quarterly marathon, and always had a few last-minute sprint efforts. Ben, what has been your experience in preparing for the board in the past?

Ben: I learned the hard way that you need to find the right altitude for the presentation, then stick with it. Since board members come from other companies and bring broader experience, it's important to set the board content in a context that is applicable to our company.

Andrew: We have been working extremely hard to make our presentations clear, relevant, and timely. We also have the most success when we use a common vocabulary, common control framework, and common controls that address risk, security, and compliance. This is important regardless of whether we are talking about security, privacy, financial, or regulatory risk.

When we began using ServiceNow GRC and Security Operations, our preparation process changed dramatically. They give us that common platform for a consistent process and standardized reporting. We can share data that we view every day in our dashboards. Over time, we’ve seen the board’s confidence increase because the data is consistent and timely.

Ben: Having that common reporting platform makes preparing for the next board meeting much easier for me as a newcomer to ServiceNow. I want to be able to communicate the key narrative of our current state and our desired state and how these align with the company's business objectives. Reports that focus on outcomes are a much better way to reflect our progress and our successes and keep us out of those rabbit holes. Any other tips for the next meeting?

Andrew: Transparency is key. They don't want to hear that everything is rosy. They want an honest assessment of the progress we are making against critical priorities. They want to hear where we fell short as much as where we did well. Our data holds us accountable to that.

To hear more from Ben and Andrew, register for “Threading the needle - Presenting risk to the board of directors,” on Thurs., Sept. 19 at 10 am PT/1 pm ET. Register for this Now on Now webinar: Threading the needle - Presenting Risk to the board of directors..

Learn more about GRC at www.servicenow.com/grc

Topics

  • Total experience companies outperform: prism refraction with an arrow pointing to the right
    Employee Experience
    Survey says: Total experience-focused companies outperform
    Organizations are aligning employee experience and customer experience to create a positive total experience. See findings from the latest research.
  • 4 ServiceNow employees who worked on support case creation and auto-agent workflows
    Now on Now
    Streamlining support case creation and administration
    When customer feedback revealed areas ripe for improvement, ServiceNow employees listened and upgraded two support workflows: case creation and auto-agent.
  • Scaled Agile Framework (SAFe): business man looking at phone while standing on bridge overlooking a city
    IT Management
    How the Scaled Agile Framework (SAFe) truly supports business
    The Scaled Agile Framework (SAFe) delivery model can help IT leaders manage the transition from a stability-focused to a continuously evolving infrastructure.

Trends & Research

  • Total experience companies outperform: prism refraction with an arrow pointing to the right
    Employee Experience
    Survey says: Total experience-focused companies outperform
  • Customer service: smiling businessman on phone walking outdoors
    Customer Experience
    Survey: 3 tips to deliver world-class customer service
  • Enterprise SRE (site reliability engineering): where service reliability and business agility meet
    Application Development
    Service quality and the rising need for enterprise SRE

Year