Chapter 2 Flashcards
T 1.1 Risk - how does this NACD text define it (based on an ISO definition)? What are 2 related definitions?
- Risk is “the effect of uncertainty on objectives,” which can be a negative or positive deviation from expectation
- Pure risk - possibility of loss without possibility of a gain
- Speculative risk - can bring either loss or gain
T 1.2 8 practices for effective risk oversight
- Understand the company’s risk profile, i.e., the major risks inherent in the company’s business model and strategy
- Define the company’s risk appetite, i.e. “ the amount and type of risk that the organization is prepared to pursue, retain or take in pursuit of its strategic objectives” (ISO)
- Clarify roles of board, committees, and mgmt.- all parties matter (as well as often outside advisors), and it is important to have a protocol for how they should work together
- Integrate discussions of strategy, risk, and performance
- Ensure transparent and dynamic risk reporting, including regular reporting of top risks, risk rankings and approaches take to manage risks
- Reinforce clear accountability for risk
- Verify that mitigation reduces risk exposure
- Assess risk culture, defined as “the behavioral norms of a company’s personnel with regard to the risks presented by strategy execution and business operations.”
T 1.3 What are 3 challenges to providing effective risk oversight
- Oversight of disruptive risks
- Quality of the risk mgmt process
- Oversight of reputational risks
T 1.4 Guidance for providing risk oversight - 10 recommendations
- Understand the company’s key drivers of success.
- Assess the risk in the company’s strategy.
- Define the role of the full board and its standing committees with regard to risk oversight.
- Consider whether the company’s risk management system is appropriate and has sufficient resources.
- Work with management to understand and agree on the types (and format) of risk information the board requires.
- Encourage a dynamic and constructive risk dialogue between management and the board, including a willingness to challenge assumptions.
- Closely monitor the potential risks in the company’s culture and its incentive structure.
- Monitor critical alignments, including that of strategy, risk, controls, compliance, incentives, and people.
- Consider emerging, disruptive, and interrelated risks. What’s around the next corner?
- Periodically assess the board’s risk oversight processes and culture. Do they enable the board to achieve its risk oversight objectives?
T 2.1 Which definition of the term crisis does the NACD use?
A crisis can be defined as a “realized risk that threatens to substantially disrupt, damage or destroy the organization’s operations, business, or reputation.”
T 2.2 What are 3 roles of boards in relation to crisis situations (before, during, after)?
- Before: providing oversight of crisis preparations, including regular discussions, simulations/table tops
- During: actively participate, as needed (particularly if the crisis involved the CEO!)
- After: conduct post mortem to ensure that lessons are learned and plans are adjusted
T 2.3 10 (potential) board action steps during a crisis
- Assess the magnitude of the crisis and how active of a role the board should pla
- Add additional directors to the board with certain skill sets, if more expertise related to the crisis is needed.
- Consider creating a temporary board committee
- Hold board meetings with independent directors only to assess management’s response
- Ask management to provide regular reports to the board on the status of the crisis. Give feedback to management.
- Determine with management what happened, who was involved, how company operations have been affected
- Question management’s assumptions
- Consider additional sources of information e.g., an independent investigation. Anticipate what additional facts the investigation may find
- Ensure all relevant internal business lines have been notified of the crisis and that management is informing all impacted stakeholders
- Assist management in providing communications that take responsibility for the crisis, if necessary, while also considering the implications for the company’s liability.
T 2.4 4 key board challenges in the face of a crisis
- If CEO is part of the crisis - board needs to take a big role
- Escalation of information to the board - consider establishing guidelines for what should be communicated to the board (no trivialities, but also no cover-ups)
- Maintaining company performance (in addition to effective crisis response)
- Board and management disposition and experience - consider board and management traits to handle crises during the selection process
T 3.1 Which definition of the term “cyber security” does the NACD use?
Cyber security ios here defined as “the preventative techniques used to protect the integrity of networks, programs and data from attack or unauthorized access”
T 3.2 Which definition of the “data privacy” does the NACD use? How does data privacy (in this definition) relate to cyber security?
Data privacy is “the appropriate use and protection of personal information”; it is contingent cybersecurity
T 3.3 What are 6 common types of cyber attacks?
● Malware: malicious software variants, including viruses, ransomware, and spyware. These programs can harm business by, e.g., destroying databases, causing damage to business infrastructure.
● Botnets: a network of compromised computer systems that can perform automated tasks without the permission or knowledge of device owners. Attackers use the computer resources of these systems to execute large-scale attacks and other malicious activity
● Social engineering: social engineering attempt to extract sensitive business information, such as login credentials, employee records, and banking details.This form of attack is typically distributed through phishing emails
● Advanced persistent threat (APT): Using stealthy and sophisticated tactics, attackers gain unauthorized access to a network or system and can remain undetected for months or years.
● SQL injection: code injection technique commonly found on malicious websites or unsecured web browsers. The vulnerability allows attackers to manipulate queries that an application makes to the connected database. This allows the attacker to view and edit source code as well as access data stored in the underlying servers.
● Denial-of-service attack: an attacker inundates a server with traffic and drains the resources necessary to keep it functional
T 3.4 What are the 3 key components of cybersecurity oversight?
- Establishing an enterprise-wide cyber-risk management framework; most common standard - NIST
- Giving regular and adequate time on board and committee agenda to cyber security. Recommended MINIMUM frequency: semi-annual for the full board, quarterly (!) to the committee charged specifically with cybersecurity oversight
- Adhering to public disclosure and reporting requirements
T 3.5 What are 7 common elements of data privacy programs?
● identifying and prioritizing the data to be protected;
● complying with relevant laws and regulations;
● developing and reinforcing a comprehensive data privacy policy;
● establishing roles and responsibilities;
● identifying and mitigating threats, external and internal, to sensitive data;
● setting and tracking metrics; and
● training employees and other stakeholders
T 3.6 What are 3 common challenges to providing cybersecurity oversight?
- Ensuring that the board has access to cybersecurity expertise
- Recognizing the legal implications of cyber risks; note - business judgment rule protects directors if they perform reasonable levels of oversight!
- Determining the organization’s cyber-risk tolerance
T 3.7 What is the NACD’s guidance on providing oversight of cybersecurity and data privacy (5 items)?
- Directors need to understand and approach cybersecurity as an enterprise-wide risk management issue, not just an IT issue.
- Directors should understand the legal implications of cyber risk as they relate to their company’s specific circumstances.
- Boards should have adequate access to cybersecurity expertise, and discussions about cyber-risk management should be given regular and adequate time on board meeting agendas.
- Directors should set the expectation that management will establish an enterprise-wide cyber-risk management framework with adequate staffing and budget.
- Board-management discussions about cyber risk should include identification of which risks to avoid, which to accept, and which to mitigate or transfer through insurance, as well as specific plans associated with each approach.
