September 2015

Board Matters Quarterly

EY Center for Board Matters

Board Matters Quarterly | September 20152

Board Matters Quarterly | September 2015 3

In this issue04 Five-year outlook: nearly 20% of

directors poised for board exitAn increased focus on board composition combined with data showing that one in five directors is approaching retirement makes this a good time for boards to review their oversight needs and engage in strategic director succession planning.

07 Audit committee reporting to shareholders in 2015Over the past four years, our data show that companies have significantly increased their voluntary proxy disclosures relating to the audit committee’s oversight of the auditor. We provide an analysis of proxy statements from 2012–15.

12 Board oversight of tax risk: understanding the global focus on base erosion and profit shiftingAs part of their role in the oversight of risk and tax strategy, boards and audit committees need to be well informed about tax policy developments and trends worldwide, including the Organisation for Economic Co-operation and Development project to address base erosion and profit shifting.

14 How boards can help crack the cyber economics equationUnderstanding threat intelligence, economic anomalies and geopolitical risks can provide board members with greater clarity as they oversee cybersecurity risks.

September 2015

Board Matters Quarterly

Board Matters Quarterly | September 20154

Five-year outlook Nearly 20% of directors poised for board exit

Based on what the EY Center for Board Matters is hearing from investors and directors, optimal practices for aiding board renewal include robust performance evaluations (including following through on key takeaways), assessments that map director qualifications against a board skills matrix, and creating a board culture where directors do not expect to serve until retirement.1 Director retirement and tenure policies are also among the tools available to boards to ease transitions. Such policies can help depersonalize the process of asking directors to leave the board.

This report looks at board retirement and tenure policies across companies in the Fortune 100. Using current director ages and tenures across the Fortune 100 and the S&P 1500, it also identifies the portion of directors approaching retirement, based on average retirement-age policies and tenures, and finds opportunity for boards to focus on strategic director succession planning now.2

Investors’ increasing focus on board composition includes attention to whether boards are continuing to refresh and recruit new directors in line with the company’s changing strategic goals and risk profile. But the challenges of effective board succession planning can go beyond finding new directors whose skill sets, diversity, character and availability match the board’s needs. They may also include asking long-standing directors to leave the board when appropriate, while protecting directors’ collegiality and relationships.

Fortune 100 boards with director retirement-age policies

61% 28% 11%

set the retirement age at 72

set the retirement age at 75

use other retirement ages ranging from

70 to 76

Of that 83% ...

83% of Fortune 100 boards have retirement-age

policies

Board Matters Quarterly | September 2015 5

Tenure of Fortune 100 directors

Less than 3 years

3–9 years

10 years or longer45%

21%

34%

Fortune 100 board retirement-age policiesNearly all Fortune 100 companies have board retirement-age policies in place, with most companies setting the retirement age at 72. Four of these companies have upped their retirement age since last year; none have lowered it.

Even when retirement-age policies are in place, some boards may choose to waive them in cases where they feel doing so is warranted. Indeed, nearly half of the Fortune 100 companies that have board retirement-age policies make explicit that the policy may be waived under certain circumstances. Still, it is rare for directors to serve on the board past the set retirement age. Only 2% of Fortune 100 directors are serving on boards past a designated retirement age. In half of those cases, the companies explain in the proxy statement the board’s reasoning for reappointing those directors. Around 8% of Fortune 100 directors are age 72 or older.

Fortune 100 board tenure policiesTenure policies are rare among Fortune 100 companies. Only four companies have them: one uses a term limit of 12 years, one uses 15 years, one uses 18 years, and one uses 20 years. Even when board tenure policies are in place, companies may waive them. In fact most of the companies that do set term limits make clear that the board may make exceptions. Only two Fortune 100 directors are serving on boards past a designated term limit — in one case the director is the chair and CEO of the company, and in the other case the director is the board chair.

Tenure policies are not popular with investors either. Based on EY Center for Board Matters’ investor outreach in advance of the 2015 proxy season, many investors believe that blunt instruments, such as term limits, do not account for the contributions of valuable, long-tenured directors.3 While some investors will more closely review boards where a significant portion of directors are long tenured (particularly

Among the Fortune 100 companies with retirement-age policies, 19% of directorships are held by individuals within five years of reaching the board’s designated retirement age.

Age of Fortune 100 directors

Under 50

50–67

68 and over71%

25%

4%

Board Matters Quarterly | September 20156

Board seats likely to turn over in the next 5 years, by index Directors who are 68 years or older and have 10 or more years on board (includes boards without a retirement-age policies)

S&P 500 | 18%

S&P 1500 | 19%

19% of S&P 1500 directorships are held by individuals who are 68 or older and have served on the board for 10 years or more.

Endnotes:

1 For more on investor views on mechanisms to trigger board renewal, see 2015 proxy season insights: a spotlight on board composition.

2 All data is from EY’s Corporate Governance Database, which covers more than 3,000 companies listed in the US. Company retirement and tenure policy data is based on the corporate governance guidelines of 87 publicly traded Fortune 100 companies as of 30 June 2015. Fortune 100 director data is based on most recent annual meeting proxy statements; director data for other indices is based on available 2015 annual meeting proxy statements for meetings through 30 June 2015.

3 For more insights from the Center for Board Matters’ investor outreach program, see 2015 proxy season insights: a spotlight on board composition.

4 For our most recent report on gender diversity on US boards, see Women on US boards: what are we seeing?

5 For tips on effective succession planning for the boardroom, see Let’s talk: governance: getting it right: succession planning for the boardroom and C-Suite.

if they have concerns about other governance practices and/or financial performance), they are generally open to long tenures when warranted by the director’s contributions and expertise.

Still, some investors did share with us their view that term limit guidelines may provide a built-in mechanism for boards to have a conversation with directors about leaving the board and create additional assessment of long-tenured directors. However, some investors noted that a rules-based path regarding director terms may prove attractive if they perceive that most boards are resistant to refreshing as needed.

How many S&P 1500 directors are currently nearing retirement?A close look at data on current board members’ ages and tenures shows that 19% of S&P 1500 directorships are held by individuals who are age 68 or older and have served on the board for 10 years or more, up from 14% in 2010. Given that the average retirement-age policy for Fortune 100 companies is 72, we can presume that these S&P 1500 directors — who are within five years of reaching age 72 and, in addition, have tenures of 10 years or longer — are poised to exit the board over the next 5

years or so. While not a precise measurement, the data reflects that the estimated portion of directors nearing retirement is significant, and greater than it was 5 years ago.

ConclusionFactors driving the increasing focus on board composition include the demand that board membership evolve along with a company’s strategic plan and risk profile, the push for enhanced board diversity and related performance benefits,4 and the need for fresh perspective, expertise and insights in the boardroom, among other things. These goals will not likely be achieved by board retirement or tenure policies alone. Setting expectations up front that directors will serve for a limited amount of time based on the board’s evolving oversight needs — not necessarily until they reach retirement age — is important. The data showing that a significant number of directors are currently approaching retirement illustrates the current opportunity for boards to review their oversight needs and engage in strategic director succession planning.5

Board Matters Quarterly | September 2015 7

Audit committee reporting to shareholders in 2015

Based on data culled from this year’s proxy statements, the previously observed trend of Fortune 100 companies going beyond minimum disclosure requirements and providing voluntary audit-related disclosures has continued and expanded even further.2 As in prior years, several factors appear to have contributed to this trend, including requests from investors to companies to provide additional information. Policymakers and other stakeholders also have been active in calling attention to the important role of audit committees and promoting consideration of greater transparency around how audit committees carry out their responsibilities.

This data may be particularly relevant in light of the recent Concept Release on Possible Revisions to Audit Committee Disclosures3 from the US Securities and Exchange Commission (SEC), which seeks public comment on current audit committee reporting requirements. This and other actions by policymakers in 20154 likely will amplify the discussion — and affect the evolution — of the audit-related disclosure landscape in the coming years.

ContextAudit committees of public companies play a critical role in the US capital markets due to their responsibility for overseeing the financial reporting process. Among other contributions, high-quality audit committees promote reliable and transparent financial reporting by management and foster an independent audit environment aligned with investor interests and protected from undue management influence. While current required disclosures about the work that audit committees do to oversee the financial reporting process are limited in nature, this has not deterred a continuation of enhanced audit committee transparency.5

Over the past four years, our data show that companies have significantly increased their voluntary proxy disclosures relating to the audit committee’s oversight of the auditor. Initiatives by regulators, investors, corporate governance leaders and other

This 2015 proxy season update is EY’s fourth report on the topic of audit committee reporting. Beginning with 2012 proxy disclosures, the EY Center for Board Matters has reviewed proxy statements of Fortune 100 companies to observe the changing nature of disclosures related to the audit and the audit committee’s oversight of the auditor.1 By capturing and publishing data on these disclosures, EY seeks to contribute to public debate by informing the marketplace of current audit committee disclosure practices, given the important role of the audit committee in capital markets.

Board Matters Quarterly | September 20158

stakeholders have encouraged these disclosures by raising awareness of the role of audit committees and noting the benefits of greater transparency such as increased investor confidence. Below we highlight some of the developments over the past year that have encouraged additional reporting by companies:

• Several investment groups and pension funds have indicated to companies that they want additional information relating to the audit and the audit committee’s oversight of the auditor. For example, the pension fund of the United Brotherhood of Carpenters has sought enhanced disclosures from certain companies regarding the audit committee’s ownership and oversight of the audit relationship.6 For the 2015 proxy season, it sent letters to 91 S&P 500 companies seeking additional disclosures.7 In addition, BlackRock’s 2015 Proxy vote guidelines for US securities states that it “looks to the audit committee report for insight into the scope of the audit committee’s responsibilities, including an overview of audit committee processes, issues on the audit committee’s agenda and key decisions taken by the audit committee.”8

• The Center for Audit Quality and Audit Analytics9 published the Audit Committee Transparency Barometer in December 2014, which sought to measure the robustness of disclosures on audit committee oversight of the auditor among Standard & Poor’s (S&P) 500 LargeCap (S&P 500) companies, S&P MidCap 400 (S&P MidCap) companies, and S&P SmallCap 600 (S&P SmallCap) companies. This research shows that many companies in each index are providing information that goes beyond minimum requirements.

• In July 2015, the US SEC issued its Concept Release on Possible Revisions to Audit Committee Disclosures (the Concept Release) to solicit views on whether there should be greater transparency around the work of audit committees and, if so, how best to achieve it, including through voluntary or mandatory disclosures. Although the Concept Release was issued after the 2015 proxy season, the SEC Commissioners and staff publicized the fact that this project was in progress, including through recent speeches by SEC Chief Accountant James Schnurr highlighting the SEC’s strong interest in this topic.10

Similar to calls from investors and others, the Concept Release focuses specifically on transparency relating to the audit committee’s oversight of the auditor. In particular, the SEC seeks views about whether there would be benefit from increased disclosure from audit committees about how they execute their existing responsibilities to appoint, compensate and oversee the independent external auditor on behalf of investors.

2015 proxy season disclosure highlightsBelow are our 2015 findings on voluntary audit committee-related disclosures from the proxy statements of Fortune 100 companies. They show a steady pace of increasing voluntary disclosures on a year-over-year basis from 2012 to 2015 amid investor and policymaker interest in this area.

These findings are based on a review of the companies in the 2015 Fortune 100 that filed proxy statements for four consecutive years as of 15 August (76 companies in total),11 utilizing data from the EY Center for Board Matters’ proprietary corporate governance database.

Since 2012, Fortune 100 companies have significantly increased the information available about how they appoint, compensate and oversee their external auditors:

• Disclosures related to the audit committee’s oversight and evaluation of external auditors:

• Nearly three-quarters (71%) of companies specified that the audit committee is responsible for the appointment, compensation and oversight of the auditor, compared to 41% in 2012.

• Over 60% of companies disclosed that the audit committee was involved in the selection of the audit firm’s lead engagement partner. In comparison, no companies did this in 2012.

Over the past four years, our data show that companies have significantly increased their voluntary proxy disclosures relating to the audit committee’s oversight of the auditor.

Board Matters Quarterly | September 2015 9

• Disclosures related to the audit committee’s responsibility for compensating the auditor and preapproving all fees paid to the auditor:

• 80% of companies noted that they consider non-audit services and fees when assessing the independence of the external auditor, compared to 11% in 2012.

• 21% of companies disclosed that the audit committee was responsible for the auditor’s fee negotiations. In 2012, none of the companies provided this disclosure.

• 9% of companies provided explanatory disclosures of the reason for year-over-year changes in fees paid to the external auditor, doubling the percentage of companies that did so in 2012.12

• Disclosures related to the appointment and retention of their external auditors:

• Auditor tenure was disclosed by 59% of reviewed companies, an increase from 25% of companies that did so in 2012. Median disclosed tenure was 18 years.

• 58% of companies explicitly state their belief that their selection of the external auditor is in the best interests of the company and/or shareholders, up from 3% in 2012.

• 41% of companies disclosed that the audit committee considers the potential impact of rotating their external auditor, up from 3% in 2012.

• 39% of companies explained the rationale for appointing their auditor, including the factors used in assessing the auditor’s quality and qualifications. Only 17% of companies did this in 2012.

• In 2015, an emerging approach to retention disclosure was observed as some companies discussed the benefits of longer tenure while providing a description of measures to protect auditor independence.

Audit-related disclosures increasingly are grouped together to make it easier for investors to access information about the audit and audit committee:

• A number of companies have created an “audit-related” section of the proxy statement or have placed more audit-related information in the audit committee report. This reduces the need for investors to search in multiple places for relevant material and perhaps miss key information.

“Audit committees play a critical role in providing oversight and serving as a check and balance on a company’s financial reporting system. … From my perspective, the increasing desire by investors to hear more from audit committees is understandable given the important role that audit committees play.”James Schnurr SEC Chief Accountant Remarks before 2014 AICPA National Conference on Current SEC and PCAOB Developments (8 December 2014)

Board Matters Quarterly | September 201510

Summary: trends in audit committee disclosure

Category Topic2012

% of total2013

% of total2014

% of total2015

% of total

Disclosures in the audit committee report13

Statement that the audit committee is independent 57% 54% 58% 58%

Name of the audit firm is included in the audit committee report

75% 75% 74% 74%

Audit committee composition

Audit committees with one financial expert (FE) 29% 26% 29% 25%

Audit committees with two FEs 17% 25% 14% 12%

Audit committees with three or more FEs 54% 49% 57% 63%

Audit committee responsibilities re: external auditor

Explicit statement that the audit committee is responsible for appointment, compensation and oversight of external auditor

41% 54% 66% 71%

Identification of topics discussed

Topics discussed by the audit committee and external auditor

8% 8% 7% 8%

Fees paid to the external auditor

Statement that the audit committee considers non-audit fees/services when assessing auditor independence

11% 80% 80% 80%

Statement that the audit committee is responsible for fee negotiations

0% 9% 18% 21%

Explanation provided for change in audit fees paid to external auditor

3% 4% 7% 9%

Assessment of the external auditor

Disclosure of factors used in the audit committee’s assessment of the external auditor’s qualifications and work quality

17% 20% 34% 39%

Statement that audit committee is involved in lead partner selection

0% 17% 47% 61%

Disclosure of the year the lead audit partner was appointed

3% 3% 7% 9%

Statement that choice of external auditor is in best interests of company and/or shareholders

3% 24% 50% 58%

Tenure of the external auditor

Disclosure of the length of the external auditor tenure 25% 30% 50% 59%

Statement that the audit committee considers the impact of changing auditors when assessing whether to retain the current external auditor

3% 17% 30% 41%

Accessibility of audit committee charters from proxy statements

Company provides a direct link to the charter 8% 11% 16% 16%

Company main website 45% 41% 40% 39%

Company site for investor relations 25% 26% 26% 25%

Company site for corporate governance matters 22% 22% 18% 20%

Reviewed companies indicated the audit committee raised certain topics with their external auditors other than those required by regulations; these included risk controls and compliance, cybersecurity and other information technology matters, and pension funding and other investments.

Reviewed companies had an average of 3 financial experts, up from 2.8 in prior years.

Most companies explain the types of services included within each fee category. The companies highlighted here explain the circumstances for the change.

Reviewed companies indicated that audit committees based these assessments on criteria such as the independence and integrity of the external auditor and its controls and procedures; performance and qualifications, including expertise on the company and global reach relative to the company’s business; quality and effectiveness of the external auditor’s personnel and communications; appropriateness of fees; length of tenure and benefits of a longer tenure; and Public Company Accounting Oversight Board reports on firm and peers.

Notes: Data is based on the 76 companies in the 2015 Fortune 100 list that have filed proxy statements for 2015, 2014, 2013 and 2012 annual meetings through 15 August 2015.

Board Matters Quarterly | September 2015 11

1 See Audit committee reporting to shareholders: going beyond the minimum (February 2013), Audit committee reporting to shareholders 2013 proxy season update (September 2013) and Let’s talk: governance: audit committee reporting to shareholders (August 2014).

2 The data on 2015 audit-related proxy disclosures provided in this publication was drawn from companies in the Fortune 100 in 2015 that filed proxy statements for three consecutive years as of 15 August (76 companies in total). This data is based on the EY Center for Board Matters’ proprietary database, which covers more than 3,000 public companies listed in the US.

3 For additional information, see EY’s To the Point: SEC seeks feedback on possible changes to audit committee disclosures.

4 For example, the US Public Company Accounting Oversight Board issued a Concept Release on Audit Quality Indicators (June 2015) as well as a Supplemental Request for Comment: Rules to Require Disclosure of Certain Audit Participants on a New PCAOB Form (June 2015), both of which could affect future audit committee disclosure.

5 According to Item 407 of Regulation S-K, audit committee reports must include statements that the audit committee has:

• Reviewed and discussed audited financial statements with management

• Discussed with the independent auditor matters required under Auditing Standard 16, such as significant matters that the auditor discussed with management and an overview of the overall audit strategy

• Received required written communications from the auditor regarding the auditor’s independence and discussed independence with the auditor

• Recommended to the board that the audited financial statements should be included in the annual report

6 Specifically, the United Brotherhood of Carpenters pension funds have asked certain companies to state the auditor’s tenure and verify that the audit committee is responsible for the appointment, compensation, retention and oversight of the external auditor; is responsible for fee negotiations associated with the retention of the audit firm; periodically considers whether there should be regular rotation of the external auditor; is directly involved in

selection of the lead engagement partner; and believes that the continued retention of the external auditor is in the best interests of the company and its investors. Carpenters’ Fund Continues to Make Progress on Auditor Disclosure, Rosemary Lally.

7 The UAW Retirees Medical Benefits Trust joined the United Brotherhood of Carpenters fund on some of these letters.

8 BlackRock 2015 Proxy voting guidelines for U.S. securities (February 2015), p. 7.

9 The Center for Audit Quality (CAQ) is an autonomous, nonpartisan public policy organization dedicated to enhancing investor confidence and public trust in the global capital markets. Audit Analytics is an independent research provider that enables the accounting, legal and investment communities to analyze auditor market intelligence, public company disclosure trends and risk indicators.

10 See, e.g., Chief Accountant Schnurr’s June 2015 Remarks at the 34th Annual SEC and Financial Reporting Institute Conference, at which he noted the significant role of audit committees in protecting investors and the SEC’s plan to issue a concept release to solicit input on audit committee disclosures. He also gave a speech noting the SEC’s plans in this area in December 2014.

11 Corporate acquisition and restructuring activity and changes in the composition of the Fortune 100 affect the specific companies reviewed. Each year, the review covers the current Fortune 100 companies filing proxy statements for each year beginning in 2012, tracking on a company-by-company basis how each audit committee’s approach to disclosure has evolved. This means the percentage of companies making audit-related disclosures shown in our previous publications on this topic may be slightly different from those shown in this document, as the 2015 Fortune 100 companies are not all the same as previous years’ Fortune 100 companies.

12 The companies providing such explanatory disclosures had fee increases ranging from 3% to 81% and cited corporate life events such as acquisitions and securities offerings as underlying the change. More than 80% of reviewed companies had fee changes +/-5% or greater and did not provide related explanatory disclosures.

13 Reviewed companies may have provided this information elsewhere in the proxy or other disclosure documents.

Endnotes

Board Matters Quarterly | September 201512

Governments around the world are scrutinizing the global tax profiles of multinational companies (MNCs) that do business in their countries, questioning MNCs’ local tax positions and seeking greater transparency into their entire tax footprint. In this regard, a key initiative to monitor is the Organisation for Economic Co-operation and Development (OECD) project to address base erosion and profit shifting (BEPS). That project, which is driven by the G20, is based on a 15-point action plan issued in July 2013 and is designed to address government concerns about the potential for MNCs to source profits to jurisdictions where they are subject to more favorable tax treatment. The OECD is expected to issue final reports in all 15 focus areas this autumn, with consensus recommendations for changes in international tax laws and treaties that governments can implement to reduce the potential for base erosion and profit shifting activity.

The importance of the OECD’s recommendationsIn addition to the active participation of the OECD and G20 governments, officials from several developing countries also have provided input into the BEPS project. With this global focus on BEPS, the tax landscape for MNCs is already changing. And the pace of change is expected to intensify with the finalization of the OECD’s recommendations. Broadly, these recommendations are expected to include changes that would:

• Limit interest deductions• Eliminate the benefits of hybrid financing arrangements• Lower the permanent establishment standards

for taxable presence in a country• Place new restrictions on access to benefits of tax treaties• Create new transfer pricing rules for intangible property• Recharacterize taxpayers’ transactions through

new approaches to transfer pricing• Require more robust transfer pricing documentation• Require new country-by-country reporting

These areas have been the focus of unilateral action by countries around the world even in advance of the final OECD output. EY has catalogued BEPS-driven changes in laws and administrative

Board oversight of tax riskUnderstanding the global focus on base erosion and profit shifting

As part of their role in the oversight of risk and tax strategy, boards and audit committees need to be well informed about tax policy developments and trends worldwide — both in the markets their company currently serves and those it may be considering.

Board Matters Quarterly | September 2015 13

practices in more than 50 countries since the beginning of 2014. For example, legislation in Mexico and France has included several BEPS-related changes, including new restrictions on the deduction of financing costs. The United Kingdom has introduced a “diverted profits tax” aimed at addressing base erosion, and Australia announced proposals that would expand its general anti-avoidance rule to address avoidance of a taxable presence. The EU recently presented a package of tax transparency measures aimed at increasing information exchange between member states. China has issued transfer pricing rules on outbound related-party fee payments. Countries including Australia, Poland, Spain and the UK have taken steps to implement documentation standards in line with the OECD’s recommendations on country-by-country reporting.

Long term, as a result of the global focus on BEPS, MNCs can expect to face:

• Increased reporting obligations

• More scrutiny of intangible property ownership and financing structures

• A greater focus on the substance of a transaction and its alignment with the business

• Increased complexity in transfer pricing

• Further limitations on access to treaty benefits

• More (and more complex) controversy with tax authorities

• A need for more proactive engagement with tax authorities to gain certainty and avoid or resolve disputes

The board’s roleWith the OECD recommendations imminent and countries already implementing BEPS-related tax legislative and administrative changes, the timing is right for companies to review their business models and structures against the BEPS focus areas to identify possible pressure points.

Boards should encourage companies to consider taking the following steps to prepare for the new global tax environment:

• Build consideration of potential BEPS impacts into current tax planning

• Re-examine supply chains and evaluate current and future financing arrangements

• Assess the company’s readiness for increased reporting requirements, including new requirements for reporting key financial and operating metrics on a country-by-country basis

• Consider advance pricing agreements (APAs) and other early engagement with tax authorities to gain greater certainty

• Communicate with stakeholders regarding the implications of the changing global tax environment for the company

Questions for the board to consider

• Is management monitoring the BEPS-related activities in all countries in which the company has or is considering a presence?

• Has management conducted a strategic review of the implications of potential cross-border tax changes for the company’s business models and structures? Has management shared this evaluation with the board?

• Has the board evaluated how the company can position itself for the evolving global tax landscape?

• Is the company prepared for the expected substantial increase in global reporting requirements and the commensurate increase in compliance costs?

• Is the company ready for heightened scrutiny and tax audit risk, which can increase pressure on cash tax and effective tax rate positions?

Governments around the world are scrutinizing the global tax profiles of multinational companies (MNCs) that do business in their countries, questioning MNCs’ local tax positions and seeking greater transparency into their entire tax footprint.

Board Matters Quarterly | September 201514

How boards can help crack the cyber economics equationConsidering all the factors in overseeing cybersecurity risks

There’s no murkiness about the effectiveness of board-level involvement in managing cyber-related risks. The Ponemon Institute’s recent 2015 Cost of Data Breach Study: Global Analysis found that when boards of directors took a more active role in the event of a data breach, the cost of repairing the breach was reduced by $5.50 per customer record stolen.

Putting a price tag on each customer record hacked makes cyber risks feel tangible, but hard costs and savings don’t paint the entire picture or clearly define the role that board members have in overseeing cyber risks. There is no playbook for such involvement, but a good first step is for the board to look at cyber in a new way — one that considers three important factors that make up cyber economics: threat intelligence, economic anomalies and geopolitical risks.

Unlike traditional, tech-only cyber vulnerability tests, cyber economics paints a truer, fuller risk picture for companies and their boards by quantifying the most serious risks. Cyber economics raises awareness of technical and nontechnical risk factors and provides both technical and business strategy solutions to give organizations the best shot at succeeding in an uncertain environment. The result is greater clarity for board members looking for guidance on which risks to focus on first.

“Only when the board has a strong understanding of the three pieces of the cyber economics puzzle — and, more crucially, the impact that they have on each other — will they be able to gain insight into protecting shareholder value and enhancing return on investment,” says Doree Keating, a partner with Ernst & Young LLP.

A board member with even modest cyber acumen will instantly recognize the need for intelligence and economics to be part of the equation, but how does geopolitics fit in? The obvious answer might seem the proliferation of nation-state-sponsored cyber attacks, and that is partially true.

“Many attacks are state sponsored or travel across geographic areas, so understanding what’s going on in those areas is important not just from a cyber perspective, but from a business perspective in general,” says Siobhan MacDermott, principal at Ernst & Young LLP.

“But there’s an additional component to geopolitics as well. When you look at risks across all of those areas you might identify trends that you can overlay onto the company’s business strategy, and that helps make decisions such as where you might choose to invest in a

This article appeared on the Bloomberg Board Directors’ Forum hub. EY is the exclusive sponsor of the Board Directors’ Forum in partnership with Bloomberg Media.

The clarions warning of the serious risks posed to businesses by cyber-related issues are being heard in boardrooms around the world. But, because cyber is a relative newcomer to the list of risks boards must consider, some are still unsure about what actions they should take.

Board Matters Quarterly | September 2015 15

data center, based on the cyber risks that exist in that country. It’s adding a cyber component to the overall risk analysis.”

Board involvement in cyber economics One of the reasons that board involvement is so critical in helping organizations manage and mitigate cyber risks is that its top-down view provides the best vantage point to holistically consider cyber risks and attacks for what they truly are: “an assault on the company’s strategic imperatives,” says Keating.

For a board member, the first question should be: Are all the components of cyber economics included on the agenda?

“When the board is paying attention to all of factors of cyber economics, management has to as well,” says MacDermott.

“There are varying degrees of sophistication among board members — some just want to check the box, others are interested in trying to determine if they could be personally liable if data is stolen or people are compromised,” she explains.

Beyond the personal responsibility and liability of board members, there are other reasons that boards should take an active interest in cyber economics. For example, during M&A transactions — a very relevant topic for the board — companies are entering into business relationships where there are direct interfaces between companies (e.g., billing procurement or timekeeping systems), which may allow access to be granted to a front company or a nation-state itself.

Having the full risk picture, including an understanding of which data (such as a target company’s research or customer list) is critical to the success of the transaction and the risk that it has been or will be compromised, is crucial.

“Everyone monitors supply chain financial risk, and that’s typically based on month-old data,” says Keating.

“In the context of the deal environment, there should be more focus on the supply chain of the target company and their relationships with vendors. Do they allow for any type of cyber audit or cyber feedback relative to their systems? Also, more questions should be asked about the root cause of certain deviations from supplier order quantities, pricing and quality. And that’s just a snapshot of what due diligence means as it relates to cyber economics in the transaction space.”

Since the impact of a data breach isn’t necessarily short term — the bad guys could sit on the data for months or years, or even destroy it completely, forcing a business back to square one — it’s important for a board to consider where the responsibility for the components of cyber economics might sit. The EY Center for Board Matters is one source for information and insights on how boards can answer that and other questions.

Considering the consequencesThe costs associated with a cyber disruption to a business don’t necessarily correlate to the amount of money spent mitigating cyber risks. In fact, spending on cyber risk mitigation in a silo might make a business even more vulnerable.

“The greatest costs from cyber attacks are likely to be incurred by companies that aren’t integrating cyber risks and security into their overall business strategy — likely because they don’t really understand the risks. Those are the most vulnerable businesses,” says Keating.

“When the foundation isn’t laid properly for the convergence of business risks and cyber attacks, nothing else really works well. That’s why we’re seeing companies have to take a step back and look at their spend on cybersecurity, because many are discovering they’ve been hacked for months and didn’t even realize it.”

Some of the biggest hits a business can take are unquantifiable, and primary among those is the damage to its reputation in the immediate aftermath of a data breach or other cyber event. The company’s name in negative headlines and the impact on the stock price are only the top layer.

Brand damage can seep down, not just to consumer mistrust of a brand, but even into business partnerships. “A potential partner could question whether they want to team up with someone who has suffered a major cyber breach and reputation hit,” says MacDermott. “Any kind of transaction being considered must consider all the factors of cyber economics,” she adds.

The threats to a company’s customer relationships, reputation and prospects for growth are too great for boards not to regularly address the full spectrum of cyber economics. Only at the very top of the organization can all the risks, costs and trade-offs involved be sufficiently vetted.

Unlike traditional, tech-only cyber vulnerability tests, cyber economics paints a truer, fuller risk picture for companies and their boards by quantifying the most serious risks.

Access relevant news on the goDownload the Flipboard app on your mobile device and search for EY Center for Board Matters to access current articles on board and governance topics.

Contacts

Mark Manoff Ernst & Young LLP +1 212 773 1954 mark.manoff@ey.com

Ann Yerger Ernst & Young LLP +1 202 327 7697 ann.yerger@ey.com

Ruby Sharma Ernst & Young LLP +1 212 773 0078 ruby.sharma@ey.com

EY | Assurance | Tax | Transactions | Advisory

About EY EY is a global leader in assurance, tax, transaction and advisory services. The insights and quality services we deliver help build trust and confidence in the capital markets and in economies the world over. We develop outstanding leaders who team to deliver on our promises to all of our stakeholders. In so doing, we play a critical role in building a better working world for our people, for our clients and for our communities.

EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients. For more information about our organization, please visit ey.com.

Ernst & Young LLP is a client-serving member firm of Ernst & Young Global Limited operating in the US.

About the EY Center for Board Matters Effective corporate governance is an important element in building a better working world. The EY Center for Board Matters is committed to bringing together and engaging with boards, audit committee members and investors to exchange ideas and insights. Using our professional competencies, relationships and proprietary corporate governance database, we are able to identify trends and emerging governance issues. This allows us to deliver timely and balanced insights, data-rich content, and practical tools and analysis to boards, audit committees, institutional investors and others interested in governance topics.

©2015 Ernst & Young LLP. All Rights Reserved. SCORE no. CJ0281 1508-1595780

ED None

This newsletter may include copyrighted materials of third parties. No part of this newsletter may be reproduced, distributed, displayed or published without the express written permission of Ernst & Young LLP and the copyright holders of any included materials. All permission requests should be forwarded to Sara Brandfon at sara.brandfon@ey.com.

This material has been prepared for general informational purposes only and is not intended to be relied upon as accounting, tax or other professional advice. Please refer to your advisors for specific advice. ey.com

About this publicationBoard Matters Quarterly is published four times a year and includes articles previously published online and distributed electronically to our subscribers. To access or sign up to receive similar content relevant to board members, please visit ey.com/boardmatters.

More insights Access additional information, including the following, at ey.com/boardmatters:

Executive summaryAs the 2015 proxy season concludes, some key developments stand out. Most significantly, a widespread investor campaign for proxy access ignited the season, making proxy access the defining governance topic of 2015. The campaign for proxy access is closely tied to the increasing investor scrutiny of board composition and accountability, and yet — at the same time — the number of votes opposing director nominees is the lowest in recent years. 

Also, the number of shareholder proposal submissions remains high, despite the fact that ongoing dialogue between large companies and their shareholders on governance topics is now mainstream. These developments are occurring against a backdrop of increased hedge fund activism, which continues to keep boards on alert. 

This report is based on EY Center for Board Matters’ proprietary corporate governance database, ongoing conversations with investors, and insights from EY’s Corporate Governance Dialogue Dinner series, which convenes institutional investors, directors, corporate secretaries, academics and corporate governance advisors to discuss key developments impacting the governance landscape.1

1. Proxy access gains momentum amid increased scrutiny of boards — but opposition to director nominees remains low.

Around 100 high-profile companies faced proxy access shareholder proposals this year — more than four times the total submitted for 2014. Even more companies are discussing the topic internally and with key shareholders, in part due to a letter-writing campaign in support of proxy access launched by one of the largest US asset managers prior to the 2015 proxy season.

The proxy access shareholder proposals have been highly successful: around 60% of the proposals that have gone to a vote so far secured majority support, and those that did not secure majority support averaged 42% support. The proposals generally suggest a proxy access model with the same key ownership terms (i.e., 3% ownership for at least three years) set forth in the SEC’s now-vacated proxy access rule.2 At least 22 companies have adopted proxy access bylaws in recent years, and 

June 2015For more articles like this, please visit ey.com/boardmatters

Four takeaways from proxy season 2015Responses to the 2015 investor proxy access campaign Of the more than 100 companies that received shareholder proposals to adopt proxy access:

14% embraced proxy access model put forward by proponents (i.e., 3% ownership for at least 3 years), either through adopting a bylaw, supporting the shareholder proposal or agreeing to submit a management proposal. Most of the bylaws adopted, or to be proposed, restrict the number of shareholders that may aggregate their ownership to groups of up to 20 or 25.

7% adopted proxy access model with more restrictive terms (generally 5% ownership for at least 3 years and restricting groups to either 10 or 20 shareholders) — proxy access shareholder proposals still went to a vote and averaged 48% support.

7% submitted a counter-proposal with more restrictive terms (generally 5% ownership for at least 3 years and varying limitations on the ability of shareholders to work as a group) — support for management proposals averaged 42%; support for shareholder proposals averaged 55%.

69% recommended against the shareholder proposal without proposing or adopting a different model — support for shareholder proposals averaged 55%.

3% shareholder proposals were omitted or withdrawn on technical grounds.3

58+42+J42%

average support for management

proposals

45+55+J55%

average support for shareholder

proposals

EY Center for Board Matters

Four takeaways from proxy season 2015

Widespread investor campaigns for proxy access ignited this season, making proxy access the defining governance topic of 2015. Proxy access and company-investor engagement, the challenge from activist hedge funds and high shareholder proposal submissions were cornerstones of this year’s season. Read our full review of the 2015 proxy season for details.

Conflict minerals reporting, year two Disclosure remains steady amid continued uncertainty

EY Center for Board Matters Conflict minerals reporting, year two

Boards and executives continued to navigate the challenge of complying with reporting requirements in the second year of mandatory reporting by the Securities and Exchange Commission’s conflict minerals rule. Our new report highlights disclosure trends in 2015 and provides questions for the board to consider as it looks ahead to next year.

Bloomberg Media and EY build Board Directors’ Forum

The EY Center for Board Matters is the exclusive global sponsorship of the Bloomberg Board Directors’ Forum and digital hub. Here, senior editors at Bloomberg business news select targeted articles of interest to board and audit committee members. Access the hub at ey.com/boardmatters.