As recently as March 2015, Hillary Clinton’s use of private email on multiple devices while serving as secretary of state hit the media. Clinton commented, “. . . I opted for convenience to use my personal email account, which was allowed by the State Department, because I thought it would be easier to carry just one device for my work and for my personal emails instead of two.”
Every board member can fall prey to the Clinton communication example—take the necessary steps to educate your board.
We continue to live in a changing business environment with a backdrop of increasing regulatory pressures and a heightened focus on improving board oversight and communication. Current guidance and regulatory policies and practices are designed to force improvement in risk management and compliance. Along with that comes the responsibility of how we securely communicate and exchange confidential information at the board and committee level.
Technology and security are playing an important role in this change as leadership demands more mobility, flexibility and speed. Armed with multiple mobile devices and an “on-the-go” attitude, some stakeholders, who may not have grown up in the world of IT, are constantly exposing company information to risk.
Practices for managing board communication suggest we may not be keeping up with the requirements for security and compliance.
Take into account the following:
The Organization
- Think about how many board members are still receiving board and committee information in their personal email accounts. Then layer in the amount of changes and document version control that need to be communicated before the actual meeting. This information often is not encrypted.
- Interactions with management and the board is continuous. Monthly, quarterly and annual meetings give the board and committee members an opportunity to review company performance, and provide a forum for governance. Information is still being printed, exposing huge amounts of confidential information as directors travel between meetings and between locations.
- Unsecure dissemination of confidential documents from regulators, investors and management flows from administrators to the board.
The Individual
- Critical documents are still being stored and shared on a variety of personal devices – computers, tablets and phones.
- Directors and committee members are still sending their packets to their personal emails so they can print the materials, thereby breaching security.
What do you do?
Security issues continue to be on the front page of the news. How do you prevent a perfect storm from happening where directors with personal communication devices are not handling confidential information in a proper format? Below are four practical steps to address this.
Education: Board members should be educated on a periodic basis as to what their roles and requirements are, from a board and a bank perspective. If you are public, Securities and Exchange Commission regulations should also be reviewed often.
Process: To help prevent damage from occurring, it is also important to setup a process whereby the directors are getting the necessary information in a secure fashion. There should be sufficient documentation of the process in establishing and monitoring board members. Appropriate personnel, including risk-management and IT personnel, should have input.
Review: The risk department should conduct a review and test the entire process to ensure the loop is secure. This should include management, committee members and the entire board.
Evaluate: Evaluate the risk factors affecting the current process. How does it impact the organization overall?
As technology continues to evolve at breakneck speed, the race is on for leaders to move fast enough to deliver a secure environment. It is clear that not enough attention is being focused on the process that is necessary to foster this environment. Board members will need to think ahead before they communicate, and leaders will need to make sure director communications are secure. And there is no magic formula for creating this—it is an ongoing, “live” process that you will need to keep reviewing. While the process needs to constantly be monitored and refreshed, it also must reflect new behaviors and new preferences: look to the success of the Apple Watch.
This real-time process will aim to keep you secure at all times. And that may end up in your favor as regulators may soon turn their focus to communication within the board room.
The Securities and Exchange Commission (SEC) is now accepting comments on proposed rules that would require public companies to disclose the ratio of the CEO’s pay to that of their median worker. Proponents say it will serve to better highlight excessive pay practices and shame those companies into adopting more shareholder-friendly programs. Detractors argue that the cost and complexity of implementing the new disclosure outweighs the benefits to investors and may actually ramp up pay levels.
With increasing needs for capital and a desire to grow, some smaller banks may want to become or remain public companies, in spite of the significant burdens imposed on smaller public company issuers. Access to the public markets and shareholder liquidity, in the right situation, are worth the price of admission. Without a growth agenda, however, small, publicly held banks would be well-advised to privatize.
It is hard to see many benefits for companies with less than $500 million in total assets to have their shares registered with the Securities and Exchange Commission (SEC) under the Exchange Act. The accounting costs associated with public company status continue to increase, as do legal and regulatory check-the-box exercises. Perhaps it is worthwhile for boards to consider the issue again at $1 billion in assets, which is when the requirements for Federal Deposit Insurance Corp. Improvement Act certifications and the Federal Reserve’s enterprise risk assessments kick in. It is clear how smaller, publicly traded banking organizations view this issue. After the JOBS Act, the pace of such companies going dark has resembled Pamplona’s Running of the Bulls.
For many banks with less than $500 million of assets, the burdens of operating as a public company likely outweigh the benefits. The reporting obligations themselves are substantial. Moreover, particularly as many community banks continue to feel the burdens of the financial crisis, the need to satisfy the short-term view of many investors can impede the pursuit of the long-term objective for a return to health. And the public markets often place a discount on the stock price of banks this size, thereby limiting the upside potential of an offering. Despite having said that, if a bank of this size is in comparatively good health, there are many opportunities for acquisitions in the marketplace now. For these banks, the publicly traded stock can still be a useful currency in a growth strategy. 
After the JOBS Act increased thresholds for registration from 500 shareholders to 2,000 and deregistration from 300 shareholders to 1,200, many banks have been closely examining the practicality of being a public company, especially considering the tremendous expense and additional regulation. However, the sensibility of that decision truly rests in the bank’s strategic plans for its future. How does the bank want to position itself? If a bank wants to expand its market or services, or if it wants (or needs) to raise capital, its prospects for doing so are much brighter as a public company. Some banks also enjoy the prestige and attention that they receive as a public company. Being a public reporting company may add significant expense, but the visibility and flexibility for raising capital is certainly enhanced for a public company, which may turn those expenses into a valuable investment for future growth.
There is no one-size-fits all response to this question. For the institution that sees itself generating enough capital to pay dividends and sustain growth and does not see itself expanding its footprint, then it should seriously consider deregistering with the SEC. There is a unique ability for a bank or bank holding company (and a savings bank and savings and loan holding company) to continue to trade on the bulletin board without having to be registered with the SEC. This is not available for non-financial institutions.
On August 12, 2011, the Securities and Exchange Commission’s (“SEC”) final rules implementing the sweeping whistleblower program in the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank”) became effective. Like all entities within the SEC’s jurisdiction, publicly-traded banks and their compliance officials should take the time now to understand the whistleblower provisions and the new challenges they pose.