Les risques de gouvernance associés à l’OPA d’Alibaba

Lucian Bebchuk, professeur de droit, d’économique et de finance, et directeur des programmes sur la gouvernance corporative à la Harvard law School vient de publier un article très important dans le New York Times.

L’auteur met les investisseurs en garde contre de réels risques de gouvernance liés à l’offre publique d’achat (OPA) de l’entreprise chinoise Alibaba.

Je crois qu’il est utile de mieux comprendre les enjeux de gouvernance avant d’investir dans cette immense OPA.

Bonne lecture !

Wall Street is eagerly watching what is expected to be one of the largest initial public offering in history: the offering of the Chinese Internet retailer Alibaba at the end of this week. Investors have been described by the media as “salivating” and “flooding underwriters with orders.” It is important for investors, however, to keep their eyes open to the serious governance risks accompanying an Alibaba investment.

Several factors combine to create such risks. For one, insiders have a permanent lock on control of the company but hold only a small minority of the equity capital. Then, there are many ways to divert value to affiliated entities, but there are weak mechanisms to prevent this. Consequently, public investors should worry that, over time, a significant amount of the value created by Alibaba would not be shared with them.

In Alibaba, control is going to be locked forever in the hands of a group of insiders known as the Alibaba Partnership. These are all managers in the Alibaba Group or related companies. The Partnership will have the exclusive right to nominate candidates for a majority of the board seats. Furthermore, if the Partnership fails to obtain shareholder approval for its candidates, it will be entitled “in its sole discretion and without the need for any additional shareholder approval” to appoint directors unilaterally, thus ensuring that its chosen directors always have a majority of board seats.

Many public companies around the world, especially in emerging economies, have a large shareholder with a lock on control. Such controlling shareholders, however, often own a substantial portion of the equity capital that provides them with beneficial incentives. In the case of Alibaba, investors need to worry about the relatively small stake held by the members of the controlling Alibaba Partnership.

After the I.P.O., Alibaba’s executive chairman, Jack Ma, is expected to hold 7.8 percent of the shares and all the directors and executive officers will hold together 13.1 percent. Over time, insiders may well cash out some of their current holding, but Alibaba’s governance structure would ensure that directors chosen by the Alibaba Partnership will forever control the board, regardless of the size of the stake held by the Partnership’s members.

With an absolute lock on control and a limited fraction of the equity capital, the Alibaba insiders will have substantial incentives to divert value from Alibaba to other entities in which they own a substantial percentage of the equity. This can be done by placing future profitable opportunities in such entities, or making deals with such entities on terms that favor them at the expense of Alibaba.

Alibaba’s prospectus discloses information about various past “related party transactions,” and these disclosures reflect the significance and risks to public investors of such transactions. For example, in 2010, Alibaba divested its control and ownership of Alipay, which does all of the financial processing for Alibaba, and Alipay is now fully controlled and substantially owned by Alibaba’s executive chairman.

Public investors should worry not only about whether the Alibaba’s divesting of Alipay benefited Mr. Ma at the expense of Alibaba, but also about the terms of the future transactions between Alibaba and Alipay. Because Alibaba relies on Alipay “to conduct substantially all of the payment processing” in its marketplace, these terms are important for Alibaba’s future success.

Mr. Ma owns a larger fraction of Alipay’s equity capital than of Alibaba’s, so he would economically benefit from terms that would disfavor Alibaba. Indeed, given the circumstances, the I.P.O. prospectus acknowledges that Mr. Ma may act to resolve Alibaba-Alipay conflicts not in Alibaba’s favor.

The prospectus seeks to allay investor concerns, however, by indicating that Mr. Ma intends to reduce his stake in in Alipay within three to five years, including by having shares in Alipay granted to Alibaba employees. But stating such an intention does not represent an irreversible legal commitment. Furthermore, transfers of Alipay ownership stakes from Mr. Ma to other members of the Alibaba Partnership would still leave the Partnership’s aggregate interest to be decidedly on the side of Alipay rather than Alibaba.

Given the significant related party transactions that have already taken place, and the prospect of such transactions in the future, Alibaba tried to placate investors by putting in a “new related party transaction policy.” But this new policy hardly provides investors with solid protection. Unlike charter and bylaw provisions, corporate policies are generally not binding. Furthermore, Alibaba’s policy explicitly allows the board, where the nominees of Alibaba partnership will always have a majority, to approve any exceptions to the policy that the board chooses.

Of course, the Alibaba partners might elect not to take advantage of the opportunities for diversion provided to them by Alibaba’s structure. And, even if the partners do use such opportunities, the future business success of Alibaba might be large enough to make up for the costs of diversions and leave public investors with good returns on their investment.

Before jumping in, however, investors rushing to participate in the Alibaba I.P.O. must recognize the substantial governance risks that they would be taking. Alibaba’s structure does not provide adequate protections to public investors.

__________________________________________

Article relié :

Alibaba Raises the Fund-Raising Target for Its I.P.O. to $21.8 Billion (Sept. 15, 2014)

Toute la lumière sur les attentes envers les C.A. | L’état de situation selon Lipton

Aujourd’hui, je veux vous faire partager le point de vue de Martin Lipton*, expert dans les questions de fusion et d’acquisition ainsi que dans les affaires se rapportant à la gouvernance des entreprises, sur les enjeux des C.A.. L’auteur met l’accent sur les pratiques exemplaires en gouvernance et sur les comportements attendus des conseils d’administration.

Ce texte, paru sur le blogue du Harvard Law School Forum on Corporate Governance,résume très bien les devoirs et les responsabilités des administrateurs de sociétés de nos jours et renforce la nécessité, pour les conseils d’administration, de gérer les situations d’offres hostiles.

Bonne lecture ! Êtes-vous d’accord avec les attentes énoncées ? Vos commentaires sont les bienvenus.

The Spotlight on Boards

The ever evolving challenges facing corporate boards prompts an updated snapshot of what is expected from the board of directors of a major public company—not just the legal rules, but also the aspirational “best practices” that have come to have almost as much influence on board and company behavior.

Boards are expected to:

Establish the appropriate “Tone at the Top” to actively cultivate a corporate culture that gives high priority to ethical standards, principles of fair dealing, professionalism, integrity, full compliance with legal requirements and ethically sound strategic goals.

Choose the CEO, monitor his or her performance and have a succession plan in case the CEO becomes unavailable or fails to meet performance expectations.

Maintain a close relationship with the CEO and work with management to encourage entrepreneurship, appropriate risk taking, and investment to promote the long-term success of the company (despite the constant pressures for short-term performance) and to navigate the dramatic changes in domestic and world-wide economic, social and political conditions. Approve the company’s annual operating plan and long-term strategy, monitor performance and provide advice to management as a strategic partner.

Develop an understanding of shareholder perspectives on the company and foster long-term relationships with shareholders, as well as deal with the requests of shareholders for meetings to discuss governance and the business portfolio and operating strategy. Evaluate the demands of corporate governance activists, make changes that the board believes will improve governance and resist changes that the board believes will not be constructive. Work with management and advisors to review the company’s business and strategy, with a view toward minimizing vulnerability to attacks by activist hedge funds.

Organize the business, and maintain the collegiality, of the board and its committees so that each of the increasingly time-consuming matters that the board and board committees are expected to oversee receives the appropriate attention of the directors.

Plan for and deal with crises, especially crises where the tenure of the CEO is in question, where there has been a major disaster or a risk management crisis, or where hard-earned reputation is threatened by a product failure or a socio-political issue. Many crises are handled less than optimally because management and the board have not been proactive in planning to deal with crises, and because the board cedes control to outside counsel and consultants.

Determine executive compensation to achieve the delicate balance of enabling the company to recruit, retain and incentivize the most talented executives, while also avoiding media and populist criticism of “excessive” compensation and taking into account the implications of the “say-on-pay” vote.

Face the challenge of recruiting and retaining highly qualified directors who are willing to shoulder the escalating work load and time commitment required for board service, while at the same time facing pressure from shareholders and governance advocates to embrace “board refreshment”, including issues of age, length of service, independence, gender and diversity. Provide compensation for directors that fairly reflects the significantly increased time and energy that they must now spend in serving as board and board committee members. Evaluate the board’s performance, and the performance of the board committees and each director.

Determine the company’s reasonable risk appetite (financial, safety, cyber, political, reputation, etc.), oversee the implementation by management of state-of-the-art standards for managing risk, monitor the management of those risks within the parameters of the company’s risk appetite and seek to ensure that necessary steps are taken to foster a culture of risk-aware and risk-adjusted decision-making throughout the organization.

Oversee the implementation by management of state-of-the-art standards for compliance with legal and regulatory requirements, monitor compliance and respond appropriately to “red flags.”

Take center stage whenever there is a proposed transaction that creates a real or perceived conflict between the interests of stockholders and those of management, including takeovers and attacks by activist hedge funds focused on the CEO.

Recognize that shareholder litigation against the company and its directors is part of modern corporate life and should not deter the board from approving a significant acquisition or other material transaction, or rejecting a merger proposal or a hostile takeover bid, all of which is within the business judgment of the board.

Set high standards of social responsibility for the company, including human rights, and monitor performance and compliance with those standards.

Oversee relations with government, community and other constituents.

Review corporate governance guidelines and committee charters and tailor them to promote effective board functioning.

To meet these expectations, it will be necessary for major public companies

(1) to have a sufficient number of directors to staff the requisite standing and special committees and to meet expectations for diversity;

(2) to have directors who have knowledge of, and experience with, the company’s businesses, even if this results in the board having more than one director who is not “independent”;

(3) to have directors who are able to devote sufficient time to preparing for and attending board and committee meetings;

(4) to provide the directors with regular tutorials by internal and external experts as part of expanded director education; and

(5) to maintain a truly collegial relationship among and between the company’s senior executives and the members of the board that enhances the board’s role both as strategic partner and as monitor.

________________________________________________

* Martin Lipton is a founding partner of Wachtell, Lipton, Rosen & Katz, specializing in mergers and acquisitions and matters affecting corporate policy and strategy

Les « Hedge Funds » contribuent-ils à assurer la croissance à long terme des entreprises ciblées ?

Voici un article publié par IEDP (International Executive Development Programs) et paru sur le site http://www.iedp.com

Comme vous le constaterez, l’auteur fait l’éloge des effets positifs de l’activisme des actionnaires qui, contrairement à ce que plusieurs croient, ajoutent de la valeur aux organisations en opérant un assainissement de la gouvernance.

Je sais que les points de vue concernant cette forme d’activisme sont très partagés mais les auteurs clament que les prétentions des anti-activistes ne sont pas fondées scientifiquement.

En effet, les recherches montrent que les activités des « hedges funds » contribuent à améliorer la valeur ajoutée à long terme des entreprises ciblées.

La lecture de cet article vous donnera un bon résumé des positions en faveur de l’approche empirique. Votre idée est-elle faite à ce sujet ?

Do Hedge Funds Create Sustainable Company Growth ?

Hedge funds get a bad press but are they really a negative force? Looking at their public face, on the one hand we see so the called ‘vulture’ funds that this month forced Argentina into a $1.5bn default, on the other hand we recall that the UK’s largest private charitable donation, £466 million, was made by hedge fund wizard Chris Cooper-Hohn. Looking beyond the headlines the key question is, do hedge funds improve corporate performance and generate sustainable economic growth or not?

Researchers at Columbia Business School, Duke Fuqua School of Business and Harvard Law School looked at this most important question and discovered that despite much hype to the contrary the long-term effect of hedge funds and ‘activists shareholders’ is largely positive. They tested the conventional wisdom that interventions by activist shareholders, and in particular activist hedge funds, have an adverse effect on the long-term interests of companies and their shareholders and found it was not supported by the data.

Their detractors have long argued that hedge funds force corporations to sacrifice long-term profits and competitiveness in order to reap quick short-term benefits. The immediate spike that comes after interventions from these activist shareholders, they argue, inevitably leads to long-term declines in operating performance and shareholder value.

Three researchers, Lucian Bebchuk of Harvard Law School, Alon Brav of Duke Fuqua School of Business, and Wei Jiang of Columbia Business School argue that opponents of shareholder activism have no empirical basis for their assertions. In contrast, their own empirical research reveals that both short-term and long-term improvements in performance follow in the wake of shareholder interventions. Neither the company nor its long-term shareholders are adversely affected by hedge fund activism.

Their paper published in July 2013 reports on about 2,000 interventions by activist hedge funds during the period 1994-2007, examining a long time window of five years following the interventions. It found no evidence that interventions are followed by declines in operating performance in the long term. In fact, contrary to popular belief, activist interventions are followed by improved operating performance during the five-year period following these interventions. Furthermore the researchers discovered that improvements in long-term performance, were also evident when the intervention were in the two most controversial areas – first, interventions that lower or constrain long-term investments by enhancing leverage, beefing up shareholder pay-outs, or reducing investments and, second, adversarial interventions employing hostile tactics.

There was also no evidence that initial positive share price spikes accompanying activist interventions failed to appreciate their long-term costs and therefore tend to be followed by negative abnormal returns in the long term; the data is consistent with the initial spike reflecting correctly the intervention’s long-term consequences.

‘Pumping-and-dumping’ (i.e. when the exit of an activist is followed by long-term negative returns) is much sited by critics. But no evidence was found of this. Another complaint, that activist interventions during the years preceding the financial crisis rendered companies more vulnerable, was also debunked, as targeted companies were no more adversely affected by the crisis than others.

In light of the recent events in Argentina it is salutary to recall this important research. The positive aspect of activist hedge fund activity that it reveals should be born in mind when considering the ongoing policy debates on corporate governance, corporate law, and capital markets regulation. Business leaders, policy makers and institutional investors should reject the anti-hedge fund claims often used by detractors as a basis for limiting the rights and involvement of shareholders, and should support expanding rather than limiting the rights and involvement of shareholders. Boards and their executives should carefully monitor these debates in order to prepare for corporate governance’s evolving policy environment.

Pour une supervision efficace de la fonction audit interne | PwC

Vous trouverez ci-dessous un document de référence publié par PwC et paru dans la série Audit Committee Excellence. Ce document, partagé par Denis Lefort, CPA, CIA, CRMA, expert-conseil en Gouvernance, audit et contrôle, apporte des réponses très complètes à plusieurs questions que les membres de conseils d’administration se posent eu égard au rôle de la fonction audit interne dans l’organisation.

1. Pourquoi la surveillance de l’audit interne est-elle critique pour les comités d’audit ?

2. Quel est le rôle des administrateurs dans l’optimisation des activités de l’audit interne ?

3. Comment aider l’audit interne à mieux définir sa mission ?

4. Quelles sont les lignes d’autorité et les besoins en ressources de cette activité ?

5. Quel est le processus de révision des résultats de l’audit interne ?

6. Que faire si votre entreprise ne possède pas une fonction d’audit interne ?

Ce document sera donc très utile à tout administrateur soucieux de parfaire ses connaissances sur le rôle très important qu’un service d’audit interne peut jouer.

Voici une introduction au rapport de PwC . Bonne lecture ! Vos commentaires sont les bienvenus.

Effective oversight of the internal audit function | PwC

The audit committee’s role is not getting any easier, but an audit committee has a lot of resources in its arsenal to help meet today’s high expectations. One of these tools is the internal audit function. Directors can, and should, focus on maximizing the value proposition of this group to ensure their own success.

A lot goes on in companies — and a lot can go wrong, even when you have good people and thoughtfully designed processes. That’s why so many audit committees look to internal audit as their eyes and ears — a way to check whether things are working as they should. Some companies staff the function internally, while others choose to outsource some or all of the role. Some do not have an internal audit function at all.

For many audit committees, overseeing internal audit isn’t just the right thing to do, it’s a requirement. At NYSE companies, audit committees have to oversee internal audit’s performance and periodically meet in private sessions. NASDAQ is currently considering whether to require its listed companies to have an internal audit function and what role audit committees should play.

Whether a required function or not, we believe it’s critical that audit committees focus on internal audit. Why? PwC’s 2014 State of the internal audit profession study found that about one-third of board members believe internal audit adds less than significant value to the company, and only 64% of directors believe internal audit is performing well at delivering expectations. Even Chief Audit Executives (CAEs) are critical of their functions’ performance, with just two-thirds saying it’s performing well.

Le C.A. doit clarifier les rôles de chef de la conformité (CCO) et de chef des affaires juridiques (General Counsel)

On note une ambigüité de rôle croissante entre les fonctions de chef de la conformité (CCO) et de chef du contentieux (General Counsel). Cet article de Michael W. Peregrine, associé de la firme McDermott Will & Emery vise à souligner les responsabilités réciproques de chaque poste ainsi qu’à montrer que celles-ci ont intérêt à être mieux définies afin d’éviter les risques de conflits associés à leur exécution.

L’auteur suggère que le rôle de chef de la conformité prend une place de plus en plus prépondérante dans la structure des organisations, en vertu du caractère « d’indépendance » rattaché à cette fonction. Les deux postes doivent donc être dissociés, le chef du contentieux se rapportant au PDG et le chef de la conformité se rapportant au conseil d’administration !

L’article insiste sur une meilleure description de ces deux postes et sur le rôle que doit jouer le conseil d’administration à cet égard.

Je vous invite à lire ce court article paru sur le blogue du Harvard Law School Forum on Corporate Governance afin de mieux connaître la nature des arguments invoqués. Bonne lecture !

Compliance or Legal? The Board’s Duty to Assure Clarity

Key Developments

Government Positions. The first, and perhaps most pronounced, of these developments has been efforts of the federal government to encourage (and, in some cases, to require) that the positions of compliance officer and general counsel be separate organizational positions held by separate officers; that the compliance officer not report to the general counsel; and that the compliance officer have a direct reporting relationship to the governing board.

There also appears to be a clear trend—while certainly not universal—among many corporations to follow the government’s lead and adopt the “separate relationship” structure, for a variety of valid and appropriate reasons. Yet, the focus on compliance officer “independence” obscures the need for compliance programs to have leadership from, coordination of or other connection to, the general counsel.

Another concern arises from the (dubious) perspective that the compliance officer should not have a reporting relationship to the general counsel. One of the underlying premises here is that the general counsel somehow has at least a potential, if not actual, conflict of interest with respect to advice that the compliance officer may provide to management or the board. However, this perspective ignores critical professional responsibility obligations of the general counsel (e.g., Rules 1.6, 1.7 and 1.13).

The third, and potentially most significant of these potential concerns relates to the preservation of the attorney-client privilege when the chief compliance officer is not the general counsel. In a recent published article, a leading corporate lawyer argues persuasively that the forced separation of the compliance and legal functions jeopardizes the ability to preserve the privilege in connection with corporate compliance based investigations.

Corporate Guardian. A second, and more subtle, development has been a series of public comments by compliance industry thought leaders suggesting that the role of “guardian of the corporate reputation” is exclusively reserved for the corporate compliance officer; that the compliance officer is the organizational “subject matter expert” for ethics and culture, as well as compliance. This “jurisdictional claim” appears to be premised on the questionable perspective that “lawyers tell you whether you can do something, and compliance tells you whether you should”.

This perspective ignores the extent to which the general counsel is specifically empowered to provide such advice by virtue of the rules of professional responsibility; principally Rule 2.1 (“Advisor”). It is also contrary to long standing public discourse that frames the lawyer’s role as a primary guardian of the organizational reputation. For example, the estimable Ben Heineman, Jr. has described the role of the general counsel as the “lawyer-statesman”, the essence of which is the responsibility to “move beyond the first question—‘is it legal?’—to the ultimate question—‘is it right?’”

Job Descriptions. The third significant development is efforts by compliance industry commentators to extend the portfolio of the CCO, to a point where it appears to conflict with the expanding role of the general counsel. As one prominent compliance authority states, “The CCO mandate is ambitious, broad, and complex; no less than to oversee the organization’s ability to ‘prevent and detect misconduct’”.

This point of view is being used to justify greater compliance officer involvement in matters such as internal investigations, corporate governance, conflict of interest resolution, the development of codes of ethics, and similar areas of organizational administration.

The debate over roles and responsibilities is exacerbated by the extent to which the term “compliance” continuously appears in the public milieu in the form of “shorthand”. In this way, the term appears to reference some sort of broad organizational commitment to adherence with applicable law; i.e., more as a state of corporate consciousness than as an executive-level job description. To the extent that “compliance” is used loosely in the business and governance media, it serves to confuse corporate leadership about the real distinctions between accepted legal and compliance components.

Expansive definitions of the compliance function are also at odds with new surveys that depict the expanding organizational prominence of the general counsel. These new surveys lend empirical support to the view that the general counsel of a sophisticated enterprise (such as a health care system) has highly consequential responsibilities, and thus should occupy a position of hierarchical importance within the organization.

The Board’s Role

As developments cause the roles and responsibilities of the compliance officer and the general counsel to become increasingly blurred, the board has an obligation to establish clarity and reduce the potential for organizational risk. The failure to clearly delineate the respective duties of these key corporate officers can create administrative waste and inefficiency; increase internal confusion and tension; jeopardize application of the attorney-client privilege, and “draw false distinctions between organizational and legal risk”.

An effective board response would certainly include directing the compliance officer and general counsel, with the support of the CEO and outside advisors, to prepare for board consideration a set of mutually acceptable job descriptions for their respective positions. This would include a confirmation of the board reporting rights of both officers. It would also include the preparation of a detailed communication protocol that would address important GC/CCO coordination issues.

The perceptive board may also wish to explore, with the support of external advisors, the very sensitive core issues associated with compliance officer independence, and with the hierarchical position of the compliance officer; i.e., should that position be placed in the corporate hierarchy on an equal footing with the corporate legal function, or in some subordinate or other supporting role.

The board can and should be assertive in adopting measures that support the presence of a vibrant, effective compliance program that teams productively with the general counsel.

Ce que chaque administrateur de sociétés devrait savoir à propos de la sécurité infonuagique

Cet article est basé sur un rapport de recherche de Paul A. Ferrillo, avocat conseil chez Weil, Gotshal & Manges, et de Dave Burg et Aaron Philipp de PricewaterhouseCoopers. Les auteurs présentent une conceptualisation des facteurs infonuagiques (cloud computing) qui influencent les entreprises, en particulier les comportements de leurs administrateurs.

L’article donne une définition du phénomène infonuagique et montre comment les conseils d’administration sont interpellés par les risques que peuvent constituer les cyber-attaques. En fait, la partie la plus intéressante de l’article consiste à mieux comprendre, ce que les auteurs appellent, la « Gouvernance infonuagique » (Cloud Cyber Governance).

L’article propose plusieurs questions critiques que les administrateurs doivent adresser à la direction de l’entreprise. Vous trouverez, ci-dessous, les points saillants de cet article lequel devrait intéresser les administrateurs préoccupés par les aspects de sécurité des opérations infonuagiques. Bonne lecture !

Cloud Cyber Security: What Every Director Needs to Know

« There are four competing business propositions affecting most American businesses today. Think of them as four freight trains on different tracks headed for a four-way stop signal at fiber optic speed.

First, with a significant potential for cost savings, American business has adopted cloud computing as an efficient and effective way to manage countless bytes of data from remote locations at costs that would be unheard of if they were forced to store their data on hard servers. According to one report, “In September 2013, International Data Corporation predicted that, between 2013 and 2017, spending on pubic IT cloud computing will experience a compound annual growth of 23.5%.” Another report noted, “By 2014, cloud computing is expected to become a $150 billion industry. And for good reason—whether users are on a desktop computer or mobile device, the cloud provides instant access to data anytime, anywhere there is an Internet connection.”

The second freight train is data security. Making your enterprise’s information easier for you to access and analyze also potentially makes it easier for others to do, too. 2013 and 2014 have been the years of “the big data breach,” with millions of personal data and information records stolen by hackers. Respondents to the 2014 Global State of Information Security® Survey reported a 25% increase in detected security incidents over 2012 and a 45% increase compared to 2011. Though larger breaches at global retailers are extremely well known, what is less known is that cloud providers are not immune from attack. Witness the cyber breach against a file sharing cloud provider that was perpetrated by lax password security and which caused a spam attack on its customers. “The message is that cyber criminals, just like legitimate companies, are seeing the ‘business benefits’ of cloud services. Thus, they’re signing up for accounts and reaching sensitive files through these accounts. For the cyber criminals this only takes a run-of-the-mill knowledge level … This is the next step in a new trend … and it will only continue.”

The third freight train is the plaintiff’s litigation bar. Following cyber breach after cyber breach, they are viewing the corporate horizon as rich with opportunities to sue previously unsuspecting companies caught in the middle of a cyber disaster, with no clear way out. They see companies scrambling to contend with major breaches, investor relation delays, and loss of brand and reputation.

The last freight train running towards the intersection of cloud computing and data security is the topic of cyber governance—i.e., what directors should be doing or thinking about to protect their firm’s most critical and valuable IP assets. In our previous article, we noted that though directors are not supposed to be able to predict all potential issues when it comes to cyber security issues, they do have a basic fiduciary duty to oversee the risk management of the enterprise, which includes securing its intellectual property and trade secrets. The purpose of this article is to help directors and officers potentially avoid a freight train collision by helping the “cyber governance train” control the path and destiny of the company. We will discuss basic cloud security principles, and basic questions directors should ask when considering whether or not the data their management desires to run on a cloud-based architecture will be as safe from attack as possible. As usual when dealing with cyber security issues, there are no 100% foolproof answers. Even cloud experts disagree on cloud-based data security practices and their effectiveness] There are only good questions a board can ask to make sure it is fulfilling its duties to shareholders to protect the company’s valuable IP assets.

What is Cloud Computing/What Are Its Basic Platforms

“Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services). Cloud computing is a disruptive technology that has the potential to enhance collaboration, agility, scaling, and availability, and provides the opportunities for cost reduction through optimized and efficient computing. The cloud model envisages a world where components can be rapidly orchestrated, provisioned, implemented and decommissioned, and scaled up or down to provide an on-demand utility-like model of allocation and consumption.”

Cloud computing is generally based upon three separate and distinct architectures that matter when considering the security of the data sitting in the particular cloud environment.

……

Cloud Cyber Governance

As shown above, what is commonly referred to as the cloud actually can mean many different things depending on the context and use. Using SaaS to manage a customer base has a vastly different set of governance criteria to using IaaS as a development environment. As such, there are very few accepted standards for properly monitoring/administering a cloud-based environment. There are many IT consultants in the cloud-based computing environment that can be consulted in that regard. Our view, however, is that directors are ultimately responsible for enterprise risk management, and that includes cyber security, a subset of which is cloud-based cyber-security. Thus it is important for directors to have a basic understanding of the risks involved in cloud-based data storage systems, and with cloud-based storage providers. Below are a few basic questions that come to mind that a director could pose to management, and the company’s CISO and CIO:

1. Where will your data be stored geographically (which may determine which laws apply to the protection of the company’s data), and in what data centers?

2. Is there any type of customer data co-mingling that could potentially expose the company data to competitors or other parties?

3. What sort of encryption does the cloud-based provider use?

4. What is the vendor’s backup and disaster recovery plan?

5. What is the vendor’s incident response and notification plan?

6. What kind of access will you have to security information on your data stored in the cloud in the event the company needs to respond to a regulatory request or internal investigation?

7. How transparent is the cloud provider’s own security posture? What sort of access can your company get to the cloud provider’s data center and personnel to make sure it is receiving what it is paying for?

8. What is the cloud servicer’s responsibility to update its security systems as technology and sophistication evolves?

9. What is the cloud provider’s ability to timely detect (i.e., continuously monitor) and respond to a security incident, and what sort of logging information is kept in order to potentially detect anomalous activity?

10. Are there any third party requirements (such as HITECH/HIPAA) that the provider needs to conform to for your industry?

11. Is the cloud service provider that is being considered already approved under the government’s FedRamp authorization process, which pre-approves cloud service providers and their security controls?

12. Finally, does the company’s cyber insurance liability policy cover cloud-based Losses assuming there is a breach and customer records are stolen or otherwise compromised? This is a very important question to ask, especially if the company involved is going to use a cyber-insurance policy as a risk transfer mechanism. When in doubt, a knowledgeable cyber-insurance broker should be consulted to make sure cloud-based Losses are covered.

High-profile breaches have proven conclusively that cybersecurity is a board issue first and foremost. Being a board member is tough work. Board members have a lot on their plate, including, first and foremost, financial reporting issues. But as high-profile breaches have shown, major cyber breaches have almost the same effect as a high profile accounting problem or restatement. They cause havoc with investors, stock prices, vendors, branding, corporate reputation and consumers. Directors should be ready to ask tough questions regarding cyber security and cloud-based security issues so they do not find themselves on the wrong end of a major data breach, either on the ground or in the cloud. »

Que faire quand la confiance entre le conseil et la direction est faible ? | Le cas d’une OBNL

Voici un cas qui origine du blogue australien de Julie Garland McLellan et qui intéressera certainement tous les membres de conseils d’administration d’OBNL. J’ai choisi de partager ce cas en gouvernance avec vous car je crois que celui-ci évoque trop souvent les situations vécues par certaines organisations à but non lucratif.

Ce cas présente la situation réelle d’une entreprise dont les liens de confiance entre le C.A. et la direction se sont effrités.

Qu’en pensez-vous ? Que feriez-vous à la place de Jake ? Quelle analyse vous semble la plus appropriée dans notre contexte ? Que pensez-vous des analyses effectuées par les trois experts ?

« Boards operate best when each director trusts each other director to adhere to the jointly accepted governance processes and policies as well as the relevant laws and regulations. This month our real life case study considers what to do when that trust is lost. Consider: What would you advise a friend to do under these circumstances ? »

Que faire quand la confiance est perdue ?

« Jake is a club chairman. The former chairman resigned after a major disagreement with the rest of the board which arose because the former chairman signed a major contract. When the board discovered what had happened they were furious that a large decision had been made without involving them. The former chairman stormed from the meeting and resigned in writing the following morning.

The Board then acted without a formal chair, directors took turns to chair the meetings, until the next election. During this time the board rewrote the by-laws which previously allowed the chairman to sign contracts after verification by the treasurer that doing so would not lead to insolvency. They adopted new by-laws that stated no director, including – for absence of doubt – the chairman and/or treasurer, could commit the club to any contract, expenditure or course of action unless approved in a duly constituted board meeting.

Jake was not previously on the board and was elected unopposed after being invited by the treasurer to stand for election. He is a successful businessman but has no experience with consensual board decision-making. He has now discovered that the club is wallowing because recent decisions have not been made in a timely fashion. His fellow directors are numerous, factionated and indecisive. The CEO has low delegations and the constitution envisages that the chairman, CEO and treasurer should make decisions between meetings and use the board to ratify strategy, engage members and provide oversight. The amended by-laws prevent the constitution from working but don’t provide an alternative workable model.

The board reacted with horror to a suggestion that they soften the new by-laws but don’t appear willing to improve their own performance so the club can operate under the new by-laws. Staff performance reviews and bonuses are soon to be agreed and Jake is fairly certain that his board will not make rational decisions or support the CEO’s recommendations. He knows that he needs to act decisively to avert disaster but doesn’t know where to start.

How can Jake create an environment that allows for effective management of the club before this situation spirals out of control? »

Les comités de risques | Maintenant plus « risqués » que les comités d’audit !

Voici un excellent article publié hier par Howard Davies dans le FT portant sur les nouvelles réalités de la gouvernance, particulièrement dans les institutions financières.

En effet, une enquête du Financial Times (The FT’s A-List), montre, de manière convaincante, que les comités de risques sont maintenant plus « redoutés » que les comités d’audit. C’est un phénomène récent qui n’est pas encore bien documenté mais l’expérience des membres de conseils semble indiquer que ces comités sont moins recherchés, principalement parce que les experts en risques siégeant sur les conseils sont trop peu nombreux.

Il y a 10 ans, les administrateurs accordaient peu de temps à la surveillance des risques, faisant ainsi une confiance presqu’aveugle aux experts de la direction. Les préoccupations et les priorités des conseils ont changé radicalement depuis 2008, notamment depuis que les autorités réglementaires rendent obligatoire la constitution de comités de risques sur les C.A. des institutions financières.

Plusieurs autres secteurs d’activité ont suivis en accordant une place prépondérante à la gestion des risques et à la mise en place de comités de risques distincts des comités d’audit.

L’article ci-dessous présente l’état de la situation et les changements qui s’imposent dans la gouvernance des organisations, Voici un extrait de cet article. Bonne lecture !

Audit is no longer the chore the board dreads most

« There is uncertainty about what risk committees should do »

Until recently, most non-executive directors would have told you that the audit committee is the one they really wish to avoid. The meetings are long, the papers voluminous, and the duties burdensome. So the conclusion of a recent survey by Per Ardua, an executive search company, came as a surprise. Eighty per cent of respondents in the financial sector now say that the risk committee is the one to dodge – even though audit and remuneration committees have so far more often exposed non-executives to public criticism.

The FT’s A-List

The A-List provides timely, insightful comment on the topics that matter, from globally renowned leaders, policy makers and commentators

The survey responses suggest three possible explanations. First, the risk committee has a broad range of responsibilities. For a bank, traditional value-at-risk measures, which reflect the likelihood that the bank’s loans will go bad, are just the beginning. The agenda has broadened into operational, regulatory, legal and reputational risk, demanding detailed knowledge of all areas of the business – and of the relevant rules within which they operate. Regulation is increasingly complex, and varies significantly by country.

Second, whereas audit committees look backwards, risk committees must look forwards – a more difficult task. True, the dividing line is not quite so stark in practice; some auditors do live in the here and now. But overseeing future risks requires greater exercise of judgment, and involves the use of stress testing and other relatively novel techniques.

Third, the regulatory focus on risk committees has grown. Before the Walker review of corporate governance in financial firms, most banks in the UK did not have a separate risk committee. The same was true in the US. The audit committee did the job in its spare time. Now regulators on both sides of the Atlantic look to the risk committee and its chairman to answer for the stability of a bank, to oversee compliance with capital regulation and to take responsibility for its resolution and recovery plans. Those plans are highly technical.

Source: www.linkedin.com

Voir Scoop.it – gouvernance

Comment le C.A. peut-il s’acquitter de la surveillance des cyber-risques ?

Aujourd’hui, j’attire votre attention sur un article publié par Tom Hogue, paru sur le site Cisco Blog, qui porte sur les nouvelles responsabilités qui incombent aux membres des conseils d’administration en matière de surveillance des risques cybernétiques globaux de la société..

Il existe des « guidelines » très utiles qui peuvent aider les membres de la direction (CxC), ceux qui doivent attester (signer) de la véracité des éléments de divulgation relatifs aux risques cybernétiques.

Également, il existe des moyens pour les membres de conseils d’administration de s’assurer qu’ils exercent une veille efficace de ces risques. Cet article fait écho à la conférence du Gartner Security and Risk Management Summit , plus particulièrement à la session « Finding the Sweet Spot to Balance Cyber Risk ».

Tammie Gartner Session

À mon avis, tous les administrateurs devraient se familiariser avec l’environnement et la gestion des cyber-risques car ceux-ci peuvent avoir des conséquences dramatiques sur la performance de l’organisation.

La lecture de cet article vous sensibilisera davantage à votre rôle d’administrateur et aux conséquences qui en découlent. Voici un extrait de celui-ci. Bonne lecture !

Cyber Threat Management from the Boardroom Risk: Lost in Translation

During the session, the panel had been discussing how the senior leadership teams address the problem of putting their signatures against the risk that cyber threats pose to their organizations. Tammie Leith made a point to the effect that it is just as important for our teams to tell us why we should not accept or acknowledge those risks so that we can increase investments to mitigate those risks.

What caught my attention was that the senior management teams are beginning to question the technical teams on whether or not appropriate steps have been taken to minimize the risks to the corporation. The CxO (senior leadership team that has to put their signature on the risk disclosure documents) teams are no longer comfortable with blindly assuming the increasing risks to the business from cyber threats.

To make matters worse, the CxO teams and the IT security teams generally speak different languages in that they are both using terms with meanings relevant to their specific roles in the company. In the past, this has not been a problem because both teams were performing very critical and very different functions for the business. The CxO team is focused on revenue, expenses, margins, profits, shareholder value, and other critical business metrics to drive for success. The IT security teams, on the other hand, are worried about breaches, data loss prevention, indications of compromise, denial of services attacks and more in order to keep the cyber attackers out of the corporate network. The challenge is that both teams use the common term of risk, but in different ways. Today’s threat environment has forced the risk environment to blend. Sophisticated targeted attacks and advanced polymorphic malware affect a business’s bottom line. Theft of critical information, such as credit card numbers, health insurance records, and social security numbers, result in revenue losses, bad reputation, regulatory fines, and lawsuits. Because these teams have not typically communicated very well in the past, how can we ensure that they have a converged meaning for risk when they are speaking different “languages”?

In order to fully explore the variations to the term “risk” for the business, I wanted to understand what the Security Exchange Commission (SEC) required of corporations in reporting requirements to their shareholders. The 2013 Cybersecurity Executive Order signed by President Obama, and the release of the NIST Cyber Framework seemed to be giving the SEC a new reason to revisit the topic of cyber security with a revitalized vigor.

The SEC had already published guidance on how corporations should provide cyber security risk disclosures in the CV Disclosure Guidance: Topic No. 2 Date: October 13, 2011. However, the speech that SEC Commissioner Luis A. Aguilar gave at the “Cyber Risks and The Boardroom Conference” at the New York Stock Exchange on June 10 discussed what the “boards of directors can, and should, do to ensure that their organizations are appropriately considering and addressing cyber risks.” In proposing a strong case for the boards of directors to take action, he discussed the “threat of litigation and potential liability for failing to implement adequate steps to protect the company from cyber-threats.” He also discussed the derivative lawsuits that were brought against companies, their officers and directors relating to data breaches. What caught my attention most about the speech is when he said, “Thus, boards that chose to ignore, or minimize, the importance of cybersecurity oversight responsibility, do so at their own peril.”

Commissioner Aguilar made a strong recommendation for corporations to voluntarily adopt the NIST Cybersecurity Framework in order to begin addressing the problem with the statement, “While the Framework is voluntary guidance for any company, some commenters have already suggested that it will likely become a baseline for best practices by companies, including assessing legal or regulatory exposure to these issues or for insurance purposes.”

I am not disagreeing with Commissioner Aguilar, but in practice, this is an incredible challenge for any board of directors as they are now being asked to provide direct cyber security oversight to the internal day-to-day operations of the organization or risk “peril.”

…..

Les investissements des fonds activistes créent-ils une réelle valeur à long terme ?

Récemment, plusieurs experts de la gouvernance des sociétés se sont questionnés (et prononcés) sur la nature de la création de valeur et sur les conséquences à long terme apportées par les fonds de couverture (« edge funds »).

Ce court billet de Martin Lipton, associé principal de la firme Wachtell, Lipton, Rosen & Katz, spécialisée dans les activités de fusions et acquisitions ainsi que dans les questions qui touchent la gouvernance et les stratégies d’affaires, est basé sur la réponse que la firme adresse à une importante étude empirique des auteurs Lucian Bebchuk, Alon Brav, and Wei Jiang sur les bénéfices à long terme des actionnaires activistes.

Cette étude est disponible au lien suivant : The Long-Term Effects of Hedge Fund Activism. Les résultats sont résumés dans un billet du Forum post et dans le Wall Street Journal op-ed article.

Ce qu’il y a de particulier dans ce court billet de Lipton, c’est qu’il vante les mérites d’une étude de l’IGOPP qui pourfend la méthodologie de l’étude économétrique de Bebchuk et al.

Je vous invite donc au débat qui fait rage dans les cercles de la gouvernance en vous référant au document des auteurs Allaire et Dauphin.

“Activist” hedge funds

Voici cette courte introduction de Lipton qui illustre parfaitement sa prise de position en faveur des arguments de l’étude de l’IGOPP. Bonne lecture ! Vos commentaires sont appréciés.

About a year ago, Professor Lucian Bebchuk took to the pages of the Wall Street Journal to declare that he had conducted a study that he claimed proved that activist hedge funds are good for companies and the economy. Not being statisticians or econometricians, we did not respond by trying to conduct a study proving the opposite. Instead, we pointed out some of the more obvious methodological flaws in Professor Bebchuk’s study, as well as some observations from our years of real-world experience that lead us to believe that the short-term influence of activist hedge funds has been, and continues to be, profoundly destructive to the long-term health of companies and the American economy.

Recently, the Institute for Governance of Private and Public Organizations issued a paper that more systematically examines the flaws of Professor Bebchuk’s econometric and statistical models, concluding that “the Bebchuk et al. paper illustrates the limits of the econometric tool kit, its weak ability to cope with complex phenomena; and when it does try to cope, it sinks quickly into opaque computations, remote from the observations on which these computations are supposedly based.” The paper also observes that “activist hedge funds operate in a world without any other stakeholder than shareholders. That is indeed a myopic concept of the corporation bound to create social and economic problems, were that to become the norm for publicly listed corporations.”

Further the Institute’s paper concludes: “[T]he most generous conclusion one may reach from these empirical studies has to be that “activist” hedge funds create some short-term wealth for some shareholders (and immense riches for themselves) as a result of investors, who believe hedge fund propaganda (and some academic studies), jumping in the stock of targeted companies. In a minority of cases, activist hedge funds may bring some lasting value for shareholders but largely at the expense of workers and bond holders; thus, the impact of activist hedge funds seems to take the form of wealth transfer rather than wealth creation.”

The Institute’s paper, “Activist” hedge funds, is well worth reading for its academically rigorous, as well as common sense, refutation of Bebchuk’s claims.

L’étendue de la divulgation des facteurs de risque attribuée aux mesures règlementaires

Je partage avec vous aujourd’hui les résultats d’une étude effectuée par Karen K. Nelson, professeure de comptabilité à l’Université Rice et Adam C. Pritchard, professeur de droit à l’Université du Michigan. Cette étude est présentée sommairement sur le blogue du Harvard Law School; elle concerne l’étendue de la divulgation des facteurs de risque lorsque l’on compare les mesures règlementaires volontaires aux mesures obligatoires imposées par la SEC.

L’étude montre les différences des deux situations règlementaires en termes de la quantité de risques divulgués, de l’importance des mises à jour annuelles et de la compréhension des facteurs de risques par les lecteurs.

Les auteurs font le constat que la divulgation des facteurs de risque ayant donné lieu à des contestations judiciaires est beaucoup plus complète dans les années qui suivent. L’étude conclue que les mesures de divulgation imposées ont porté fruits.

Voici un extrait de l’article. Bonne lecture !

Shift from Voluntary to Mandatory Disclosure of Risk Factors

In our paper, Carrot or Stick? The Shift from Voluntary to Mandatory Disclosure of Risk Factors, we investigate public companies’ disclosure of risk factors that are meant to inform investors about risks and uncertainties. We compare risk factor disclosures under the voluntary, incentive-based disclosure regime provided by the safe harbor provision of the Private Securities Litigation Reform Act, adopted in 1995, and the SEC’s subsequent disclosure mandate, adopted in 2005.

The PSLRA’s safe harbor provision shields firms from liability for forward-looking statements provided they are accompanied by “meaningful cautionary statements identifying important factors that could cause actual results to differ materially from those in the forward looking statement.” The voluntary disclosure of risk factors provides a direct means for firms to reduce the often substantial expected costs of securities fraud class actions. Thus, the safe harbor provides an important incentive for public companies to disclose risk factors, but that incentive is likely to vary with firms’ perception of their potential vulnerability to securities class actions.

Risk factor disclosure shifted from a voluntary, incentive-based regime to a mandatory one in 2005 when the SEC added Item 1A to Form 10-K. Item 1A requires most public companies to disclose risk factors annually and update them quarterly as necessary in Form 10-Q.

We study how these two changes in the law affect the disclosure of risk factors. Our tests focus on three questions: First, we examine whether litigation risk plays an important role in firms’ disclosure practices, particularly during the voluntary disclosure period from 1996 to 2005. Second we test whether the SEC’s 2005 disclosure mandate narrows the gap between firms with a litigation–related incentive to provide risk factor disclosure and those compelled to disclose because of the mandate. Third, we assess whether differences in the quality of the disclosure affect its usefulness to investors in assessing firm risk.

To conduct our analyses, we use three metrics designed to capture characteristics of “meaningful” disclosure suggested by the PSLRA’s legislative history, subsequent court decisions, and the SEC:

(i) the amount of risk factor disclosure;

(ii) the extent to which the risk factors are updated year-to-year; and

(iii) the readability of the risk factors.

All else equal, risk factor disclosure is more “meaningful” if it is comprehensive, if it is not a boilerplate copy from the prior year, and if it can be understood by the average investor.

We use these disclosure metrics to investigate whether firms at greater risk of securities fraud lawsuits provide more “meaningful” risk factor disclosure, and how the SEC’s 2005 mandate affects this disclosure. Controlling for other factors that could affect the disclosure decision, we find that, on average, firms with greater litigation risk provide more risk factor disclosure, revise their disclosure more from year-to-year, and use more readable language than firms with low litigation risk. When we allow these effects to vary with the disclosure regime, we find significant differences in disclosure between high and low risk firms in the voluntary regime. After the SEC mandate in 2005, however, firms with low litigation risk increase converge with high risk firms in their risk factor disclosure.

We conclude that the SEC’s mandate had a material effect on the disclosure decisions of companies that had relatively little incentive to provide meaningful disclosure under the PSLRA’s safe harbor provision alone. We also find, however, that firms with high litigation risk continue to provide a significantly greater amount of risk factor disclosure in the mandatory regime. Moreover, in both disclosure regimes, high risk firms disclose significantly more risk factor information as litigation risk increases.

Finally, we find evidence that risk factor disclosures provide information useful to investors in assessing future firm risk, although here again the findings vary predictably with firms’ disclosure incentives and the disclosure regime. For firms with high litigation risk and hence greater incentive to provide meaningful disclosure, one-year-ahead beta and stock return volatility are increasing in the unexpected portion of risk factor disclosure. Moreover, in the voluntary disclosure regime, firms with high litigation risk provide risk factor disclosures that are significantly more informative about systematic and idiosyncratic risk than firms with low litigation risk. Subsequent to the SEC mandate, however, there is no statistical difference, consistent with a convergence in the meaningfulness of risk factor disclosures.

Overall, our findings suggest managers respond to high ex ante litigation risk with risk factor disclosures designed to reduce the expected costs of litigation. In contrast, low risk firms perceiving little net benefit to disclosure did not provide meaningful risk factor disclosure until compelled to do so by the SEC. Understanding risk factor disclosures is important to managers and legal counsel responsible for formulating a disclosure strategy, to regulators and courts charged with evaluating the quality of these disclosures, and to investors interested in assessing the risks posed by firms.

The full paper is available for download here.

Les grands enjeux reliés à la rémunération des administrateurs canadiens

Il y a peu d’informations colligées sur les rémunérations versées aux administrateurs de sociétés canadiennes. Michel Magnan, professeur et titulaire de la chaire de gouvernance d’entreprise Stephen A. Jarislowsky de l’École de gestion John-Molson, Université Concordia, a récemment publié, en collaboration avec l’IGOPP, les résultats d’une étude fort pertinente sur le sujet.

Le rapport fait ressortir plusieurs constats dont les suivants :

(1) Sur la période de 10 ans allant de 2001 à 2010, les honoraires annuels moyens touchés par les administrateurs de sociétés ouvertes canadiennes ont augmenté de 465%. Cette hausse considérable n’est toutefois pas uniforme parmi toutes les sociétés, puisque les augmentations les plus importantes se retrouvent dans les grandes institutions financières ainsi que dans les sociétés pétrolières et minières.

(2) La rémunération des administrateurs de sociétés canadiennes reste significativement inférieure à celle octroyée par des sociétés américaines comparables.

(3) La rémunération des administrateurs n’a pas atteint des niveaux que l’on pourrait juger excessifs compte tenu de l’accroissement des exigences institutionnelles et réglementaires durant la période.

(4) Le débat sur la rémunération des administrateurs et leur indépendance doit être vu comme un enjeu de composition et de fonctionnement du conseil d’administration. Si des cas de rémunération excessive surviennent, ils ne font que refléter des problèmes de gouvernance sous-jacents plus sérieux, lesquels minent la légitimité et possiblement la crédibilité du conseil

(5) Nous sommes dans un contexte de gouvernance fiduciaire. Les administrateurs sont donc préoccupés par la conformité aux lois et règlements, la mise en place et le suivi des mécanismes et des systèmes de contrôle, d’incitation et de reddition des comptes. Leur rémunération est ainsi fonction de ce rôle.

Vous trouverez, ci-dessous, un sommaire du rapport, notamment de ses recommandations. Bonne lecture !

Rémunération des administrateurs et gouvernance : enjeux et défis

Les attentes envers les administrateurs en termes de crédibilité, de disponibilité et de légitimité ont considérablement augmenté depuis le début des années 2000. Leur rémunération a suivi mais les jetons de présence ont-ils une incidence sur le comportement et les décisions des membres des conseils ?

….

Il ressort de cette analyse que la rémunération des administrateurs n’est qu’une facette de la gouvernance du conseil d’administration, et pas nécessairement la plus stratégique, puisqu’elle ajoute peu à des processus de nomination et d’évaluation des administrateurs qui sont déjà rigoureux. La rémunération des administrateurs doit refléter le fait que leur responsabilité est conjointe, continue et orientée vers la veille des intérêts à long terme de l’entreprise dans son ensemble, et non seulement des intérêts à court terme de certains actionnaires. À cet effet, le rapport propose plusieurs recommandations, notamment :

La priorité d’un conseil en matière de gouvernance est de maintenir et accroître sa légitimité et sa crédibilité au moyen de pratiques et processus rigoureux.

La rémunération des administrateurs ne doit pas reposer sur l’atteinte d’objectifs ou de buts à court terme.

La rémunération d’un administrateur doit être suffisamment élevée pour attirer des candidats crédibles, intègres et détenant les compétences spécifiques correspondant aux objectifs de la société.

Les administrateurs doivent détenir un investissement significatif à long terme dans les actions de l’entreprise.

La rémunération des administrateurs devrait être uniforme entre les individus qui ont des tâches similaires.

La rémunération des administrateurs doit refléter de manière rationnelle les risques spécifiques qu’ils encourent.

Les investisseurs n’hésitent pas à remettre en question les compétences et les décisions des administrateurs. Dans un tel contexte, leur rémunération risque de devenir un enjeu de gouvernance important. C’est pourquoi ce rapport de l’IGOPP cadre le débat par une analyse de déterminants potentiels de la rémunération et suggère des principes et recommandations qui permettront de guider le travail des conseils en la matière.

Le vote obligatoire des actionnaires dans les cas de changements importants prévient-il les mauvaises transactions ?

Quelles transactions devraient requérir l’approbation obligatoire de tous les actionnaires ? L’article de Marco Becht, professeur de gouvernance corporative à l’Université libre de Bruxelles; Andrea Polo, du département d’économie et Business à l’Universitat Pompeu Fabra et Barcelona GSE; et Stefano Rossi du département de finance de Purdue University, s’intéresse à la limite du pouvoir qu’il est nécessaire de laisser aux actionnaires plutôt qu’au conseil d’administration.

En Grande-Bretagne (UK), les offres faites à des entreprises-cibles de grandes tailles sont considérées comme des transactions de classe 1 et donc obligatoirement sujettes à l’approbation des actionnaires. Les résultats de cette étude montrent que les bénéfices financiers résultant d’une telle approche sont très importants.

Plusieurs juridictions ont choisi d’exclure les acquisitions de tailles importantes du vote de l’actionnariat, au détriment de l’avoir des actionnaires selon l’étude. Bien entendu, lorsqu’une transaction change profondément la nature de l’entreprise et peut potentiellement avoir des conséquences importantes sur la valeur des actions, celle-ci doit être traitée lors d’une assemblée extraordinaire des actionnaires.

« Our paper infers that mandatory voting makes boards more likely to refrain from overpaying or from proposing deals that are not in the interest of shareholders »

Voici un extrait de l’article publié dans le Harvard Law School Forum on Corporate Governance and Financial Regulation. Vous pouvez télécharger tout le document ici.

Bonne lecture ! Vos commentaires, portant sur la souveraineté des C.A., sont les bienvenus.

Does Mandatory Shareholder Voting Prevent Bad Corporate Acquisitions ?

In our paper, Does Mandatory Shareholder Voting Prevent Bad Corporate Acquisitions?, which was recently made publicly available as an ECGI and Rock Center Working Paper on SSRN, we examine how much power shareholders should delegate to the board of directors. In practice, there is broad consensus that fundamental changes to the basic corporate contract or decisions that might have large material consequences for shareholder wealth must be taken via an extraordinary shareholder resolution (Rock, Davies, Kanda and Kraakman 2009). Large corporate acquisitions are a notable exception. In the United Kingdom, deals larger than 25% in relative size are subject to a mandatory shareholder vote; in most of continental Europe there is no vote, while in Delaware voting is largely discretionary.

The consequences for Delaware corporation shareholders are well documented in the relevant finance literature. A large percentage of deals initiated by U.S. acquirers destroy shareholder value with aggregate announcement losses running in billions of U.S. dollars. Shareholder voting exists, but it is voluntary and therefore endogenous. Deals facing potential shareholder opposition can be restructured to avoid a vote, as was recently the case with Kraft Inc.’s bid for Cadbury Plc, after public opposition from Warren Buffett. Shareholder voting in the United States is not a binding constraint and previous empirical studies based on U.S. data are rendered inconclusive.

Under the U.K. listing rules, bids for relatively large targets are called “Class 1 transactions” and are subject to mandatory shareholder approval. In a representative sample of acquirers listed on the main market in London, Class 1 transactions are associated with an aggregate gain to acquirer shareholders of $13.6 billion, over 1992-2010. Similar U.S. transactions in terms of size and other observable characteristics that are not subject to shareholder approval are associated with an aggregate loss of $210 billion for acquirer shareholders over the same period; and smaller Class 2 U.K. transactions, also not subject to shareholder approval, are associated with an aggregate loss of $3 billion. The findings are robust to various controls for deal characteristics and also hold at the U.K. mandatory voting threshold, where deals are very similar except in their voting status.

How does mandatory voting bring about these positive Class 1 results? Our paper infers that mandatory voting makes boards more likely to refrain from overpaying or from proposing deals that are not in the interest of shareholders. We find that shareholders never voted against Class 1 transactions ex-post and deals that were poorly received by the market at announcement were often dropped before they reached the voting stage. The results show that giving shareholder a direct decision right over large transactions can have a positive causal impact by discouraging bad corporate acquisitions.

Many jurisdictions have chosen to exclude large acquisitions from the list of fundamental changes that are outside the scope of delegated board authority. The advantages of board delegation such as reduced legal costs and greater speed and flexibility are shown to be preferred to explicit shareholder approval. This study shows that the benefits of mandatory voting on large corporate acquisitions can be large, shedding new light on this trade-off.

L’État de l’audit interne à l’échelle internationale | Rapport 2014 de Thompson Reuters Accelus

Denis Lefort, CPA, expert-conseil en Gouvernance, audit et contrôle, vient de me faire parvenir l’édition 2014 de l’étude Thompson Reuters Accelus sur l’audit interne.

Ce sondage identifie des observations intéressantes pour la profession d’auditeur interne :

(1) Seulement un peu plus de 27% des services d’audit interne vérifient les processus de gouvernance de leur organisation;

(2) Il y a encore des écarts importants de perception entre les services d’audit interne et les comités d’audit quant aux priorités que devraient être celles des services d’audit interne;

(3) Les auditeurs internes investissent 45% de leur temps pour l’audit de la sécurité des TI;

(4) Près de 50% des services d’audit interne interagissent maintenant avec les autres fonctions d’assurance de leur organisation (Conformité, Gestion des risques, etc…).

Ce document sera donc très utile à tout administrateur soucieux de parfaire ses connaissances de l’état de la situation en 2014 dans le monde.

Bonne lecture. Vos commentaires sont les bienvenus. Voici le sommaire de l’étude.

ÉTAT DE L’AUDIT INTERNE – RAPPORT 2014 DE THOMSON REUTERS ACCELUS

Thomson Reuters Accelus’ annual State of Internal Audit Survey provides an insight into the experiences and expectations of internal audit professionals around the world. More than 900 internal audit practitioners across 50 countries participated in the 2014 survey sharing their views across a range of subjects, issues and concerns. The experiences shared in this report are intended to help internal audit functions and senior management benchmark the myriad of challenges faced and enable them to leverage the approach taken by their peers.

The survey has demonstrated that the world and work of internal audit continues to be as complex, and challenging as ever. Both the volume and diversity of issues that internal auditors need to understand and assess continues to increase globally and across all industries.

In fact, at a high level the results of the Thomson Reuters Accelus State of Internal Audit Survey have remained relatively unchanged for the last few years.

This year the results confirmed that the vast majority (81 percent) of internal auditors’ focus remains on providing assurance on the efficacy of internal control process. While assurance work is the traditional mainstay of internal audit there are a wide range of other areas and issues for internal auditors to consider, including:

(1) Nearly a quarter (24 percent) of internal auditors expect their personal liability to increase in 2014. The adequacy of internal auditors’ skills, focus and approach is firmly on the radar of regulators worldwide. It is no surprise, therefore, that internal auditors expect their own personal liability to increase in the near future.

(2) Nearly half (49 percent) of all internal auditors have had no involvement in assessing their firm’s culture. There are distinct regional variations with respondents from South America reporting that three-quarters (77 percent) of internal auditors have not assessed the culture of their firm.

(3) Just over a quarter (27 percent) of internal auditors have had no involvement in assessing their firm’s corporate governance; regionally this figure looks most concerning for North America, with 32 percent of internal auditors having no involvement.

4) Internal auditors spend 45 percent of their time on IT security and risk. Nearly half (48 percent) of respondents said that it should be a top priority for their organization and 35 percent said it would be a top challenge for boards of directors in 2014.

(5) Nearly half of the respondents (48 percent) expect to be spending more time reporting to senior management and tracking remedial actions. This is in addition to almost a quarter (24 percent) of internal auditors anticipating a need to focus on the implementation of industry-specific legislation.

(6) Nearly half of internal auditors interact with risk management (44 percent) and compliance (47 percent) on at least a monthly basis. While these figures are a slight improvement on last year it remains an area where improvements could be made.

(7) It is interesting that areas not considered a priority for internal audit included customer outcomes (6 percent), whistle-blowing (5 percent) and capital and liquidity (4 percent).

(8) Internal auditors’ perception of priorities for the board are not aligned with their own. The key challenges for internal auditors are greater complexity of issues and focus on risk and control, as well as changing business models. In contrast, boards’ priorities are corporate strategy, strategic risk management and legal and regulatory risk.

The growing focus which policymakers and regulators have been placing on culture, corporate governance and risk management has emphasized still further the need for a strong, well-resourced independent audit function operating, and in particular reporting, in close coordination with other risk and compliance functions, all with visible support from the top of the organization. Yet the results show a relatively unchanged picture in these areas from previous years. As the risks increase so does the need for internal audit to react to those changes.

Bras de fer entre Osisko et Goldcorp | Réflexions sur le rôle des administrateurs

Dans le cadre du cours à la maîtrise de Gouvernance de l’entreprise (DRT-6056) dispensé à la Faculté de droit de l’Université Laval, le professeur Ivan Tchotourian a bénéficié du Programme d’appui au développement pédagogique 2013-2014 et il a mis en place des méthodes innovantes d’apprentissage. Dans le cadre de ce programme, il a été proposé aux étudiants non seulement de mener des travaux de recherche sur des sujets qui font l’actualité en gouvernance de l’entreprise, mais encore d’utiliser un format original permettant la diffusion des résultats. Le présent billet expose le résultat des recherches menées par M. Philippe Côté et M^mesPatricia Gingras et Émilie Le-Huy.

Ce travail revient sur l’offre publique hostile qui a été lancée en janvier 2014 par l’entreprise Goldcorp sur la société québécoise aurifère Osisko et ouvre le débat entourant le contenu des devoirs fiduciaires des administrateurs.

Je vous en souhaite bonne lecture et suis certain que vous prendrez autant de plaisir à le lire que j’ai pu en prendre à le corriger. Merci encore à Jacques de permettre la diffusion de ce travail et d’offrir ainsi la chance à des étudiants de contribuer aux riches discussions dont la gouvernance d’entreprise est l’objet.

Ivan Tchotourian

Bras de fer entre Osisko et Goldcorp : réflexions sur le rôle des administrateurs

En janvier 2014, la minière vancouvéroise Goldcorp a lancé une offre publique d’achat dans le but de prendre le contrôle de la minière Osisko, une compagnie québécoise aurifère exploitée à Malartic, en Abitibi, et employant près de huit cent personnes. Osisko n’exploite pas seulement la plus grosse mine du Québec, mais aussi la plus grosse mine d’or du Canada.

D’« Osisko pour tous » à « tous pour Osisko »

Considérant que l’offre de Goldcorp ne s’insérait pas dans l’intérêt de la société et de ses parties prenantes, le conseil d’administration d’Osisko a fait connaître son désaccord à cette offre publique d’achat, devenue dès lors « hostile » (ci-après « OPA hostile »), et a multiplié depuis les mesures défensives dans l’espoir de contrer celle-ci et de protéger sa société. Elle a ainsi saisi la Cour supérieure[1] et sollicité de nouveaux investisseurs. Tel que l’illustre l’importante couverture médiatique entourant la guerre ouverte ayant cours entre Osisko et Goldcorp, cette dernière ne laisse personne indifférent. Il faut reconnaître qu’une prise de contrôle de la société Osisko par Goldcorp pourrait vraisemblablement mener à la perte d’un siège social important pour le Québec qui verrait un grand moteur économique lui échapper, ce qui n’est pas sans inquiéter les parties prenantes d’Osisko. La bataille d’Osisko a récemment connu un nouveau souffle avec l’arrivée d’un chevalier blanc, mettant à profit certaines des parties prenantes de sa société[2] et augmentant ainsi considérablement ses chances de bloquer l’OPA hostile de Goldcorp[3]. Soulignons toutefois que la partie est loin d’être gagnée puisque Goldcorp a récemment bonifié son offre afin de concurrencer celle du chevalier blanc d’Osisko, la minière torontoise Yamana[4].

Du « déjà-vu » sous le thème des OPA hostiles

Alors que l’aventure d’Osisko se poursuit, celle-ci ramène au premier plan les préoccupations énoncées par la communauté des affaires au cours des dernières années, alors que Rona et Fibrek faisaient face à la menace d’une OPA hostile. Elle rappelle également, par voie de conséquences, les recommandations que l’Autorité des marchés financiers (ci-après l’« AMF ») ainsi que le groupe de travail mandaté par le gouvernement (ci-après le « Groupe de travail ») ont respectivement formulées récemment en vue d’améliorer la protection des sociétés eu égard aux OPA hostiles[5]. Elle met à nouveau en lumière les incohérences du droit des sociétés et du droit boursier devant guider les décisions des administrateurs dans l’exercice de leur devoir fiduciaire. La bataille entre Osisko et Goldcorp relance un débat qui ne s’est finalement jamais conclu : quelle discrétion devrait être accordée aux administrateurs d’une société dans l’exercice des moyens défensifs visant à contrer une OPA hostile ?

Une question d’intérêt

Rappelons que les administrateurs d’une société doivent en tout temps agir dans l’intérêt de la société en vertu des lois québécoise et canadienne[6]. Ces lois ne définissant pas clairement le critère de « l’intérêt de la société », celui-ci demeure sujet à interprétation. Il appert d’ailleurs des récents développements en gouvernance qu’il y a effectivement matière à interprétation : l’intérêt de la société oscille toujours entre sa conception traditionnelle, fondée sur la primauté des actionnaires, soutenue par une réglementation boursière formaliste, commandant de favoriser les actionnaires envers et contre tout, et son courant plus libéral, largement influencé par nos voisins américains, puis supportée par d’importantes décisions de la Cour suprême du Canada, telles que les causes Peoples[7] et BCE[8]. Il en ressort ainsi que la grande déférence qu’accordent les tribunaux judiciaires aux décisions des administrateurs[9] se voit limitée, par ailleurs, par la réglementation des autorités canadiennes en valeurs mobilière qui leur commande de garantir le libre choix des actionnaires de la société, à qui l’OPA hostile est adressée[10]. Bien que cette réglementation se justifie aisément en raison du contrôle qu’elle permet d’exercer sur l’opportunisme des administrateurs de la société, il n’en demeure pas moins qu’elle réduit considérablement la discrétion des administrateurs dans l’évaluation du meilleur intérêt de la société, lequel prendra naturellement des allures traditionnelles.

L’espoir du renouveau

Par leur nature fortement inspirée du droit émanant du Delaware[11], les recommandations de l’AMF et du Groupe de travail semblent s’insérer dans une volonté de plus en plus populaire d’élargir la discrétion des administrateurs, afin qu’ils puissent considérer plus librement l’intérêt des parties prenantes dans l’exercice de leur pouvoir décisionnel face à une OPA hostile, ce qui pourrait contribuer d’autant à la clarification de leur devoir fiduciaire dans un tel contexte. Cependant, ces mesures n’auront rien d’une panacée tant que les autres provinces canadiennes n’adopteront pas des mesures semblables à celles proposées par l’AMF et n’emboîteront pas le pas au Québec, ce qui est loin d’être chose faite[12].

Le dernier acte

Pour l’heure, il semble bien que le salut d’Osisko repose entièrement sur l’ardeur de ses administrateurs à préserver l’intérêt à long terme de la société, qui s’inscrit du même coup dans l’intérêt de ses parties prenantes. Dans un monde où le meilleur intérêt de la société ne fait pas consensus, laissant planer le spectre d’une lourde responsabilité à l’encontre de toute décision des administrateurs s’éloignant de la traditionnelle conception de la primauté des actionnaires, il y a lieu de se demander jusqu’où les administrateurs pourront porter leur étendard avant de se voir attribuer l’étiquette des opportunistes.

Philippe Côté

Patricia Gingras

Émilie Le-Huy

Anciens étudiants du cours DRT-6056 Gouvernance de l’entreprise

_____________________________________________________

[1] Osisko, qui reprochait à Goldcorp d’avoir agi de mauvaise foi dans le cadre de la présentation de son OPA, a finalement retiré sa poursuite. Voir Agence France-Presse, « Osisko retire sa poursuite contre Goldcorp », affaires.lapresse.ca, 3 mars 2014.

[2] Lesaffaires.com, « Osisko trouve son sauveur: Yamana Gold », lesaffaires.com, 2 avril 2014 ; Sylvain Larocque, « La Caisse appuie le chevalier blanc d’Osisko », affaires.lapresse.ca, 2 avril 2014.

[3] En effet, avec l’aide de la Caisse de dépôt et de placement du Québec ainsi que l’Office d’investissement du Régime de pensions du Canada (OIRPC), l’entreprise torontoise Yamana Gold propose d’acheter la moitié de la société aurifère québécoise pour un montant 1,37 milliard, une offre qui vient concurrencer celle de Goldcorp. Voir J.-P. Décarie, « Osisko, un très bon coup de la Caisse », affaires.lapresse.ca, 5 avril 2014.

[4] Lesaffaires.com, « Goldcorp bonifie son offre pour Osisko », lesaffaires.com, 10 avril 2014.

[5] L’AMF propose dans son rapport des modifications radicales de la règlementation concernant le rôle des régulateurs de valeurs mobilières. Selon certains experts, ses propositions se rapprochent de la législation du Delaware, où plus de 60 % des grandes entreprises ont leur siège juridique.Voir le rapport de l’AMF : AUTORITÉ DES MARCHÉS FINANCIERS, Un regard différent sur l’intervention des autorités en valeurs mobilières dans les mesures de défense, Document de consultation, Montréal, 2013. Voir également à ce sujet Y. allaire, « Le Québec : sièges sociaux et prises de contrôle », lesaffaires.com, 24 février 2014. Quant aux recommandations du Groupe de travail, voir Groupe de travail sur la protection des entreprises au Québec, Le maintien et le développement des sièges sociaux au Québec, Québec, Gouvernement du Québec, 2014.

[6] Loi sur les sociétés par actions, L.R.Q. c. S-31.1, art. 119 ; Loi canadienne sur les sociétés par actions, L.R.C. 1985, c. C-44, art. 122.

[7] Magasins à rayons Peoples inc. c. Wise, [2004] 3 R.C.S. 461.

[8] BCE Inc. c. Détenteurs de débentures de 1976, [2008] 3 R.C.S. 560.

[9] Sur la règle de l’appréciation commerciale, voir R. Crête et S. Rousseau, Droit des sociétés par actions, 3^e éd., Montréal, Éditions Thémis, 2011, aux par. 1036-1058.

[10] Règlement 62-104 sur les offres publiques d’achat et de rachat, L.R.Q. c. V-1.1, r. 35 ; Avis 62-202 relatif aux mesures de défense contre une offre publique d’achat, Bulletin hebdomadaire, vol. XXXIV, n^o 28, 18 juillet 2003.

[11] Sur le droit du Delaware, voir S. Rousseau et P. Desalliers, Les devoirs des administrateurs lors d’une prise de contrôle : étude comparative du droit du Delaware et du droit canadien, Montréal, Édtions Themis, 2007.

[12] Pensons notamment aux défis que représente l’harmonisation d’un tel régime avec l’ensemble des législations fédérales et provinciales (autres que québécoises) auxquelles seront confrontées tôt ou tard les entreprises québécoises désirant s’inscrire à la Bourse de Toronto. Voir M. Vallières, « Québec devrait s’aligner avec les provinces et Ottawa », lesaffaires.com, 22 février 2014.

La saga d’American Apparel | Une affreuse gouvernance

Voici un article publié par Gael O’Brien dans Business Ethics sur la saga de la gouvernance à American Apparel. Le fondateur Charney est en guerre contre son conseil d’administration pour une foule de raisons, valables à mon point de vue.

La situation est d’autant plus saugrenue que le président Charney est responsable de la nomination des membres du C.A. !

Je vous invite à une lecture pimentée d’une situation surréelle dont vous trouverez un extrait ci-dessous.

American Apparel: Sex, Power and Terrible Corporate Governance

The American Apparel story gets crazier by the moment.

Actions taken by the company’s board two weeks ago to attempt to remove founder Dov Charney as chairman and CEO have prompted him to launch a counteroffensive to regain control of American Apparel. Working with hedge fund investors, Charney has borrowed money to increase his shares in the company to 43 percent and is threatening a proxy fight. But the hedge fund investors working with Charney are now negotiating with the very board that fired him – and there’s a possibility that a new management team could be appointed that does not include Charney.

Whether Charney is successful or not, the result of his past leadership is an American Apparel characterized by two faces in opposition to each other. When that happens, the worst face eventually outweighs the best. The retail company’s attempts at socially responsible practices — clothes touted as ethically made in the United States – have ended up being plowed under by the repugnant behavior of its leader, who sexualized the workplace as a stalking ground for employee relationships called consensual, disregarding disparity of age and power.

American Apparel’s drama illustrates two key problems: In companies where there is a dominant founder running the company according to the beat of his (or her) own drum, how hands-on can a hand-picked board be when it is necessary to reign in the founder? And, when ethical issues surface in a company with a sexually provocative brand image, how does a hand-picked board ensure a clear stand is taken?

Charney’s hand-picked board supported him for years through several very public sexual harassment lawsuits — not appearing to reign in his philosophy that a sexually-charged workplace fosters creativity; it authorized a quiet, internal investigation this year which uncovered examples where they said Charney misused company funds and didn’t prevent the posting of naked photos of a former employee who had sued him for sexual harassment a few years before.

___________________________________________________

Gael O’Brien, a Business Ethics Magazine columnist, is a consultant, executive coach, and presenter focused on building leadership, trust, and reputation. She publishes the The Week in Ethics and is The Ethics Coach columnist for Entrepreneur Magazine.

La gouvernance, les cyber risques et la reponsabilité du C.A.

Voici la présentation de M. Luis A. Aguilar, commissaire à la Securities and Exchange Commission (SEC). Le billet paru dans Harvard Law School Forum on Corporate Governance sonne l’alarme en ce qui regarde les menaces posées par les cyber attaques et les rôles et responsabilités des conseils d’administration à cet égard.

C’est un article qui met en perspective les besoins d’un changement significatif dans le focus de la gouvernance des entreprises.

Ci-dessous, un extrait de l’introduction à cet article, Bonne lecture !

I am pleased to be here and to have the opportunity to speak about cyber-risks and the boardroom, a topic that is both timely and extremely important. Over just a relatively short period of time, cybersecurity has become a top concern of American companies, financial institutions, law enforcement, and many regulators. I suspect that not too long ago, we would have been hard-pressed to find many individuals who had even heard of cybersecurity, let alone known what it meant. Yet, in the past few years, there can be no doubt that the focus on this issue has dramatically increased.

Boards of Directors, Corporate Governance and Cyber-Risks | Sharpening the Focus

Cybersecurity has become an important topic in both the private and public sectors, and for good reason. Law enforcement and financial regulators have stated publicly that cyber-attacks are becoming both more frequent and more sophisticated. Indeed, according to one survey, U.S. companies experienced a 42% increase between 2011 and 2012 in the number of successful cyber-attacks they experienced per week. As I am sure you have heard, recently there have also been a series of well-publicized cyber-attacks that have generated considerable media attention and raised public awareness of this issue. A few of the more well-known examples include:

The October 2013 cyber-attack on the software company Adobe Systems, Inc., in which data from more than 38 million customer accounts was obtained improperly;

The December 2013 cyber-attack on Target Corporation, in which the payment card data of approximately 40 million Target customers and the personal data of up to 70 million Target customers was accessed without authorization;

The January 2014 cyber-attack on Snapchat, a mobile messaging service, in which a reported 4.6 million user names and phone numbers were exposed;

The sustained and repeated cyber-attacks against several large U.S. banks, in which their public websites have been knocked offline for hours at a time; and

The numerous cyber-attacks on the infrastructure underlying the capital markets, including quite a few on securities exchanges.

Official portrait of Securities and Exchange Commission (SEC) Commissioner Luis A. Aguilar. (Photo credit: Wikipedia)

In addition to becoming more frequent, there are reports indicating that cyber-attacks have become increasingly costly to companies that are attacked. According to one 2013 survey, the average annualized cost of cyber-crime to a sample of U.S. companies was $11.6 million per year, representing a 78% increase since 2009. In addition, the aftermath of the 2013 Target data breach demonstrates that the impact of cyber-attacks may extend far beyond the direct costs associated with the immediate response to an attack. Beyond the unacceptable damage to consumers, these secondary effects include reputational harm that significantly affects a company’s bottom line. In sum, the capital markets and their critical participants, including public companies, are under a continuous and serious threat of cyber-attack, and this threat cannot be ignored.

As an SEC Commissioner, the threats are a particular concern because of the widespread and severe impact that cyber-attacks could have on the integrity of the capital markets infrastructure and on public companies and investors. The concern is not new. For example, in 2011, staff in the SEC’s Division of Corporation Finance issued guidance to public companies regarding their disclosure obligations with respect to cybersecurity risks and cyber-incidents. More recently, because of the escalation of cyber-attacks, I helped organize the Commission’s March 26, 2014 roundtable to discuss the cyber-risks facing public companies and critical market participants like exchanges, broker-dealers, and transfer agents.

Today, I would like to focus my remarks on what boards of directors can, and should, do to ensure that their organizations are appropriately considering and addressing cyber-risks. Effective board oversight of management’s efforts to address these issues is critical to preventing and effectively responding to successful cyber-attacks and, ultimately, to protecting companies and their consumers, as well as protecting investors and the integrity of the capital markets.

Bien comprendre les droits et responsabilités des actionnaires de sociétés !

Ci-dessous, l’extrait d’un article très simple sur les devoirs attendus de la part des actionnaires. Si vous avez décidé d’investir dans une entreprise, vous possédez une part de la propriété de celle-ci !

Il est donc important de lire la documentation fournie par le conseil d’administration et par la direction de l’entreprise afin de vous former une opinion sur sa gouvernance, et vous devriez vous faire un devoir d’exercer vos droits de votes.

L’article récemment publié par The Canadian Press saura-t-il éveiller chez vous le sens de la responsabilité de l’actionnaire ? En ce qui me concerne, j’ai décidé, il y a quelques années, de me faire un devoir de lire les documents préparatoires à l’AGA et de voter, par la poste, sur les items de l’ordre du jour qui sollicitent l’assentiment des actionnaires.

Understand your rights as a shareholder: experts – Business – The Telegram

Documents sent to shareholders ahead of the meeting can include the management proxy circular, annual information form and the company’s annual report. The information form and annual report give the financial statements and an update by management on the business and the direction for the company — both key documents for shareholders.

Walmart Shareholders’ Meeting 2011 (Photo credit: Walmart Corporate)

The proxy circular includes information related to the annual meeting, including the nominees for the board of directors and the appointment of the auditors. It can also include shareholder proposals or major changes at the company that require shareholder approval.

Eleanor Farrell, director of the Office of the Investor at the Ontario Securities Commission, says shareholders have the right to vote on matters that affect the company, including the election of the board of directors. “That is a very important governance piece for the company,” Farrell says.

“The board is the one that approves the strategic plan. It sets the direction of the company. They appoint the CEO, they evaluate the CEO and they also approve the compensation plan.” Farrell says if shareholders don’t approve of a nominated director they can withhold their vote and, at most large companies, if a majority of the votes cast withhold a vote for a particular director, that director would be forced to step aside.

“Shareholders in the last few years have certainly become and gotten a lot more powerful and a lot more powers, I would say,” Farrell said. “Corporate governance has been a very big concern for institutional investors, certainly, and companies are much more concerned about corporate governance.”

The information circulars also include detailed descriptions about how much the company’s directors receive in compensation and what the senior executives are paid in salary, shares or options, as well as the size of their bonuses and the value of any other perks. The circular will also include how the board arrived at that compensation as well as comparisons with previous years. Certain provisions, such as how much a chief executive will receive if the company is taken over or if they are let go, are also often included.

Modèle de supervision du management | Lignes de défense des parties prenantes

Vous trouverez ci-dessous un document de réflexion publié par Sean Lyon* et paru dans la série Executive Action du Conference Board. Ce document partagé et commenté par Denis Lefort, CPA, CA, CIA, CRMA, fait référence à cinq (5) lignes de défense interne, soit les opérations, les fonctions de surveillance tactiques comme la gestion des risques et la conformité, les fonctions d’assurance indépendante que sont le comité d’audit, l’audit interne et les autres sous-comités du conseil, et, enfin, la direction et le conseil d’administration.

Quatre lignes de défense externe sont aussi proposées, soit: les auditeurs externes, les actionnaires, les agences de notations et les organismes de réglementation.

Le modèle des 5 lignes de défense est aussi comparé au modèle traditionnel des trois lignes de défense.

Finalement, l’auteur insiste sur l’importance pour l’ensemble des lignes de défense d’agir de façon concertée, voire intégrée, pour assurer le succès global des interventions des uns et des autres pour le bénéfice de l’organisation.

Voici un extrait du document. Bonne lecture !

Corporate Oversight and Stakeholder Lines of Defense

Corporate stakeholder responsibility should take intoaccount various stakeholder groups, including shareholders, employees, customers, suppliers, special interest groups,

communities, regulators, politicians, and, ultimately, society. Consequently, a comprehensive corporate oversight framework should be multi-faceted to safeguard the diverse interests and varied expectations of all stakeholders. Increasingly, stakeholders are demanding oversight that safeguards a multitude of their interests, be they financial, economic, social, or environmental. Such an inclusive approach should include an appreciation of the symbiotic relationship that exists between business, society, and nature.

Michael Oxley , U.S. Senator from Maryland. (Photo credit: Wikipedia)

Organizations should understand the complexity of this interconnectedness to fulfill their social responsibilities. A holistic focus that includes the various lines of defense approach helps provide different stakeholders with the comfort that their interests are safeguarded, if implemented appropriately. A lines-of-defense framework provides stakeholders with a comprehensive system of “checks and balances.”

The existence of such an integrated framework means that stakeholders can reasonably rely on it to ensure that the organization is fulfilling its fiduciary duties, legal obligations, and moral responsibilities, while creating durable value and sustainable economic performance in the process. For this approach to operate effectively, however, each line of defense must play its part both individually and collectively—fulfilling its oversight duties within a holistic framework.

Accordingly, each line of defense collaborates with and challenges the other (complimentary yet antagonistic) lines of defense, as it acts in its own enlightened self-interest. Enhanced cooperation and communication between these lines of defense should be facilitated by better interaction between stakeholders through regular dialogue which is based on mutual understanding of the organization’s objectives. This, however, must be achieved without allowing respective responsibilities or accountabilities to become blurred in the process.

To strengthen corporate defense capabilities, organizations should consider fortifying the second line of defense, which provides the critical link between operational line management and executive management. For many organizations, this is still perhaps the weakest link in the chain. Unfortunately, in many organizations, the defense activities at this layer are operating in a silo; they are not in alignment with other lines, but rather, operate in isolation, with little or no interaction, sharing of information, or collaboration. The activities of an effective second line of defense must be managed in a coordinated and integrated manner.

Each of the other lines of defense requires differing degrees of fortification, but this perhaps has as much to do with best practices rather than any radical makeover. The goal is to reach a more effective balance between the spirit of guidelines based on principle and the interpretation of guidelines that are legal or more prescriptive.

____________________________________

* Sean Lyons is the principal of Risk Intelligence Security Control (R.I.S.C.) International (Ireland) and a recognized corporate defense strategist. He is published internationally and has lectured and spoken at seminars and conferences in both Europe and North America. His contributions have been acknowledged in the Walker Review ofCorporate Governance in UK Banks and Other Financial Institutions, the Financial Reporting Council (FRC)’s Review of the Effectiveness of theCombined Code and the International Corporate Governance Network (ICGN)’s ICGN Corporate Risk Oversight Guidelines. In 2010 Sean was shortlisted as a finalist in the GRC MVP 2009 Awards organized by US based GRC Group (SOX Institute) co-chaired by Senator Paul Sarbanes and Congressman Michael Oxley.

Articles d’intérêt :

Document de référence sur les bonnes pratiques de constitution d’un Board | The Directors Toolkit *

Voici un document australien de KPMG, très bien conçu, qui répond clairement aux questions que tous les administrateurs de sociétés se posent dans le cours de leurs mandats.

Même si la publication est dédiée à l’auditoire australien de KPMG, je crois que la réalité règlementaire nord-américaine est trop semblable pour se priver d’un bon « kit » d’outils qui peut aider à constituer un Board efficace. C’est un formidable document électronique de 130 pages, donc long à télécharger. Voyez la table des matières ci-dessous.

J’ai demandé à KPMG de me procurer une version française du même document mais il ne semble pas en exister. Bonne lecture en ce début d’été 2014.

The Directors Toolkit

Our business environment provides an ever-changing spectrum of risks and opportunities. The role of the director continues to be shaped by a multitude of forces including economic uncertainty, larger and more complex organisations, the increasing pace of technological innovation and digitisation along with a more rigorous regulatory environment.

At the same time there is more onus on directors to operate transparently and be more accountable for their actions and decisions.

To support directors in their challenging role KPMG has created The Directors’ Toolkit. This guide, in a user-friendly electronic format, empowers directors to more effectively discharge their duties and responsibilities while improving board performance and decision-making.

Key topics :

Duties and responsibilities of a director

Oversight of strategy and governance

Managing shareholder and stakeholder expectations

Structuring an effective board and sub-committees

Enabling key executive appointments

Managing productive meetings

Better practice terms of reference, charters and agendas

Establishing new boar

______________________________________

* En reprise

Article relié :

Partagez (share) ce post

Partagez (share) ce post

Partagez (share) ce post

Partagez (share) ce post

Partagez (share) ce post

Partagez (share) ce post

Partagez (share) ce post

« There is uncertainty about what risk committees should do »

Partagez (share) ce post

Partagez (share) ce post

Partagez (share) ce post

Partagez (share) ce post

Partagez (share) ce post

Partagez (share) ce post

Partagez (share) ce post

Bras de fer entre Osisko et Goldcorp : réflexions sur le rôle des administrateurs

Partagez (share) ce post

Partagez (share) ce post

Articles reliés :

Partagez (share) ce post

Related articles

Partagez (share) ce post

Partagez (share) ce post

Related articles

Partagez (share) ce post