Boards and the cloud

As organizations increasingly grapple with digital transformations, large technology investments, and shifts to the cloud, these issues regularly appear on board agendas. In this episode of the Inside the Strategy Room podcast, Steve Van Kuiken, global leader of the McKinsey Technology practice and coauthor of a recent article about ways boards can shape the cloud agenda, speaks with two experienced directors about the implications of such a move. David Court sits on the boards of pension investment manager PSP Investments, retailer Canadian Tire, and several other organizations. Liz Lempres is an independent director on the boards of General Mills and Great-West Lifeco, among others. This is an edited transcript of the discussion. For more conversations on the strategy issues that matter, subscribe to the series on Apple Podcasts, Spotify, or Google Podcasts.

Steve Van Kuiken: The rapid growth in online collaboration and e-commerce, as well as cybercrime, has made the cloud a big topic in boardrooms. How are board members approaching this issue?

Liz Lempres: I think about those issues in the context of the board’s responsibilities around business strategy and risk mitigation. For example, assessing where the cloud fits into risk starts with understanding the company’s overall enterprise risk-management framework.

David Court: I agree; strategy plus risk management is the lens that most boards take. If an organization wants to operate more horizontally—for example, a pension fund that managed its business by asset class now wants to optimize across asset classes—or apply analytics and AI to a breadth of data, there is no way to accomplish that in a timely, cost-effective way without embracing the cloud. In strategy discussions, boards understand the need to operate in more agile ways and getting to the cloud in a fast but secure way is one of the main enablers.

Steve Van Kuiken: Our research suggests that the cloud is not a big topic in board discussions. Do you think boards are pushing management enough on the cloud investments necessary to give the company the speed and tech enablement to realize the strategy?

David Court: It depends on the industry and the situation. I am on the board of a large retailer, and we have been all over this for years. At smaller companies with $5 to $10 billion in revenue, boards probably have not spent as much time getting educated about the cloud.

Liz Lempres: The board should be asking, “What is the strategy three to five years out and what are the critical enablers to it?” You would hope that starts to surface these necessary longer-term investments. Another way to jump-start the discussion is to ensure that the company has the right senior talent. It used to be said that the most important thing a CEO needed to be successful was a top-notch CFO as their right hand. Increasingly, that top-notch right-hand person needs to be someone who understands business, technology, and the intersection between the two. Making sure that is built into the succession plan and the recruitment of senior people is where boards can make a difference.

Steve Van Kuiken: What markers should boards look for that indicate the management is considering the cloud and technology appropriately?

David Court: First, I agree with Liz that the board should cover this when discussing the three- or five-year strategy. Otherwise, you are looking at individual projects. Boards should ask, “What is going on in the external environment? What do we need to do? What are the enablers to make this happen?” Aside from Liz’s point about talent, you need to make sure the tech infrastructure will be robust enough and that the change-management program for business leaders is in place—something that usually is not sufficiently addressed. Then the board can do what it does well, which is to agree on a set of metrics to track progress.

This gets into the issue of board education. If you take a sample of 20 board members and executives in a reasonable-size company, a maximum of two will have gone through a cloud-based transformation before. If you have not, how do board members get their heads around these questions? I have had many board courses on cyber and on analytics, but I have yet to have one on cloud-based transformation. It doesn’t come up because there is little experience in it.

Steve Van Kuiken: Whose responsibility is it to make sure the board is educated on the intersection between technology and business?

Liz Lempres: As with most things, it’s a partnership. The CEO wants the board educated on the topics important to driving shareholder value, but board members have the responsibility to educate themselves when they feel the need for outside support or additional discussion.

David Court: Most boards have vehicles for education. It could be a retreat or an evening session the night before a board meeting. The best sessions feature an outside speaker that management has prepared, and it’s a joint audience of the board and management who can talk together afterward. Putting those topics in the context of the company brings them to life. I also think we need to double down on board members’ obligation to stay informed, and boards are not pushing that enough.

Steve Van Kuiken: Even if training is in place, how do you ensure that the board understands the implications and impact of cloud and engages appropriately?

Liz Lempres: To engage the board at the right level, you have to focus on business outcomes most important to the business strategy. When there are trade-offs or different ways to finance the investment, the boards can engage at more detailed levels but not until they have the context of how the shift to the cloud changes the way the business goes to market or deals with customers.

Steve Van Kuiken: In your board experience, has management ever come to you with a big investment in the cloud, and if so, how was it framed?

David Court: Yes. In one case, it was a big chunk of money over several years, and I thought the CEO did a good job of setting up the concept of transformation before presenting the numbers. He did not go into detail, but he got the board to understand and commit to a strategic change. Then he said, “There are two or three critical enablers to make this happen.” One was talent; another was the cloud; a third was changes in management processes. I think it made a difference. If management does not do that, as a board member all you see is big growth in the IT budget.

Liz Lempres: You can also assume that boards have some experience with major technology investments that go beyond IT, even if not directly in cloud technology. Those are very large investments that people initially thought about as simply IT investments and then realized that they merited further review around business process changes, for example. Many board directors have lived through that.

Steve Van Kuiken: That is a great point. Boards are used to looking at big tech investments, but the cloud changes the profile of spending from capex to opex [capital expenditures to operating expenditures] and you may not see as many capital investment decisions before the board.

On the subject of risk, cyber is a huge topic. It is highly complex, and cloud makes it trickier because it changes how you manage cyberrisk. The cloud can improve risk management, but you have to change the operational processes. As a board member, how do you guide cyber strategy and risk mitigation?

David Court: We mentioned earlier that when the executive team puts the cloud in the context of the strategy, you have a better board discussion. The equivalent for cybersecurity is that if you can articulate the business risks you are managing against and connect the actions and investments to that context, board members can get their heads around it.

Liz Lempres: It’s important to remember that while cyberrisk and ransomware are realities for any company, the magnitude of those risks differs depending on the kind of business you run. If you have healthcare or personal credit-card data, that is a very different scenario than a B2B company in commoditized industrial products.

You need to have a clear-eyed discussion about how much cyberrisk you face relative to other things in your enterprise-risk-management framework, then decide how to deploy the board’s time against it. Is our cyberrisk higher this year than it was last year because we acquired three companies and are taking on the risk associated with their processes? Or maybe we launched new promotional vehicles that have more consumer sign-ons to our platforms, which increases risk?

Steve Van Kuiken: The cloud changes how you manage security. Have changes to risk management come up in your board discussions?

Liz Lempres: Absolutely. In several of my boards, the conversation around the cloud is closely linked to the conversation around security, whether that is internal processes or hackers and other bad actors. Then we get into more detailed discussions about the cost of cloud and the mitigation.

Steve Van Kuiken: When a company transitions to the cloud, it starts to operate in fundamentally different ways. Business and technology become much more closely intertwined, and you should see an increase in speed of innovation and level of agility. Are there operating models or ways of working that boards should encourage in the transition to the cloud?

David Court: I have yet to be in a board meeting across five or six boards where, when the subjects of agility and speed come up, the board is not somewhere between encouraging and cheerleading. Coming out of COVID-19, that is even more important. The question is, how do we get ourselves comfortable that progress is being made on all fronts at the right speed?

I will give you a simple example. A retailer has three businesses. They want to have a single loyalty program and a cross-banner marketing effort. The cloud allows that to happen faster and in more sophisticated ways. What metrics will you use to track progress? This is where I believe you need to drive things down to the committee level and then back up to the full board for approval.

Liz Lempres: Sometimes, the metrics end up being too implementation-oriented: “We’ve moved this much,” or “We’ve reduced on-premises storage by X amount.” The metrics seem to be moving in the right direction, but you don’t see any change in the customer experience. That’s because the metrics are defined more in terms of management execution as opposed to asking, “What was the bigger picture we were trying to achieve?” Management is demonstrating that they are getting the work done, but the board is thinking, “Are any of our stakeholders benefiting from that work?” That can create tension and unproductive conversations.

David Court: That is a great point. One of the reasons this happens is that historically with IT projects, the audit committee would ask, “Is the project on time and on budget?” Now, when you link it to transformation, you have to move to business outcome metrics.

Steve Van Kuiken: The focus on outcome metrics is a tough transition for companies to make, but if boards encourage that shift, the productivity unlock could be tremendous. How do you think this growing focus on the cloud and, more broadly, technology will influence the expertise boards need?

Liz Lempres: I absolutely think it will impact the board profile, and you can already see it. One of my boards recruited a sitting CIO [chief information officer] who spent their entire career in technology. But that may not be the profile you will see over time. Just as we look for business leaders who understand technology and technology leaders who understand business outcomes, boards will prize similar combinations of skills. Historically, boards may have looked for a sitting CFO or CEO, but now they seek out people who understand digital marketing, different ways of going to the market, and technology transformations.

Steve Van Kuiken: What about technology talent more broadly? IT organizations used to prize software developers who could do bespoke systems and big projects. Now, what is prized is experience in operating in cloud-native environments. You also want tech leadership that is business-savvy and knows how to drive transformations. It all creates a large burden on the technology organization and how companies attract talent. What is the board’s role in this area?

David Court: I would add two complications to what you mentioned. One is, what are the five reports to the CIO in a digital-, cloud-, and security-conscious organization? Those have all changed, and the organizational structure is one thing that boards lean in on. The other issue is whether or not to outsource and with whom to partner.

Liz Lempres: It’s unclear whether anybody, short of a superperson, could have all the capabilities Steve laid out. One approach, as David suggests, is to outsource the basic infrastructure so internal capabilities around data centers and cost management become less important than some of the other elements Steve mentioned.

I want to see that management is being thoughtful about both the skill profile we need and the types of experiences that would give someone that profile. To me, it increasingly means people who have had business roles in addition to technology roles—not just being a business partner from an IT perspective but leading business transformations or working in companies where technology was central to the offering. I also look for people who have a variety of experiences because it suggests somebody who is accustomed to change. At a practical level, I also notice that getting the right leader and a couple of people beneath that leader tends to attract talent from different sources than search firms or HR departments typically look at because those individuals have strong networks.

Steve Van Kuiken: Then you need to create the right environment to retain that talent, right?

David Court: Yes. The technology leader has to be very good at setting the right culture. I’m involved with a venture capital firm that works with many AI start-ups, and the value proposition and culture of those firms are all about excitement. To get those people to work in the IT organization of a large company, you need to make it special.

Steve Van Kuiken: The final topic I want to tackle is external communication. What is the board’s role in communication and stakeholder management around the company’s adoption of new technology and the outcomes of those investments?

Liz Lempres: You want to be mindful about the business outcomes you are driving from that investment. I don’t just mean financial outcomes; it can be protection of customer privacy or improving employee experience. As with other topics that are drawing increased attention—diversity, equity, and inclusion or ESG [environmental, social, and governance]—you want to go beyond a sentence or two about what you are doing and explain why it is beneficial to your stakeholders. Certainly, the proxy statement should clearly articulate your strategy across the most important levers. It is not only a smart thing to do when you are making such big investments but also important your stakeholders understand that you are investing for the long term.

David Court: Over the past few years, I find more and more questions on earnings calls are about the technology infrastructure. Analysts are trying to tie that to business outcomes because that is how they build their models, so if boards are going to talk about technology investments externally, they need to be very clear on how those initiatives lead to business outcomes and represent investment in the future. Anything short of that risks coming across as just adding to the cost structure.