In the report Midyear Observations on the Board Agenda, KPMG found directors focused on emerging issues like compliance with laws and regulations, cybersecurity and the dissemination of misleading information and the reputational damage that can result. We spoke with John Rodi, leader of the KPMG Board Leadership Center, about the report's findings.
Directors & Boards: Taking a look at the trends identified by KPMG's Midyear Observations on the Board Agenda, should we expect an increase or decrease in globalization in the second half of 2024, and why?
John Rodi: Globalization isn't going away. But the continuing pullback on supply chains is an indicator of a broader pendulum swing that's reshaping the full-throttle globalization of recent decades. Shifting from the “cheaper-faster” strategies enabled by highly complex, decentralized supply chains to greater or even hyperlocalization and control of a company's networks — suppliers, services, data/information — is clearly about resilience of the company. At the same time, concerns about the resilience of national economies and of the global business arena at large are driving the momentum toward more centralized and local supply chains. Economic policies, technological advancements and geopolitical developments will also impact the shape that globalization takes in the months and years ahead.
DB: What does the survey you conducted indicate in the area of generative AI? Are the board members you surveyed prepared for the rapid acceleration of AI?
JR: The trajectory of generative AI (GenAI) adoption is still uncertain, and it will vary by company. But we expect to see many companies move from experimentation to larger-scale rollouts in 2024. Our survey suggests that 2025 may be the year of significant measurable results in workforce productivity and, by 2026, some companies may emerge as breakaway winners or losers in terms of business models and competitive implications.
The survey also highlights that successful adoption of GenAI technology at scale requires the skills and know-how to assess company processes and workflows. Risk management frameworks need to be refined to mitigate critical risks related to data accuracy, bias, intellectual property, cybersecurity, data privacy, compliance, reputation and talent. Workforce issues such as upskilling, reskilling and downsizing are important considerations in the context of GenAI adoption. Given all these challenges, GenAI adoption will also be a leadership journey.
Overall, boards have quickly recognized the risks and opportunities presented by GenAI, and that's prompting deeper conversations about the implications of the technology, including the board's own skill sets and ability to effectively oversee GenAI.
DB: Based off of the midyear observations, what are board members' biggest concerns in the area of talent and the workforce?
JR: We're seeing increased boardroom focus on a range of talent and workforce issues — from the impact of GenAI on how work gets done and addressing employee anxieties about job security to dealing with the expectations of today's workers, including decisions around remote work and how the company's values are viewed by current and prospective employees. These tensions in the system pose challenges, but they also present opportunities for boards to sharpen their focus on the company's human capital management strategy.
DB: In which areas should we expect regulation to challenge boards and companies in the second half of 2024?
JR: Regulatory challenges will vary by company and industry, but most boards should be having robust conversations around climate and sustainability issues, GenAI, cybersecurity, and noncompliance with laws and regulations (NOCLAR).
Policymakers and regulators are focusing on climate change and sustainability issues, with the SEC, California and the European Union (EU) leading the way. Companies will need to navigate complex climate disclosure mandates, reporting requirements and compliance obligations. The regulatory landscape for AI is developing rapidly at the local, state, national and global levels. The EU’s AI Act is the first comprehensive attempt to regulate AI. Companies should understand whether they are subject to these regulations and benchmark their risk and compliance practices accordingly.
Cybersecurity risk continues to mount, with the proliferation of criminal hackers, malware developers and nation-state actors. Boards and companies need to prioritize readiness and resilience, with robust cyber incident response plans, periodic tabletop exercises and clear delineation of responsibilities for data security. And the Public Company Accounting Oversight Board’s proposal on auditors’ responsibilities related to NOCLAR could bring sweeping changes to auditing standards. Boards should closely monitor this proposal, as it may require auditors to audit legal and regulatory noncompliance and alert appropriate members of management and audit committees.
And whatever the outcome of 2024 elections, the next administration's policy agenda — from infrastructure investments and business incentives to tax and regulatory priorities — will shape the business environment for years to come. Boards will need to help ensure that their companies are staying informed about evolving regulations and have the necessary talent, resources and expertise to comply with regulatory requirements and mitigate related risks.
DB: Can you explain the concept of “MDM” and why it should be a concern for boards?
JR: MDM stands for “mis-, dis-, and mal-information.” It refers to the intentional dissemination of inaccurate or misleading information, which can critically undermine trust in institutions and the rational contest of ideas. With the advancements in technology, particularly now with GenAI, the purveyors of MDM have the ability to create convincing content, including deepfake images, narratives and voices. MDM should be a concern for boards because it poses significant reputational risks.
Inaccurate information, regardless of its source or motive, can erode trust in a company and its products and services. This can have a detrimental impact on customer loyalty, investor confidence and overall brand reputation. Boards need to understand the potential disinformation narratives that can materially impact their business and identify likely purveyors of MDM. They should help ensure the company has robust risk management, corporate communications and investor relations processes in place to prevent, identify and counter MDM.
A company has little to no control over MDM, so it's important to build a surplus of trust with customers and stakeholders, including having a clear narrative for the marketplace and focus on transparency, authenticity and open communication. By addressing MDM proactively, companies will be better positioned to protect their reputation and maintain stakeholder trust.
DB: Has the onset of AI pushed cybersecurity to the backburner as a concern of boards and companies? Why should boards still see cybersecurity as a high-profile risk?
JR: If anything, cybersecurity may be considered an even-higher-profile risk now that hackers have access to GenAI tools that can be used to increase the sophistication and volume of cyberattacks. Criminal hackers, malware developers and nation-state actors are, in a sense, knowledge workers, and GenAI is enabling them to be more efficient and effective with their attacks. Ransomware incidents are on the rise, so it's never been more important for companies to have robust cyber-response plans in place and to periodically run tabletop exercises to test those plans and calibrate the company's readiness. Boards should also be having more robust conversations about the implications of potential cyber breaches of vendors in their supply chains, which can have a major ripple effect across the sector.