Another great Australian Institute of Company Directors (AICD) Essential Director Update (EDU) at the ICC this morning. It was also great to randomly bump into Annie Beaulieu, Stephen Summerhayes, Raja Venkateswara… and Adrian Wiggins on the way in 😃
Christine Holman and Bruce Cowley gave keynote talks. Christine focused on the key themes of genAI, cybersecurity, and mandatory climate reporting. Bruce spoke about company culture – including psychosocial risks and NFP financial resilience. He also touched on the session’s other key themes in the context of NFP organisations.
Christine and Bruce then joined a panel led by Louise Petschler with Peeyush Gupta.
Where are we at?
There was consensus on the reality of what’s happening and the opportunities and risks these themes bring. It can’t be questioned that talent, customers, investors – and increasingly regulators expect more from companies and leaders than they have in the past.
Financial performance (and resilience) is still front and centre – but not at the expense of how we treat and interact with nature, our home planet, and people. The people and teams who create value for our companies, the customers who buy and use our solutions, and the communities we all live, work, and play in.
Not just shareholders.
Companies need a social license to operate. They also need to manage climate, people, and other non-financial risks. These dimensions play a huge role in financial performance now.
These changed and increased expectations of how we treat people and planet are now core business – they materially show up on the P&L and balance sheet. In the past some of this has been viewed as “giving back” (what did you take?) and is often full of implicit and explicit power dynamics with the company at the centre and in control.
CSR and sustainability leaders were given near sole responsibility (often with little to no budget or decision-making), and the intent has usually been pretty transparent when the reporting line is to marketing or PR.
The shift is happening where it’s being recognised that these expectations aren’t something that can be treated as fringe. They need to be embedded in strategy and core business with the CEO, CFO, COO, and ultimately the board being accountable.
The only real decision is how to respond to these expectations (and legal requirements). As a compliance burden… or as an opportunity to innovate, do better business, and rapidly transition to more regenerative ways of living and doing business.
Diving into the themes
The key themes were genAI, cybersecurity, mandatory climate reporting, company culture, and NFP financial resilience.
Mandatory Climate Reporting
I’ve already talked about this theme a bit. While all of the themes are important, this is the one I’d say is the most urgent and where most organisations have the lowest maturity.
The requirement for mandatory climate reporting (you might also hear it called mandatory sustainability reporting, climate-related financial disclosure, or some other variation) starts 1 January 2025 for Group 1. These are entities who match at least two of these three criteria: $500m+ annual revenue, assets of $1b+, 500+ employees (roughly equivalent to the ASX 200).
While it’s easy to think this doesn’t apply to smaller organisations – or that there’s plenty of time to get it sorted *, that isn’t how this is playing out.
Over the past couple of months, I’ve heard about multiple cases of small businesses (including social enterprises and NFPs) being asked for a version of their climate reporting by their clients who are in Group 1. Some have explicitly been told that if they can’t provide this, they can’t be used as suppliers anymore.
The signs I’m seeing is that this will roll out much faster than the roadmap and organisations of all sizes need to take action now.
An easy starting point is AICD’s Introduction to Climate Governance online training.
This change isn’t the sole responsibility of sustainability leaders. It needs to be embedded in strategy and core business with the CEO, CFO, COO, and ultimately the board being accountable. It’s not something that can be delegated away.
”The only thing more dangerous than the absence of progress is the illusion of it.”
The AICD’s A Director’s Guide to Mandatory Climate Reporting was updated last month and is a valuable resource.
* The reporting requirements for Group 2 starts 1 July 2026 and Group 3 on1 July 2027
Company Culture
Bruce emphasised the need for boards to take a leading role in company culture. He also noted that some boards are not as vigilant about culture as they were a few years ago. Some boards have lost focus on poor culture as a strategic risk.
I’ve had some recent conversations (not with any of my clients thankfully) where I’ve been told that company culture doesn’t mean anything and that it’s fluffy. That it doesn’t relate to business performance.
It might be five years old now, but the Hayne Report from the Financial Services Royal Commission specifically focused on culture and drew a direct line to business performance “entities have no choice but to grapple with culture, governance and remuneration. All three are related” (p335).
It also resulted in fines and refunds of $1b+ and enormous reputational damage.
What does culture mean? The report says, “the culture of an entity can be described as the ‘shared values and norms that shape behaviours and mindsets’ within the entity”. I recommend checking out the “Culture, governance and remuneration” section of the report (p333) – no matter what industry you’re in.
Bruce summarised the key attributes of this culture failure as command-and-control structures, lack of non-financial risk management, and lack of empathy with customers and stakeholders. He also said there needs to be training for people in leadership roles.
For directors, he posed these four questions:
- How satisfied are you that you have a good understanding of the culture of your organisation?
- Have your efforts to achieve a strong positive culture been wholly or partly effective?
- Is it time to refocus your Board’s attention on culture?
- Should culture be identified as a key strategic risk by your Board?
Expectations aren’t standing still. What talent, customers, investors, and regulators expect has increased dramatically. The AICD’s Governing Company Culture report says:
“For directors and investors, company culture matters: it influences long-term company performance and impacts on employees, customers and other stakeholders… Boards are as responsible for oversight of culture as they are for financial performance”.
The report also says “positive cultures have been shown to improve personal effectiveness and ethical behaviours; increase employee job satisfaction and performance; improve human relations in the workplace; and lead to better revenue growth, job creation, stock price, firm value and profitability.
Overall, according to the Harvard Business Review, culture may account for up to 20-30% of the differential in corporate performance.
Culture is also intrinsically linked to strategy – without the appropriate culture, the agreed strategy is unlikely to be implemented successfully”.
In challenging economic times it can be easy to lose focus on strategy and culture but that comes at a high cost.
GenAI
Christine recommended taking a lightweight R&D approach to genAI initially – rather than full scale digital transformation with legacy ERP and CRM systems integration. Focus on building organisational capability and fluency first.
This means being aware of where genAI is in the Gartner hype cycle – something I included in the Bridge the Gap Between Tech & Human Experience leadership workshops I led a few months ago.
If genAI is approached with an efficiency mindset, it’s more likely to result in job displacements and organisations miss the opportunity of using it to extend the reach and relevance of human expertise. It’s also important to retrain your workforce as part of these programs.
Cybersecurity
Cyberattacks are the only guarantee and the stakes have never been higher for directors. It’s been said “there are only two types of companies: those that know they’ve been compromised, and those that don’t know”.
A breach isn’t necessarily a disaster, but not responding well often is. Deciding on what to disclose and when is often a key challenge.
Cybersecurity isn’t just a tech issue – it’s an organisational strategic imperative. The board and executive need to be prepared to handle these incidents which means including it in strategic planning and running scenarios. Christine recommended using an independent supplier to run these exercises.
This requires proportional investment based on risk. I also recommend the HBR article Boards Are Having the Wrong Conversations About Cybersecurity by Lucia Milica and Keri Pearlson. I like the way they frame the need to focus on resilience at the board level more than protection.
The Australian Signals Directorate (ASD) has designed the Essential Eight to help organisations protect themselves against various cyber threats. This includes outlining the eight essential mitigation strategies with guidance on implementation and a maturity model.
Cyberattacks via third-party services are responsible for 29% of attack vectors based on this article and Christine cited some other similar stats. This shows the need for proper due diligence. It also worries me that without fit for purpose due diligence, smaller providers will get locked out or face excessive requirements.
I’ve done a lot of work on security controls (strategy, policy, process, and procedure) and technical assessments over the decades – especially in mission critical areas of financial services. Occasionally I also help our clients with tech platforms complete their security assessments and penetration tests when it’s required by one of their clients.
Through this I’ve had visibility of what’s required by different corporates, NFPs, and government departments. There’s little to no standardisation and I’m yet to see one that takes a risk-based approach. The language is often ambiguous and there’s rarely access to the right people to get specific answers.
This actually introduces a lot of unnecessary risk for all parties and really needs to improve.
What’s changed since last year?
This year’s EDU was largely a continuation of last year’s themes with genAI unsurprisingly getting more emphasis.
Stakeholder engagement (including but going beyond shareholders) got a lot of emphasis at last year’s EDU, especially in the context of directors’ duties. Today those messages were more integrated in the other themes and were especially called out as part of the company culture theme.
I was surprised I didn’t hear a single mention of remote and flexible work – especially given how much company policy and expectation has changed on this over the past year. It came out in a few ways at last year’s EDU and still feels like something companies are working through.
One piece of advice for the next 6-12 months…
To close out the panel, Louise asked each of the panellists for one piece of advice or thing to focus over the next six to 12 months.
- Christine talked about working on the new regulations in challenging economic times. Her key point is that this isn’t a trade-off if it’s embedded in strategy
- Bruce talked about balancing time between the strategic and regulatory requirements
- Peeyush focused on simplification and the expectation to do more with less in the current macroeconomic conditions. He recommended committing to the medium-long term with persistent funding and core team
What happens next?
That’s really up to us as leaders, customers, and investors.
I think it’s important framing that AICD’s purpose is “to strengthen society through world-class governance” and its mission is “to be the independent and trusted voice of governance, building the capability of a community of leaders for the benefit of society”.
Everything I do is focussed on helping transform the way business is done – to accelerate the transition to more regenerative ways of living and doing business. Business models, products, and services that create great outcomes for people and our planet while making money and increasing wellbeing.
For many years I’ve been saying that good business means designing our business models, products, and services to be regenerative… because:
- Customers want to buy from companies doing good things
- Talented people want to do meaningful work
- Investors know it’s lower risk with better returns
- We have a great opportunity to use the power of business to help create positive impacts
The fact these conversations are mainstream now – even if there’s healthy debate about how we do it and the role of innovation – is great progress and we’re moving beyond shareholder primacy to take a more strategic view that values all stakeholders and is backed by accountability.
I’m lucky to have friends and collaborators who’ve been doing this work for years – this includes being generous with their investment in building the community and ecosystems for these practices. A shout out to a few of them… people you can trust to help you do better business. Thanks for all you do and keep doing!
- Dan Leverington from The Ocelli Group. Connecting Group 2 and Group 3 boards and their executive teams with climate reporting service providers
- Frances Atkins & Naomi Vowels from givvable. Experts in automating supplier diligence and sustainable procurement to meet ESG requirements based on supplier data
- Kel Beaumont from Leaders for IMPACT Network. Dedicated to driving business success, social impact, and sustainability through peer-to-peer leadership networks
- Mick Hase from SEVENTEENx. Exists to educate, engage, and enable the business community to take measurable action with the Sustainable Development Goals to create positive impact in the world
- Cat Long & Jo Auburn from Trace. Empowering businesses to reach Net Zero through accessible technology, education, and actionable carbon emissions data
- Natasha Hawker from Employee Matters. Outsourced in-house HR and recruitment team helping businesses maximise profitability, sustainability, and productivity through their employees
- Andrew Davies, Mindy Leow, and the team at B Lab Australia & NZ. Transforming the global economy to benefit all people, communities, and the planet
Let’s collaborate to solve problems that matter – problems that matter for our teams, customers, investors, regulators, and life on our planet.
Let’s rapidly transition to more regenerative ways of doing business and living.
Enjoyed this article?
Get our twice monthly newsletter for actionable ideas on leadership, design thinking, regenerative innovation, wellbeing, and purpose… to help you solve problems that matter.
