Spencer Stuart Board Index

ADDED PERSPECTIVE
Spencer Stuart Governance Survey: Cybersecurity
»»
Major information security breaches to business or government systems regularly hit the news,
and boards increasingly recognize that cyber crime is a risk management issue that affects the
entire organization and belongs on the board agenda.
»»
One-quarter of survey respondents said the full board is responsible for cybersecurity oversight,
while 75% said the board has assigned cybersecurity oversight to a specific board committee. Of
those, 74% said the audit committee oversees cybersecurity risk, and 14% said the risk committee
is responsible. Responsibility for cyber risk falls to the technology committee for 5% of boards.
»»
88% of respondents said the board or a committee has discussed the company’s crisis response
plan to a cyber breach within the past year.
Audit committees average more than eight meetings
»
» Audit committees averaged 8.6 meetings, a slight decrease from 8.8 last year and roughly one meeting
less than the 2006 average of 9.5.
»»
68% of S&P 500 audit committees met eight or more times annually, including 48% that had eight, nine
or 10 meetings. 20% of audit committees met 11 times or more, compared with 37% a decade ago.
»»
Compensation and nominating/governance committees meet less often, averaging 6.1 and 4.8 meetings
annually, respectively.
»»
43% of compensation committees held five or six annual meetings.
»»
74% of nominating/governance committees met five times or fewer annually, with 29% meeting
four times.
Distribution of Committee Meetings *
Audit committee Compensation committee Nominating/governance committee
3 or fewer meetings 1% 7% 20%
4 5% 14% 29%
5 11% 23% 25%
6 6% 20% 13%
7 9% 16% 9%
8-10 48% 15% 4%
11-13 16% 4% 0%
14 or more 4% 1% 0%
Average 8.6 6.1 4.8
Median 9.0 6.0 5.0
Maximum 24 16 19
*
Includes in-person and telephonic regular and special meetings.
board index 2016 29