Becoming
a Non-executive Director

Emily Wearmouth: Hello and welcome to the Security Visionaries Podcast, a place where we invite cyber security leaders to come and talk to us about interesting stuff. And today we're doing just that, discussing the role of a NED or non-executive director. I'm your host Emily Wearmouth, so let me introduce my guests. Richard Starnes is the CISO of Six Degrees and he's also a non-executive director for the Cyber Resilience Centre for London, as well as a school governor at Lenham School in Kent as part of the Cyber Governors Scheme. He's worked in both the US and the UK and he joins our elite club of guests who's also held law enforcement positions, which I always like to get involved in the podcast. He is a recipient of the ISC2 CEO award and he's been named a top 50 information security professional, so welcome to the podcast Richard.

Richard Starnes: Thank you very much.

Emily Wearmouth: My second guest is Homaira Akbari, she's the President and CEO of AKnowledge Partners, which is a global advisory firm, and she's held senior management roles in a number of large organizations including Microsoft and Thales. But we invited her to join us today because she has extensive board leadership experience, serving on six public company and 15 private company boards of directors. Currently she's a non-executive director on the board of Banco Santander and she also serves the same role for Landstar System. If that's not enough, she's also the author of more than 50 scientific articles in international journals. She has two patents and a PhD in particle physics, which is just downright cool, so I'm really glad that you could join us today. Thanks for being here Homaira.

Homaira Akbari: Well, thank you, Emily.

Emily Wearmouth: So I'm gonna dive right in with the obvious question and I'm gonna start by asking this one to you, Richard. What is a non-executive director?

Richard Starnes: I'm going to go to an English phrase that's a bit of a how long is a piece of string question, that varies quite widely depending upon what industry you have a NED post in and the size and a myriad of different things. So it kind of depends.

Emily Wearmouth: [laughter] Homaira, can you help us out? Can you hone down a little bit? What are some of the general characteristics of a non-executive director role?

Homaira Akbari: Yes, every company whether they are private or public should have a governance. What does governance mean? It means a group of people called board of directors, which take the responsibility and fiduciary, specifically fiduciary responsibility and duty of care of governing all the principles for that company from bylaws and from rhythm of the business, from the objectives of strategy, and really have check and balances also against regulations and compliance.

Homaira Akbari: So that is board of directors. And within board of directors, then you have a group of people who, for example, the chief executive officer of the company who would usually become a director of the company, but they're executive obviously. In UK, it happens that frequently CFO, chief financial officer is also a director, but in the US or many other countries, in fact, that trend or that practice has been discontinued. Usually only CEO is the executive and you might have former executives who are serving on the board of directors. But when you have somebody who is independent from the company, has not worked for the company in the past, or advised the company in the past, or has been very closely associated with it, at least in the recent past, sometimes it's five years, for example an auditor, partner of major auditing companies, then you would call them non-executive directors.

Emily Wearmouth: Richard, does the distance, the more independence from the executive team imply that they're not paid? Is this still a commercial relationship? Is it still some sort of employment?

Richard Starnes: I think employment might be an interesting sort of distinction, but some of them are paid and some of them are not paid. It depends upon the board itself. For smaller non-profits or for smaller professional boards, those are going to be non-paid usually, certainly at Homaira's level. And I have to be honest, after listening to your introduction, Homaira, I'm feeling a bit of imposter syndrome here.

Emily Wearmouth: She is impressive isn't she?

Richard Starnes: Very impressive. What on earth am I doing here? But those sorts of positions are obviously remunerated.

Homaira Akbari: If I may add, first of all, Richard, thank you very much. And I'm very happy to be with you on this call. And I think the different backgrounds makes it so interesting. But you mentioned, Emily, commercial. There is really no commercial relationship between an NED or there shouldn't be because they are, in fact, they have fiduciary responsibility for all shareholders, even for not-for-profit. I am also, as Richard said, in not-for-profit, not only you're not paid, but you actually pay. You have to pay because it's not-for-profit and they need funds. But regardless, whether it's not-for-profit or for-profit, you effectively have fiduciary responsibility towards other shareholders of the company or other participants, if you like, or members.

Homaira Akbari: And therefore, when you mentioned the word commercial, I would say there is a commercial relationship. But yes, boards of for-profit companies are generally paid. And the reason for it is, there is quite a bit of work involved in doing that. And again, back to you have duty of care and you have fiduciary responsibility. And if you do not perform those fiduciary responsibility, you're subject to legal actions by shareholders. Therefore, you're paid generally. Most boards pay you appropriately, but it's not gainful if you like.

Emily Wearmouth: I actually went to an event recently and I heard a couple of NEDs chatting and both of them agreed that no one gets into it for the money. You get into it for lots of reasons. And there is compensation, but nobody is in it for the money. But I was quite interested, they were talking about, and both of you are as well holding multiple roles at the same time. So what's the sort of average time commitment? Is there an average or does it vary?

Homaira Akbari: Yes. It does vary depending on the board. But on average, if we talk about a public board and let's say a board which is mid cap, a 10 billion market cap, and maybe I use European, the European company, which is mid cap, they usually meet five times a year, of which four times a year are actually board meetings. And one time a year is a strategy, if you like. So they don't do a board, but they do a strategy. They visit subsidiaries, they visit operations. And for that five times, if you like, you probably, depending on where you come from, you will travel two to three days, including the meetings. So you could say that you are engaged with a board around 15 to 17 days in person, and then another probably 10 to 15 days scattered across the year virtually for virtual calls and also preparation for the meetings. So for a single board, you might consider somewhere between 25 to 30 days a year, which is a lot but not a lot.

Emily Wearmouth: Right. It's a lot. Yeah. Yeah. It is certainly not a full-time job, but I think it's more than I was perhaps thinking for the number of boards that some people sit on, it does seem quite time intensive. Richard, what's your experience? And I'm quite interested in this cyber governors program, so we'll talk about that in a bit more detail in a moment, but when you are looking at be