BDO’s recent report, 2024 Shareholder Meeting Agenda, examines the priorities on the minds of public company shareholders, with cyber and generative AI concerns, climate regulations and board composition found to be leading the way. We spoke to Amy Rojik, assurance managing principal — corporate governance, communications and emerging issues — for BDO, to get details on the top issues.

Directors & Boards: According to BDO’s 2024 Shareholder Meeting Agenda, what are the issues that are set to be the most pressing priorities for shareholders throughout the rest of 2024?

Amy Rojik: Shareholders this season will likely be preoccupied with the quality of board oversight over (and experience with) a litany of new and evolving risks. Generative AI and cyber risks dominate headlines, and shareholders are watching those risks closely. They’re aware that poorly managed cyber risks may generate considerable exposure and cost for companies. As generative AI adoption also rapidly increases, competitive strategy and responsible use policies and protocols must be established, monitored and enforced to guide employees and safeguard the business.

Next is accountability for climate risks and greenhouse gas emissions disclosure. Part of a broader push for corporate transparency, this expectation of prudent environmental stewardship now comes with regulatory compliance expectations and penalties at the global, federal and state levels.

Relatedly, shareholders will expect to see companies proactively navigating challenging talent risks and will want indicators that the board and management team are prioritizing leader succession planning and talent attraction and retention, particularly in areas where higher or evolving skill sets may be most needed.

DB: What are the major board concerns in the area of cybersecurity and AI, and what can boards do to best help their companies monitor this emerging issue?

AR: Boards face many cybersecurity and AI risks, and data breaches and other cyberattacks are increasingly sophisticated, complex and costly. New SEC disclosure requirements for timely reporting of material cyber incidents, along with risk management, strategy and governance of cybersecurity, may prove challenging to address. Having a robust cyber incident response plan that includes guidelines for determining whether a breach or incident has or is likely to have a material impact on the company requires thoughtful analysis of where and how a company is vulnerable.

Additionally, organizations need to demonstrate that they have an equally well-thought-out cybersecurity strategy and communication plan that includes frequent assessments; stress testing; continuing education; and consideration of needed resources, funding, and allocation of responsibilities among the management team and board.

Easily accessible generative AI applications are being widely adopted, incorporated into everyday tasks and used by all ages. However, there are very real risks associated with the rapid deployment of relatively new technology. In many cases, companies’ safeguards — policies, procedures, and education — have not yet caught up to the capabilities and use cases being imagined in the workforce. Increasing reports of questionable or biased data sets, inputs and algorithms are generating information that is proving unreliable. These risks are capturing the attention of everyone — especially investors. However, as data processing and machine learning abilities improve, there are significant opportunities that companies are only just beginning to realize. Boards and management teams are quickly moving to prioritize enterprise use of generative AI and to address AI in a multidimensional, cross-disciplinary and transparent manner so that everyone involved understands what may be at stake.

Human error and bias, along with the scale and sophistication of cybercrimes, including those augmented by AI, require boards to closely oversee how their organizations educate, communicate, monitor and govern the permitted use of advanced technologies and their cybersecurity policies. Boards must collaborate with management, IT, internal audit, legal and other relevant departments to improve the organization’s approach to AI and make sure the appropriate guardrails are in place. Given the broad scope cybersecurity and AI may have across a business, boards should carefully consider how they are leveraging AI and cyber subject matter expertise to assess the quality and effectiveness of data and technology governance.

DB: What effect do you think the SEC’s climate disclosure rules will have on this year’s shareholders meetings, and what should boards do to deal with the many developments taking place around climate, ESG and sustainability?

AR: The board and management responsibilities component of the SEC’s new climate disclosure rules will require companies to disclose what their governance of climate-related risks looks like. Investors will likely be wary of companies who appear to be taking their time in preparing for compliance, despite arising legal challenges that stay or delay the effectiveness of new requirements. Companies that have significant global operations or may be part of global supply chains need to closely monitor rules and legislation in foreign jurisdictions that are broader in scope and that are moving quickly toward effective dates.

Shareholder expectations this season will depend in large part on the company’s stated commitments and action (or inaction) related to sustainability since the previous year. Some boards may experience more related proxy proposals. Shareholders may also make proposals related to executive pay, racial equity, fair labor practices, and other areas of human capital and compensation. Boards should collaborate with management ahead of annual meetings to gauge what risks and topics matter most to their shareholders and proxy advisors.

DB: What are shareholders most concerned with when it comes to board composition in 2024 and what questions should boards be asking themselves to make sure they are addressing those shareholder concerns?

AR: When assessing board composition, shareholders will expect to hear how the board’s current mix of skills, expertise and experience accurately reflects not only the core mission, challenges and opportunities of the business, but also how the board is prepared to address emerging risks to the business. Transparency into how the board is setting itself up for succession planning is strongly encouraged to garner further confidence in the governance of the organization.

To preempt these concerns, boards should ask themselves how they identify and address company blind spots and vulnerabilities. They should also ensure regular, meaningful discussions about black swan (unexpected/unknowable) and grey rhino (evident and foreseeable) events, as well as shareholder activism.

Key questions they should ask themselves include:

• Are we educated about the risk landscape, and do we have the right information to understand it?
• How well is our board able to weigh risk and opportunity, as the greatest risk may be the inability of the board to act?
• Do we spend enough time in the boardroom with those who are the most knowledgeable to contemplate where the next risks may be generated?