®

Thought Leadership in Governance since 1976 Third Quarter 2018 @DirectorsBoards directorsandboards.com

Facebook’s Board is “RIDING Can they tame ” bottom-line risks A TIGER ALSO! and preserve Director Development: The perpetual student Care & feeding of an effective board democracy? Rethinking director onboarding BOARD OVERSIGHT

Facebook’s Board is “RIDING A TIGER” 18 DIRECTORS & BOARDS BOARD OVERSIGHT Directors at the embattled social networking giant face risk-scrutiny as they try to balance shareholder value and societal good. By Eve Tahmincioglu and Allan Grafman

ith the U.S. elections loom- Some critics say Facebook’s dual-class stock ing, all eyes are on Facebook structure giving Zuckerberg majority-voting CEO and chairman Mark rights undermines the board’s effectiveness. Zuckerberg and whether he Facebook officials counter the company has has done enough to ensure bolstered corporate governance and is on the Wthat nefarious sources with fake accounts on the right path. social networking site don’t derail democracy. Facebook’s directors face immense chal- But all eyes should also be on Facebook’s lenges, because “They’re right at the heart of board of directors, which according to the so many changes in society,” says Ric Mar- firm’s own corporate governance guidelines, shall, executive director in the environmental, “acts as the management team’s adviser and social, governance (ESG) research team at in- monitors management’s performance.” vestment research firm MSCI Inc. Good corporate governance at a corpora- “They’re riding a tiger, but they’re holding tion has never been as critical as in the case of on,” he says about the board. Facebook, which allowed 50 million Facebook Facebook, he continues, “is still facing enor- profiles to be harvested by data analytics firm mous risk, primarily in data privacy.” The risk, Cambridge Analytica and allowed fake accounts he adds, isn’t just the potential for more scan- from foreign entities to proliferate on the plat- dals; it’s also the potential for serious pushback form, many part of an effort to influence voters. from governments. “It’s entirely possible that if And in late September, Facebook announced the board doesn’t manage those risks they will yet another hacker breach, with an additional 50 end up facing regulations that put the entire million customer accounts compromised. business model at risk.” Has the board done enough given indications Indeed, a few state attorneys general are re- the November elections could still be impacted portedly mulling possible regulations on Face- by Facebook’s bogus accounts? Is the compa- book and other social media companies, and ny’s bottom line going to take a hit largely last month, the U.S. Justice Department an- because of management’s security missteps? nounced Attorney General Jeff Sessions “con- Even bigger questions: What exactly is vened a meeting with a number of state attor- “enough” when it comes to corporate gover- neys general … to discuss a growing concern nance in this unprecedented scenario? Does that these companies may be hurting competi- the board even have the power to impact real tion and intentionally stifling the free exchange change given that Zuckerberg has a majority of ideas on their platforms.” vote and holds the position of chairman of What’s happening at Facebook goes to the the board? heart of the challenges directors deal with

THIRD QUARTER 2018 19 BOARD OVERSIGHT

when it comes to risk oversight, and the need Facebook sees its shortfalls as a function to sometimes put shareholder value second of the Herculean task at hand. “Security is in order to protect the company and its role not something that you ever fully solve,” said in society. And also there’s the question of Zuckerberg during a press call in August. “Our whether a board has the power to make these adversaries are sophisticated and well-funded, tough choices when the company CEO and and we have to constantly keep improving to founder is also the board leader. stay ahead. But the shift we’ve made from re- Nora Chan, a Facebook spokeswoman, active to proactive detection is a big change told Directors & Boards that changes have been — and it’s going to make Facebook safer for implemented to bolster the board’s oversight everyone over time.” and to root out fake accounts that impacted “Over time” is apparently not in time for previous elections. the upcoming elections. There are, however, indications the fixes Facebook’s former chief security officer, may be too late for the November elections. Alex Stamos, who left the firm in August, said This despite the company’s investments in it may be too late to protect the integrity of security upgrades, which Zuckerberg has the upcoming elections. already said: “will significantly impact our In an August post he wrote for the Law- profitability.” fare blog he blamed a host of factors for the

FACEBOOK’S BOARD OF DIRECTORS

Marc Andreessen Erskine B. Bowles Kenneth I. Chenault Member of the Audit & Chair of the Audit & Risk Member of the Audit & Facebook Founder, Risk Oversight Committee Oversight Committee Risk Oversight Committee Chairman and Chief Director since 2008 Director since 2011 Director since Executive Officer Andreessen is a Bowles is President February 2018 co-founder and has been Emeritus of the University Chenault is Chairman a General Partner of of North Carolina and and a Managing Director Andreessen Horowitz, a served as President from at General Catalyst, a venture capital firm, since January 2006 through venture capital firm. July 2009. Andreessen December 2010. Bowles Prior to joining General co-founded and served as served as White House Catalyst, Chenault was the Chairman of the board Chief of Staff from 1996 Chairman and Chief of directors of Opsware, to 1998 and Deputy White Executive Officer of Inc. (formerly known House Chief of Staff from American Express as Loudcloud Inc.), and 1994 to 1995. Company, a position he he was a co-founder of held from 2001 to 2018. Facebook Chief Operating Netscape Communications Officer Corporation.

20 DIRECTORS & BOARDS BOARD OVERSIGHT

ongoing issues, including “the fundamental on the election process, and recent steps were flaws in the collective American reaction.” taken to boost board independence. But as Others point the finger at the Facebook for whether the board did their jobs when it boardroom. comes to election integrity, Facebook’s Chan “It is a deficiency in governance and declined comment or to provide comment board oversight,” maintains Julie Goodridge, from any of the company’s board members. CEO, NorthStar Asset Management, which Some believe Facebook’s board, the ma- holds $5.5 million worth of Facebook stock. jority of which were around before the data “What’s going on at Facebook and what’s breaches occurred, is as much responsible for about to go on at Facebook is because the the missteps as management. board didn’t do their homework around risk.” Lawsuits have already been filed against the Assessing and managing risk, adds MSCI’s company’s leadership, including the board, as Marshall, is the most critical contribution the a result of the breach, including one repre- board can make. “We look to the board for senting shareholders. The suit, filed in March oversight, to create a balance between the by Cotchett, Pitre & McCarthy the Northern creative enthusiasm of the CEO and risk District of California, San Francisco Division, oversight.” singles out six board members: Marc An- dreessen, , Reed Hastings, Erskine Facebook’s governance steps Bowles, Susan Desmond-Hellman and Jan The company has announced a host of mea- Koum, WhatsApp CEO who stepped down sures to mitigate the impact of fake accounts from the board earlier this year.

Susan Desmond- Reed Hastings Peter A. Thiel Jeffrey Zients Hellmann Chair of the Member of the Member of the Audit & Lead Independent Compensation & Compensation & Risk Oversight Committee Director; Member of Governance Committee Governance Committee Director since May 2018 the Compensation & Director since 2011 Director since 2005 Mr. Zients currently Governance Committee Hastings has served Thiel has served as serves as the CEO of the Director since 2013 as the Chief Executive President of Thiel Capital, Cranemere Group Limited, Desmond-Hellmann is the Officer and Chairman of an investment firm, since a diversified holding Chief Executive Officer the board of directors of 2011 and a Partner of company. Mr. Zients of The Gates Foundation. , Inc., a provider of Founders Fund, a venture served in the Obama Desmond-Hellmann an Internet subscription capital firm, since 2005. Administration from 2009 served as President of service for movies and In 1998, Thiel co-founded to 2017, including as Product Development television shows, since PayPal, Inc., an online Director of the National at Genentech, where 1999. Prior to Netflix, payment company, Economic Council for she was responsible for Hastings served as where he served as President Obama and pre-clinical and clinical Chief Executive Officer Chief Executive Officer, Acting Director of the development, business of Technology Network, President and Chairman of Office of Management development, and product a political service its board of directors from and Budget. portfolio management. She organization for the 2000 until its acquisition by joined Genentech in 1995. technology industry. eBay in 2002.

THIRD QUARTER 2018 21 BOARD OVERSIGHT

That suit states that “the com- WHATSAPP WITH pany’s executive management and FACEBOOK & PRIVACY? board of directors consistently mis- represented to users and sharehold- an Koum, the cofounder of the in Facebook’s boardroom. Facebook’s ers that it had a comprehensive popular messaging service spokeswomen would not comment on privacy program in place, that it JWhatsApp that Facebook bought whether he did. notified users if their information in 2014 for about $20 billion, got a seat Active disputes over company policy had been compromised, and that on Facebook’s board following the pur- are common, says Charles Whitehead, it required third-party developers chase. a corporate law professor at Cornell to adhere to strict confidentiality In an April Facebook post, Koum Law School. “We don’t know if it was provisions, much of which was announced he was leaving the social raised with directors in terms of com- networking firm amid media reports that pany strategy but you would hope to misrepresented to shareholders.” he and his cofounder Brian Acton, who see an active debate on how a compa- Facebook’s directors are now left Facebook a year ago, were at odds ny monetizes or chooses not to mone- reportedly putting pressure on with CEO Mark Zuckerberg and COO tize the data they have.” management to step up efforts. An Sheryl Sandberg over privacy issues. While Whitehead says there’s a lot article in Last month, Acton confirmed in a we don’t know about what happened in September, citing a person fa- Forbes article that Zuckerberg and in the Facebook boardroom, it appears miliar with the situation, reported Sandberg had tried to push the cofound- the key people at the organization that Zuckerberg was “urged by his ers to find ways around WhatsApp’s were able to voice their opinions. board to be more proactive” and end-to-end encryption. “Ultimately, Zuckerberg ended up pre- to “get control of its challenges.” A Facebook spokeswoman did not vailing, presumably with the support In response, the CEO asked Sher- comment on whether that was the of the board,” he adds, and given the yl Sandberg, Facebook’s COO, “to case, but she did point to comments CEO’s star power it’s no surprise. lead the company’s efforts to iden- Sandberg made to Congress during “There’s always concerns when you hearings last month on foreign inter- have a dominant shareholder or domi- tify and prevent future blowups on ference on social media platforms: nant founder. They are so much a force the platform,” the article adds. “We are strong believers in encryption. within the company, and the world Chan would not comment on Encryption helps keep people safe, it’s identifies them with the company,” he the Journal story. She did say the what secures our banking system, it’s explains. “In those instances you can company has been proactive in what secures the security of private exert a lot of influence over the board, fighting fake accounts and also messages, and consumers rely on it and push the board in a way you think bolstering corporate governance. and depend on it.” is appropriate. That doesn’t mean you In June, Facebook updated its Acton has been a vocal critic of have a fiduciary breach. You just have audit and risk oversight commit- Facebook since his departure, even a really big guy in the room.” tee charter, she says. The updates launching a Twitter campaign under the Upon his departure, Koum made provided clarifications for some of hashtag “#DeleteFacebook” in March no mention of any disagreements at the risk oversight that the commit- following revelations that Cambridge Facebook despite reports to the contrary. tee was already doing, including an Analytica had improperly used custom- In his exit post he wrote: “I’ leaving at a er data. In the Forbes piece, he called time when people are using WhatsApp in annual cybersecurity review, and Facebook executives “good business more ways than I could have imagined. expanded the scope of the com- people,” but added, “they just repre- The team is stronger than ever and it’ll mittee to codify annual reviews sent a set of business practices, princi- continue to do amazing things. I’m taking of things that had previously been ples and ethics, and policies that I don’t some time off to do things I enjoy outside handled on an ad hoc basis, partic- necessarily agree with.” of technology, such as collecting rare ularly around privacy and data use, How this has played out opens up the air-cooled Porsches, working on my cars and community safety and security. question of whether Koum, as a board and playing ultimate frisbee.” The update also included chang- member, raised any privacy concerns — Eve Tahmincioglu ing the name to include the word “risk” to the audit committee.

22 DIRECTORS & BOARDS BOARD OVERSIGHT

And, she points out, two independent di- Governance and the director of the John L. rectors — Jeff Zients, the CEO of the mul- Weinberg Center for Corporate Governance Facebook’s tinational holding company Cranemere, and at the University of Delaware, and a consul- dual class former American Express CEO Kenneth tant to the law firm of Holland & Knight. Chenault — were added recently. When major breaches arise at a company and stock structure Susan Desmond-Hellmann, CEO of the they’re not dealt with accordingly, he explains, renders the board Bill & Melinda Gates Foundation, is lead in- the answer is generally for the board to replace dependent director for Facebook. Her role is management. “completely to help ensure that the board is acting in the “That’s not going to happen here,” he emasculated. best interests of the shareholders and to serve maintains, because of Facebook’s dual-class as a liaison between Zuckerberg, and the other stock structure, which gives the CEO major- Any vote to hold independent directors, says Facebook’s Chan. ity voting rights. A spokesperson for Desmond-Hellmann The structure, he stresses, renders the board management said she was unavailable to comment for this “completely emasculated. Any vote to hold accountable story. But in the same Journal article quoted management accountable will result in the Desmond-Hellmann as saying: replacement of the board.” will result in Sandberg is an “exceptional business ex- That’s why NorthStar Asset Management the replacement ecutive.” Yet she wouldn’t have had all of the sponsored several shareholder resolutions in power to solve the problems that were surfac- recent years asking the company to reconsider of the board,” ing at the company, she adds. the supermajority share structure. They want- says Charles “Even though it is a great partnership, I ed Facebook to “allow for one vote per share,” will say there’s a material difference between says Goodridge. But the resolutions, she adds, Elson, director being CEO and being COO,” says Dr. Des- have been voted down multiple times. mond-Hellmann, former president of the bio- In a proxy statement from April defending of the John L. tech firm Genentech Inc. “While they both the stock structure, Facebook stated: “We be- Weinberg Center discuss priorities, ultimately Mark makes the lieve that our capital structure is in the best calls on personnel allocation — not just how interests of our stockholders and that our cur- for Corporate much to spend but what percent of the engi- rent corporate governance structure is sound Governance at neering staff works on things as well.” and effective.” Clearly, Zuckerberg has a lot of deci- MSCI’s Marshall says he doesn’t see du- the University of sion-making power and that makes sense since al-class structures as generally good or bad. Delaware. he’s the CEO, but what happens if his deci- “We think of them as being one contributor sions don’t lead to change? to the risk profile of the company,” he says. In August he told reporters that the com- “It’s a governance question of course. But pany had removed hundreds of “pages, groups generally speaking, our research shows that and account for coordinated inauthentic be- companies with concentrated ownership, par- havior on Facebook and .” But, he ticularly where the found is at the helm, do added, “we’re still investigating and there’s a tend to outperform the market.” lot that we don’t know.” But many still have concerns. Unequal voting rights, and Zuckerberg Is the CEO too powerful? holding both the CEO and chairman jobs, It’s unclear if the board can hold Zuckerberg were called out as risk concerns in a May accountable for the mistakes he admits he’s report by proxy advisory firm Institutional made — and continues to make. Shareholder Services. The organization rates The role of the board is the hold man- Facebook’s governance risk at a ‘10’ on a scale agement accountable, says Charles Elson, the of 1-10, with 10 indicating the highest gov- Edgar S. Woolard, Jr., Chair in Corporate ernance risk.

THIRD QUARTER 2018 23 BOARD OVERSIGHT

shareholder value, there’s been a growing BALANCING SHAREHOLDER movement for boards to also take social issues into consideration. VALUE AND SOCIETY: “With every board, there needs to be a so- Things directors should consider cial conscious,” stresses Stephanie Resnick, an attorney with Fox Rothchild and chair of the • Delaware law specifically allows boards to take into account the Directors’ & Officers’ Liability & Corporate interests of various stakeholders and the long-term viability of a com- Governance Practice Group. pany at all times, even when in conflict with immediate shareholder value. Beyond Delaware law, 19 states have laws that allow boards to From a legal liability perspective, she adds, consider the interests of their communities in addition to shareholders. “directors have to be very very thorough, they have to be responsive and they have to do • When must the board set aside the CEO’s actions to secure the their own due diligence. That doesn’t mean long-term security of the firm? they have to solve every problem, short circuit • What are the situations where shareholder value must be second- every issue before it happens.” ary to other concerns that address long-term value? It’s about balance, she notes. “While profit • How clear has the board been with management on how the above and economic viability are hugely significant can be addressed and the division of responsibilities? and sometimes the only reason why a com- pany is in existence, a better company is one that looks to economic viability and also is On the issue of an independent chair, Face- socially conscious.” book’s Chan pointed to the company’s response But can such an approach lead to director in a 2017 shareholder proposal document. liability? “Mr. Zuckerberg, as our founder, has guided “A lot of this depends upon on how you us from inception and is invested in our suc- define it, social good versus profit,” says John cess. We believe our board of directors is func- Noble, former Delaware Chancery Court tioning effectively under its current structure, vice chancellor, who declined to comment and that the current structure provides appro- on Facebook specifically. priate oversight protections. We do not believe When it comes to the greater good, he that requiring the chairman to be independent maintains, “directors have a lot of flexibility, will provide appreciably better direction and but the difficulty is figuring out what to do performance, and instead could cause uncer- and how much to do.” tainty, confusion and inefficiency in board and An existential risk can become a company management function and relations.” risk, he adds. He views it through the lens that “if a corporation is engaged in a perfectly Society vs. profits lawful business that all of a sudden creates a It’s unclear whether splitting the roles, or im- perceived social problem and it runs the risk plementing one vote per share at Facebook of being regulated, that could impair profits.” would lead to better or worse things. What Directors, Noble adds, have to ask: “what’s is clear is that the social networking firm has the risk and what can you do about it?” ■ made mistakes, impacting the company’s bot- tom line and, more importantly, the very fiber Eve Tahmincioglu, executive editor and digital of the United States’ democracy. director for Directors & Boards, can be reached Is bad governance ultimately to blame, and at [email protected]. Allan Grafman could directors be held accountable for more served on 8 boards, is an SEC qualified ‘financial than just the bottom-line impact? expert’ and media authority. He is CEO of AMV, While the fiduciary responsibility of boards MD at Oberon Securities and can be reached at of directors at a publicly traded company is [email protected]

24 DIRECTORS & BOARDS