In recent months, the Horizon scandal has brought to the forefront many questions about what management and board-level decision-making at the Post Office looked like, and who knew what when.

While we do not yet have all the facts to hand, details that have emerged so far highlight key lessons:

1: Ask the right questions

In their book, "Collective Intelligence: How to Build a Business That’s Smarter than You", authors Jennifer Sundberg and Pippa Begg set out five, simple questions that have helped companies of all sizes to think honestly and critically about their performance:

• What are we trying to achieve?

• What’s gone well and what hasn’t?

• What are the key risks and opportunities?

• Given all of this, what should we stop doing/start doing/do differently?

• Are we confident that we’ll achieve our aims?

2: Are directors on top of the right risks?

Are your directors fully in the picture about the risks around your business-critical IT systems? How old are those systems? What do their development and operation histories look like? Are there known, persistent issues?

Are they easy to maintain – or do they require specialist, in-house and supplier support to keep running? Does the board have an accurate record of what it costs to keep them in long-term operation? Today’s state-of-the-art systems are tomorrow’s legacy systems.

In 2021, the UK government put aside half of its £4.7bn IT budget to keep old legacy systems running. Industries such as banking and insurance also have significant exposure to older and legacy systems that they need to keep operational.

This is not just a budgeting issue. Boards must also question whether a skills base still exists that can effectively maintain outmoded systems.

Of course, there are also risks associated with implementing new IT systems and the board should ensure there are robust testing processes in place and that there are agreed sign-off criteria.

Beware: external providers and in-house teams may have too much of a vested interest to give directors a full picture of the risks, so bringing in external, expert advice may be essential for getting all the answers.

For more on managing risks, see our article The role of Boards in managing risk.

3: Ensure the board and directors have external, expert support

Boards should be self-aware enough to understand that they do not have all the required expertise to be on top of every risk.

A roster of advisers – or perhaps even an advisory board – will be able to support them on risk areas such as legacy systems, cyber security and artificial intelligence.

To quote Donald Rumsfeld, this will help them spot not only “known unknowns” but also “unknown unknowns”.

4: Align incentives with the company’s goals and desired culture

Incentivise your business partners and key suppliers to identify and resolve issues

Business partners and key suppliers often feel incentivised to hide problems to meet delivery targets or deadlines. Small, hidden problems can become major issues further down the line. Building trust with business partners and key suppliers and incentivising them to identify, report and resolve issues is key to long-term success. 

Get executive and staff incentives right

To build the right culture, it is essential that the company’s incentive structure is encouraging the right behaviours and de-incentivising the wrong ones – from the CEO all the way down the organisation.

Short-term quantitative targets have a tendency to backfire. Several London councils used to reward subcontractor parking wardens for the number of fines issued. Predictably, controversy erupted over excessive fining. 

However, incentives that focus on the business’s longer term, sustainable success are likely to underpin a healthy, collaborative culture.

For further thoughts on this, see our articles Culture holds the key: the role of the boardroom and Company culture: setting the right tone.

5: Encourage staff to raise concerns

Companies should encourage staff, on-site contractors and business partners to raise concerns without fear of retribution. They should also encourage managers to welcome the reporting of concerns and ensure they are resolved in good faith.

Support from the top down is key.

A ‘speak up’ line – with direct board oversight – must be available for when staff feel unable to raise concerns with their manager, or that their concerns are not being dealt with properly. Any investigation of the C-suite must be led by the appropriate board committee.

For further details, check out Company Culture: setting the right tone, and The critical role of boards in developing strong ethics and compliance in our New Boardroom Agenda series

6: Be a responsible business 

Is your business paying small suppliers within the legally required 30 days in the UK? Or is it aggressively squeezing suppliers to increase margins, putting them at risk of collapse, or leading employees further down the supply chain to not earn a living wage?

Being a responsible business starts by treating staff, suppliers and business partners fairly.

Responsible businesses also ensure that they are managing risks in their supply chains in relation to the environment, human rights and business integrity. Does the board have visibility of those risks? 

A good starting point is the OECD Due Diligence guides to support Responsible Business Conduct.

7: Ensure the board is getting the right information

Alongside financial and other performance metrics, the board must get the right information on the right things to bring potential risks into focus.

Metrics around late filings in business units, the number of speak-up reports, IT downtime or supplier-related legal disputes could indicate poor business practices or risks that are not being adequately managed.

Are staff comfortable with flagging up concerns to line managers? Are those concerns being dealt with fairly and thoroughly? Is the speak-up process working? Staff surveys with incisive questions will help the board find out the answers.

Plus, it is vital for the board to be on top of which metrics they need to see. Don’t just let management decide which KPIs to report. Board conversations with executives must be open and honest, and KPIs from every corner of the business provide a factual, neutral basis for those talks.