Cyberattacks, AI and boardroom resignations, with Devyani Vaishampayan, RemCo Chair and AI Expert

"Everyone talks about AI today. But I'm not really sure how many people still understand it." 

This week's guest on the Boardroom Confidential podcast, powered by Sherpany, is Devyani Vaishampayan, an independent non-executive director at Forvis Mazars, and RemCo Chair at a number of organisations, including NHS Supply Chain. 

Devyani is also an expert in AI, and cuts through the noise to ask the question many boards are still struggling with: what's hype, and what's a real business opportunity?  

She shares the boardroom stories that have shaped her career, including the moment she joined an AIM-listed company as RemCo Chair, only to find herself, in her very first meeting, navigating a CEO resignation. 

She also takes us inside the NHS Supply Chain boardroom during a cyberattack, and explains what made the board's response effective.  

Devyani previously spent more than 30 years as an HR director at companies including Rolls Royce, Citibank, and AT&T. 

Boardroom Confidential is brought to you by Sherpany, a leading meeting management solution, designed to meet the unique needs of the board, board committee, and executive meetings. Follow us here.

Chapters:

(00:00) Introduction  

(01:30) Cyberattack Crisis 

(05:14) AI Pressure on Boards 

(14:08) Chair CEO Dynamics 

(19:11) Be Brave Speak Up 

Key takeaways

Boards must prepare for the unknown, not just oversee the known

(01:30)

The NED's role increasingly is getting to deal with the unknown on a very frequent basis, and gone are the days when you just turned up for board meetings. If I look at NHS Supply Chain over the last 18 months, we've had three or four huge issues that no one could have anticipated a couple of years ago. The first was tariffs [...] The second big unknown was really a cyber attack during the Middle East war. [...] It wasn't just a business issue, it was very much a patient care issue — it was a national issue that we were dealing with. [...]

Over the six to eight weeks, which were the intense period, it was really a case of working very closely. Our cyber teams worked with the supplier's cyber teams, as well as the government and a whole range of other agencies. It wasn't just our business and our teams, but lots of teams, lots of effort. That was helpful because everyone could pull together and figure out the right approach, not just to stop it, but to ensure the right barriers were in place for future attacks.

Effective crisis governance depends on collaboration and board capability

(03:52)

It's really almost a pressure cooker environment of completely unexpected factors, with government and a lot of external stakeholders involved. How does the board deal with it? Firstly, the board is really a well-knit team. It helps when you have the board working as a team rather than individuals with very different views. [...]

We obviously had to meet far more regularly than our regular board meetings, but having virtual calls makes that relatively easy. You also need enough expertise on the board. You do need deeper IT and cyber expertise, and we've been very lucky to have members who have that. [...] We also have an executive team who treat the board as someone they can work with and get advice from, rather than someone who has to be kept at bay. What has worked well is a collaborative effort, frequent meetings, board members with different skills, and very proactive stakeholder management.

Boards need to separate AI hype from genuine strategic decisions

(05:14)

About nine years ago, I left a FTSE 100 group executive role to become an AI entrepreneur. At that time, the reaction was, "AI what?" Today, everyone talks about AI, but I'm not really sure how many people still understand it, particularly from a board perspective. There's a lot of hype about AI right now, so the first dilemma for boards is: what is hype and what is real?

The bigger question is the scale of the business opportunity. Boards have to understand that before they can either push the executive team or rein them in. The investment has to happen now, but the benefits often come later, and because every organisation is different, it's difficult for boards to judge how ambitious they should be. [...]

Good boards don't take a black-and-white view of AI. They nuance it to the business they're supporting while acting as a sounding board for the executive team, because this is an area where no one really knows. We're all in this together. [...] On one of my boards, the board and executive team spent a full day learning about AI together. Traditionally, those sessions would have happened separately, but doing it together created much richer discussion and exploration.

Strong chairs create the conditions for healthy board dynamics

(14:08)

A good board is one where the chair is credible, understands the difference between the executive and non-executive roles, doesn't step into the CEO's role, but works to create trust within the board. [...] The CEO's outlook towards the board makes a big difference. The best CEOs see the board as a source of support and mentoring rather than something to be managed. But a good chair can also change that dynamic.

One of the chairs I work with does a few things exceptionally well. There's strong trust between the chair, the CEO and the NEDs. Outside the board meeting we have separate NED calls, regular sessions with executives on topics we need to understand better, regular reviews and ongoing development. All of that creates a structure that facilitates good board dynamics rather than assuming they'll happen on their own. [...] In today's environment it's becoming more challenging to separate the executive and non-executive roles, so it's important to keep reviewing whether we're stepping into each other's shoes. The chair plays a big role in setting that tone.