S5:E106🎙️LIVE with Tim Leech (Multi Tracks Audio)

¡Hola! Hi, I'm John Maxwell. When the top companies in the world are looking for trainers, speakers, and coaches, there's one name that stands above the rest, and that's Maxwell Leadership. Our certified team members have gotten proven results for companies all over the globe, and our reputation, I'm proud to say, is second to none. Some of our members have risen to the top of their profession, including the one you're going to meet today. I proudly introduce you to my friend Bob Fabien Zinga.

Welcome to the Leadership and Success Podcast with your host, Coach BZ, where we help you lead with purpose and succeed with impact. If you're ready to grow into the kind of leader others want to follow, this podcast is for you. If you're determined to elevate your success and leave a lasting legacy, this podcast is for you. As my mentor, Dr. John C. Maxwell, reminds us, everything rises and falls on leadership. Our goal is simple, to inspire you, challenge you, and equip you with insights that can transform the trajectory of your leadership journey. Welcome aboard to Welcome to another episode of the Leadership and Success Podcast with Coach BZ.

And I know you mentioned heat maps, and so the title today's show is Tim Leach Loves Heat Maps and Risk Registers. A bit tongue-in-cheek there because I know you absolutely do not, but they are still being used. Okay, so let's, let's be clear on that. I actually like and use risk heat maps all the time, but only with respect to a specific objective. When you take a bunch of risks, you go around the company and you say, what do you see as the big risk? So go imagine if you're sitting, you have a family of two parents and three children, and you, you ask everybody, what do you see as the big risks in the house? In the family. What do you see as the big risk to the family? You're going to get a weird list of risks, right? Well, unfortunately, a lot of these risk lists that people are creating are cherry-picking a bunch of random stuff with low, low rigor. They don't ask them— a lot of times the question isn't a lot more specific. What do you see as the big risks? Sometimes it's, what do you see as the big risk to the company? Sometimes it's not even as specific as that. So, and you've got people like the IIA and the Risk Institutes publishing reports that is a survey of the top risks. And I say to them, would this be the same set of risks if you said, what are the top things that threaten the achievement of our most important strategic objectives? Would that list look the same? The answer is no, it wouldn't look the same if you change the question to, what do you see as the biggest things that could create uncertainty? We won't achieve the most important objectives to long-term success. Unfortunately, most of the risk people and internal audit are not asking that question, and they're not exploring it in terms of their work. But it all goes back to the lack— you have supply-driven professions who are pushing out what their institutes and what they think they should do, You have apathetic customers that haven't been willing to define with any clarity what they want. We have a problem in risk governance that's big and it's around the world.

Hello everyone, welcome to another edition of the Leadership Success podcast. I am so overjoyed today, really honored and privileged to be speaking to really one of the world's foremost experts in governance, risk, and assurance. Before I introduce my guest, as is our tradition here, we are going to take a moment, what we call moment of gratitude. So you know the drill, we just take a quick moment to be grateful for something every single time we meet, partly because my brothers and sisters in, US military veterans and service members, it's about 22 of them that commit suicide every single day. And we do believe here that we cannot be suicidal and grateful at the very same time. So if you would maybe close your eyes and put yourself in your happy place, you may need to take a deep breath to slow down your nervous system. And just in that moment, think about one thing, one thing that you are grateful for today. And for me, I think it's just being alive, right? I am so grateful almost every day I still have breath. As long as I have breath, I think there is hope for me. I have a purpose and I am just so grateful for it. Somebody went to sleep last night and they didn't wake up today, but I am still here and I think it really means a lot. So let us know in the comments what you are grateful for. Let us know where you are joining us from, which city, which state within the US. But if outside of the US or Canada and Europe, let us know which country as well. Let us know what you are grateful for. And of course, if you have a question for my guest, go ahead and type it in the comment and we will be answering live. Okay. Let me see if I can properly introduce our guest today. Today, really joining me is a globally recognized Governance, risk, and assurance thought leader, Tim Leach, is the founder and managing director of Risk Oversight Solutions and author of the upcoming, I believe it's going to be an instant bestseller, Mission Critical Governance: Focusing on What Matters Most, which will be released August 10th. But I triple-checked in the US, the Amazon store will allow you to preorder today. All right, so the book is published by CRC PricewaterhouseCoopers team has spent more than 4 decades advising boards, executives, regulators, auditors, and global enterprises on governance, enterprise risk management, cybersecurity oversight, assurance, and mission-critical decision-making. His work has been recognized by Harvard, Columbia, the London School of Economics, conference boards, IIA, and governance leaders around the world. This is going to be a powerful conversation for Neville Jr. off officer aspiring to command, but also Silicon Valley leaders and innovator. So part of what we're gonna be learning today is why smart boards and organizations still fail, but also how courageous leadership creates resilient organization. So without any further ado, please help me welcome to the Leadership Success Podcast, the one and only Tim Leach. All right, good morning, Tim. How are you doing today?

I'm great. It's very early for you. It's pretty, pretty normal for me. Thanks for getting up so early to do this. I appreciate it. And thanks for that introduction.

Absolutely. I joined the Navy 21 years ago. Since then, I've been waking up at 5:30 every morning regardless of the time zone. But it's really a great, great Pleasure and privilege to be speaking to you today, Tim. Maybe to get started, what is something you are grateful about today?

Well, I know a lot of— I've looked at some of your other podcasts and you should be very proud of them. And many of your participants reference family. And last August, my wife and I celebrated our 50th wedding anniversary.

And amazing.

I have to say the thing I'm most grateful for is my family, my wife and my children. And I now have 3 and a third grandchildren. So it is a very important piece of my life and I am grateful that I've been able to have it. And as you said, I woke up this morning as well. So I'm hoping, according to ChatGPT, he says I I should be good for a while longer despite whatever little ailments that come. And I asked Chat, you know, I'm quite harsh with Chat, you know, is this something that's likely to kill me soon? So you can ask Chat those kind of questions and sometimes it gives you a false answer.

But yeah, I guess the older I get, the more important health is to me. I know I got injured, I think it was in 2017. Was it? I had a back injury and, uh, yeah, I couldn't get out of bed for like 2 or 3 days. My goodness, nothing was more important to me than my health in that moment. But, uh, yeah, thank you so much for sharing that, man. 50 years of marriage, that is really awesome. My wife and I have been married 24 years, going to be 25 years in July, so it's going to be about half of your, uh, uh, marriage life. What, what, what do you think is the secret to your marriage, if you don't mind sharing? That's really outstanding.

Well, I suppose the thing that's most important is we've learned how to disagree in a way that's respectful. And yes, we hope that we've been able to pass that notion on to our girls. And it's absolutely essential to relationships to be able to disagree, and disagreeing is natural. And you won't always get the result that you think you should, whether it's the color of the pool liner or something more fundamental. Uh, yes, should your teenage daughter be allowed to go away for the weekend with her boyfriend? Uh, so you face many decisions and, and you hope that you can have a discussion with them and, and reach a, a a place that you're both okay with in terms of going forward.

That is really, really insightful. And for those young people listening now thinking about getting married or just got married, this one insight could save your marriage for sure. Because I remember when we first got married 24 years ago, I tended to always want to be right. And then I was like, okay, if I keep doing this, this marriage isn't going to last. So do you want to be right or do you want to be happy? I said, no, I want to be happy. So Disagreeing with your spouse is definitely a great, great skill to have. Thank you so much for sharing that. Before we get into the meat of our podcast, is there something about you that most people may not know when they first meet you, something you are willing to share?

I suppose my daughter 3 years ago gave me a Christmas present, which is a Life Stories, uh, application. And what, what it does is every, every Monday morning for a year, she would ask me a question, uh, in an email, and she could ask anything she wanted. And wow, the app gave them a whole range of things that they could choose. The, the purpose of it is, is it in the end was going to create the life Life Stories of Tim Leach. Yes, but through the eyes of my daughter who was asking the questions, and, and those questions, um, can get very awkward in terms of it stop and make you think, like, uh, you know, how did you know you were in love with your mother? Wow, that's, you know, so, uh, anyway, I suppose the one, the one thing that, that I answered one day she asked, one Monday morning she asked, was there something was there a time when you, you came close to dying? And, and it was, yes, I, I was riding in the back of a car when I was 17 and the driver lost control on a snow-covered highway. And then, oh no, and the car hit some posts that were designed to stop the car going down a big cliff. The, the, and it threw it into a 360 and my back door had been knocked open as a result of the collision, and I was thrown out on the highway. And I said, oh my goodness, I slid down the snow-covered highway and a car went by me in the other lane. I could still see the, the driver and his wife looking at me sliding by them on the highway. Uh, so my, my daughter said, you never told us that story. And I said, well, it never came up.

Wow.

I, I am so sorry to hear that. No, no, nobody died, right?

Uh, no, no. My glasses got knocked off and, and all of the stuff in the car, the back of it was flying around. And my buddy who was driving and my other buddy were in the front. They got it under control about 400 yards down the highway. And he turned to my buddy and says, are you okay? And then they looked in the back seat and I was gone. Wow!

What was going through your mind in that moment, if you don't mind sharing?

It's kind of funny, but I had been writing back in those days. I was writing an essay for grade 12 English, and I had been writing it longhand. And when the car, the back gate flung open and all the stuff fell out, and my essay was flying all over the place in the snowy snowy highway, and my number one goal was to recover those 12 pages that I had written of this essay.

In that moment, really?

Two things, actually. Find my glasses, because I'm actually quite blind, and find the essay so that I didn't have to rewrite it.

You gotta be kidding. Like, you could be about to die, and that's what you're thinking about?

Well, I'd already not died, so might as well move on.

Wow. Okay, okay. That is quite impressive. I don't know how many young people would be feeling. So how did you feel in that moment?

I, I was just kind of, uh, my God, I guess I'm okay. So let's, let's figure out how we're gonna— it was really snowing hard. I mean, this is in, in 2 hours north of Toronto, and it was in November, which was very unusual. And yes, the highway had been completely covered in snow, and my buddy was a brand new driver, and he didn't know that if your front tire went off the the edge of an asphalt highway, you don't correct.

Wow.

You just take your foot off the gas and let the car slow down, because if you correct, it throws it into a 360 spin.

Man, that is quite an experience. Did that experience impact the rest of your life, you think? And if it did, in what ways?

Well, I suppose it gave me— we're here for whatever time. And if you believe in God, that God has given us or that we're ordained to spend on this earth, and we need to be happy and grateful for whatever number of days or years that we're here for, because it can be over in a blink.

Yes. And did that teach you anything or impact the way you lead today, you think?

I don't know. I suppose I might be more careful about getting into a car that a driver had just got it 3 weeks before that had never driven on snow and letting him drive the car.

Yeah, yeah.

Down a snow-covered highway. I might have said maybe we should go back to the cottage and go home tomorrow. Yeah, yeah, this is imprudent to go home in this weather.

Yes, yes. Uh, I guess when you look back, no, you get the, uh, insight. But yeah, I have, I have two, two daughters. One of them I taught how to drive about, what, 6, 6 years ago, and my second daughter is 18 now. And, uh, yeah, I need to teach her how to drive, but it's, it's kind of scary for a father to be going on the road with a brand new driver. Although in my experience, girls tend to be very, very careful the way they, they drive, following the rules.

And well, both of my daughters, because we, we live here in Canada, when they were 16 and they were— had their learners and, and were learning to drive, I would take them to a relatively deserted stretch of road and get them to take take it up to 60 miles per hour and do a full jam stop.

Yes.

And then, then I would, in the winter, I would ask them— we had four-wheel drive vehicles— and I would tell them to, to put their front right tire up on the snowbank and drive down, down the, the side street half up like this.

Yes.

Just to get them, um, aware of, of things that often you don't have, you don't do, and often aren't covered in training. But yes, sometimes you may have to do it. So the best way, if you have to do something, is to have practiced it.

That's so true. Wow. Wow. Well, thank you. Thank you so much for sharing all of that. Hopefully that's going to inspire some of the listeners. So, Tim, you have spent like over, what, 4 decades now Challenging Conventional Thinking Around Governance, Risk, and Assurance. No, again, thanks so much for writing this book that's about to come out. I think it's going to help a lot of people in the industry. But what originally sparked your passion, though, for improving governance systems?

I think it's fair to say that, uh, I had joined— I, I had worked in Coopers and Lybrand getting my, at the time it was called a Chartered Accounting designation, and I wanted Coopers to let me go into consulting and they said, you give me 3 more years of external auditing and then I think we can think about letting you into the consulting side of the business. And I said, I can't take 3 more years of external auditing. And I went into internal auditing and I started briefly with Westinghouse Corporation. Uh, and then I moved to Gulf Canada Resort. Canada in Toronto and did 3 years of traditional audit. Then Gulf transferred me out into managerial positions in the controllership in Calgary. And so all of a sudden I was now running organizing, you know, I ran the oil and gas. Uh, we, we did over a billion dollars a year in revenue and I looked after 700 or 800, uh, accounting, uh, oil and gas wells and, or more. And that's when internal audit scheduled me for an audit. And it became very clear to me that the traditional paradigm of auditors going in and then writing up what internal audit believes are management's deficiencies and weaknesses is just not a good positive psychological experience. But even more importantly, it's not the way to drive continuous learning and improvement.

Yeah.

And, and that became very clear to me when I was on the receiving end of what I had finished doing for 3 years, which were traditional audits. And that was kind of a pivotal moment in my life. And that was shortly after that I proposed to the general auditor that we introduce what we called control and risk self-assessment at the time, but it was really objective-centric. We would go into business units and say, what are your most important objectives that are absolutely key that you achieve? And then we, instead of auditing them, we facilitated a discussion of what are the things that could get in the way of that happening successfully, and what are you doing to manage those risks? And are you okay with the risk?

Yes.

So that was really my pivotal moment that we proposed it to the CEO. He was a crusty old oil and gas guy. He said, it makes good sense to me. Just go do it. Wow. So, so we did. And we started to write about it and talk about it and people got excited. We got invited to speak at conferences. People started ringing up saying, we need to come and visit you. We want to understand what you're doing there.

Yes.

And that was 1985. So, wow, a long time ago. But that was my pivotal moment. I still have not released my view that the traditional approaches to internal audit is not a positive way to drive improvement or to support governance. And later, when risk management started to come along in the '90s into the 2000s, companies started to create risk groups. I was, am, and was an outspoken critic of this notion of building risk registers and presenting heat maps to boards. It was, in my mind, it was a sham. And I regularly in my posts call it governance theater. It's done for theatrics in the sense of it isn't helping boards do what they need to do, which is to oversee the success of the company. And it's just pacifying some well-intending but misguided regulators. And sometimes the boards, some regulators have said to the boards, governance includes you reviewing a list of principal risks. So yes, they tell management, bring us a list of principal risks. They schedule it for a 1-hour or 20-minute discussion once a year, and that's their tick.

Yes. Well, that's really— this is from one of your LinkedIn posts. That's really the elephant in the room, isn't it? And again, you have this upcoming book I think is going to be an instant bestseller, Mission Critical Governance: Focusing on What Matters Most. So Instead of the, I guess you called it theater, what should C-level executive actually tell their board? What is the proper way to do it for those who really care about risk and making a difference?

I would— unfortunately, it's a little more complex in the sense that most companies have not defined what I call mission-critical objectives. Those are the top strategic value creation and value preservation objectives.

Yes.

And you can do it in any size of business. You could do it for your own business.

Yes.

What, what are your top things, uh, that you're trying to achieve in terms of value creation? What does success mean to you? What are the things that you could get wrong that could seriously hurt you? Let's put those into objectives, and then let's take some time and consciously think through whether you're okay with the way you're pursuing those. Yeah. So the concept is dead simple. AI-assisted research in my 40 years working with literally tens of thousands of companies, if you count all the students in my, in my classes, the majority of companies have not agreed what are their mission-critical objectives. So what it means is that governance activities are incredibly fragmented and they're not focusing on what I believe is the most fundamental question is, are we okay with the uncertainty we're taking that we're going to achieve our most important value creation and value preservation objectives? Full stop. And unfortunately, for a lot of complex reasons, internal audit has evolved. It provides virtually little support. For mission-critical objective information. And the risk groups, they also similarly don't provide reports on the state of uncertainty linked to mission-critical objectives. So we have a situation where almost nobody disagrees that that makes good sense. Mm-hmm. So what we're really at is people don't want to change from the way they've been doing it. But in my book, and what my book really crystallized to me, the majority of CEOs don't want the board to know the state of risk linked to mission-critical objectives. So they actually, and I saw it over my 40 years, internal audit and chief risk officers, the no-surprise meeting with senior leadership. What are you going to tell the board? Well, If they don't like what you're going to tell the board, your career is pretty much finished.

Yes.

If you persist in telling the board what you think the board needs to discharge its obligation to oversee mission-critical objectives, and your CEO doesn't want the board to know that uncertainty status information or even performance data, for example, on a mission-critical Yeah, I've seen, I've seen literally dozens of Chief Risk Officers and CAEs, they get fired. Sometimes it's, it's in a quiet way. But their careers are finished at that company.

Well, let me ask you this. I guess in many organizations I've seen, it seems to be the CEO and the C-suite that tend to come up with those mission-critical objectives. But for good governance, shouldn't that be coming straight from the board though?

Well, you know, what you've decided in chapter 1 of the book is titled The Purpose Void. What my research tells me is if you go out and you look at literally thousands and tens of thousands of listed public companies in the United States, Canada, the UK, Europe, Australia, South Africa, almost no boards disclose what their purpose is.

That's crazy.

They, they, they disclose all the things they're going to do. They're going to have meetings, they're going to have committees, they're going to review the strategic plan, they're going to review audit reports, they're going to review the risk register.

Well, isn't that the true elephant in the room then?

Because that should be the number one Well, in the book, the lack of board purpose is in fact the central problem.

Yes.

And the book actually proposes what I think the purpose of a board should be. But it also analyzes, and this was important in my research. Chapter 2 is called the Don't Tell, Don't Ask Governance Syndrome. So, CEOs don't want to tell the board the state of risk linked to mission-critical objectives, but boards don't want to ask.

Yes.

So there are— I have a team of a psychiatrist and two psychologists, and they've done guest posts for me, and I've done extensive research. There is a lot of human behavior reasons why the CEO doesn't want to share the true reality of uncertainty with the board and a lot of complex reasons. The board in 60 seconds could ask the CEO, what are this company's mission-critical objectives, our top strategic value creation and value preservation objectives? And who's going to be telling the board about the state of risk linked to them? That's it. One minute.

Yes, yes.

They don't want to ask those two questions. So then you say, Something that would take a minute. I mean, doesn't that question seem logical to you that a board should want to ask?

Yes. Yes.

They don't. They won't.

Hmm.

And the reasons are incredibly fascinating in terms of why the board won't take that one minute and ask those two questions. So I've done posts on two questions that could change the course of governance around the world.

Yes.

Literally in a period of a few months, boards won't ask it.

Why, why, why do you think?

The book gets into it. It's given our time constraints. I suppose the short answer is they don't want to know because then they'd be accountable for knowing that they know. So let's assume we have a situation. I mean, one of my companies over the years, I've done huge work in oil and gas all around the world. And I don't know if you know much about oil with gas, but sour, sour, uh, certain crude has, has, uh, sour gas in it. And sour gas is, is a byproduct when you produce that oil. Yes, it produces sulfur, but it also produces incredibly poisonous gas. So Mission Critical should say that one of the safety objectives is to ensure that our sour gas processing processing plants, uh, maintain zero likelihood of a sour gas leak because it can literally kill neighboring— yes, similar to my clients in the nuclear power generation. You have a nuclear radiation leak, so mission critical says, okay, well, the board should be on top of that, right? Well, that means there should be an objective. That objective should have an owner who is a management person. Analysis should be done on, on what are all of the risks that could cause a sour gas or a radiation leak.

Yes.

What are we doing about each of those risks? What, what's the likelihood of the risk? What's the consequence if it happens? What are we doing to treat the risk? And what's our current performance in terms of releases, near, near releases, near misses? Yes, that data should go to the CEO and the board. Well, that's not how they do it in most companies. So whether that's customer service, I, I don't— I have a favorite barbecue called a Napoleon. I've used them for 30 years. So recently this spring, I wanted to, uh, I needed to ask customer service whether my warranty covered a part that I needed to replace. And I call, I call up and, and I get the recorded message that the wait time is currently 1 hour and gives me no option to call, you know, for them to call me back. Or I had previously recommended them all over to people about fabulous customer service. All right. So I'm giving you a counter. That's a value creation objective. Great customer service.

Yes.

Well, who's the manager that's talking to the board about the state of customer service? What kind of quality information is being delivered to the board? Why hasn't the board asked? Well, in the Boeing case, The derivative shareholder action was going to sue the board for negligence. They settled it for $3 or $4 billion out of court because I don't think that the court concluded there was adequate evidence that the board wasn't overseeing what was a mission-critical objective for an airline manufacturer company and aircraft.

Wow.

It got settled out of court. Wells Fargo, the fraud of fake accounts went on for 10 years. What was the board doing during that entire time? Why? Why wasn't the CEO talking about what was happening as a result of the CEO's hugely aggressive sales targets? Causing people to create fraudulent accounts. So the book goes through all of the various— and I've been a student of governance disasters since the '70s. Um, there is ample evidence the majority of huge governance disasters can be traced to weak board oversight of mission-critical objectives.

Yes.

So then you say, well, They're smart people. Why aren't they asking for reports on risk to mission-critical objectives? So then the book gets into a very rigorous analysis of the information loop problems, and it's supplemented by the research I've had my psychiatrist and psychologist help me with., as well as AI research. Um, if you were to ask your AI agent, why don't all boards ask management for reports on risk linked to mission-critical objectives? Try it, see what AI tells you.

I wonder if a couple of your posts are the answer from the movie A Few Good Men. They just can't handle the truth, can they?

Well, that was certainly, you know, when you, when When I ask chat for an answer, I mean, certainly, the psychology of it is hugely important. And the work of a guy by the name of Peter Senge, S-E-N-G-E. He wrote The Fifth Discipline: The Art and Practice of the Learning Organization. Hugely important book to me. So what he What he said is, is when you can create a shared vision and you can get people to look at their current reality, if there's a disjoint between the current reality and the shared vision objectives, people will learn and try and close that gap. That was very exciting to me. And I built a lot of my methodology around that fundamental principle of you show people their current reality. If it's not looking like it's going to achieve what they claim they most want, human behavior should say that that will cause them to close that gap.

Yes.

Sadly, later in his later, uh, he concluded that human beings aren't capable of looking at their current reality. It's just against the human nature to be willing to have a hard objective look at one's current reality. So he said, you know what I said about creating learning organizations, unless humanity can learn to look at their current reality in a clear objective way, continuous learning and improvement is going to be an elusive goal for the majority of us.

That is, that is quite interesting. And again, the book you just mentioned, we do have a digital library for this podcast. I'm going to add it. The Fifth Discipline: The Art of and Practice of—

Remember, that was the one that inspired me and gave me hope. And then it was a later one where he dashed it and said everything he said in this one, he's not sure. He's not sure it's true because he's not sure human beings and companies in particular are willing to look at the current reality. And if you think about it, what those CEOs in the don't tell, don't ask governance syndrome, which is a big piece of the book.

Yes.

They don't want to show the board the current reality because they're afraid the board is going to ask them a whole lot of questions about their judgment and how they concluded that accepting that level of uncertainty was the right thing to do. So the easiest way to avoid those questions is don't tell the board.

Yeah, but that's not the right thing to do, especially if you care about your organization, I mean, long term, right? Now, as someone who's built and sold one of the world's first integrated risk and assurance software platforms, we do have quite a few wanna-be entrepreneurs within my audience. What leadership lesson did entrepreneurship teach you about uncertainty and accountability?

Well, my history was, is I built a methodology to help companies self-assess their current reality on mission-critical objectives. And I was successful and companies started to actually pay me up to $100,000 for what was a CD at the time. That was a collection of training courses, reference aids, and materials that, that they could help them implement the methodology. So companies like Mobil paid me $100,000. It gave them the right to use the methodology across their whole company. The success I had with big corporations like Mobil and Telstra in Australia and KPMG licensed my methodology around the world in 22 countries caused me to build software, which you refer to, and my software was called CARD Map and CARD stood for Collaborative Assurance and Risk Design. And I branded all of my tools, card map, card line, card model, everything was branded around collaborative assurance and risk design. The central seeking consensus agreement on the acceptability of uncertainty linked to key objectives should be a central goal of every corporation, but it should also be a central goal of people, individuals. So, when we look at that, the software, I was passionate about it. I promoted, my clients started to, if you could imagine a company like Mobil implementing risk assessment on all of their mission-critical objectives in 100 subsidiaries around the world.

Wow.

You get to sense the sense of data. All of that needed to be consolidated for a consolidated report to the big, big parent company.

Yes.

So it became clear we needed software. So I was, I suppose, young and bold and crazy enough to say, well, damn it, if we need it, it doesn't exist out there. I'm gonna go build it.

Wow.

So, so I convinced 4 of them to give me $100 grand on the premise that I could deliver software that would do, do what I told them. And I used that money and we built version 1 and we released in 1997 CardMap. The goal was to show the CEO of a company or any of its subsidiaries, the current state of risk linked to mission-critical objectives in that subsidiary. And a consolidated view of risk to the consolidated company's mission-critical objectives, which often tended to be grow revenue by— grow our proved and probable reserves by 3 million barrels year over year, et cetera, et cetera. So I was proud that we actually pulled that off.

That's amazing.

In the year 2000, we took our platform to the cloud, we web-enabled it, started to sell software as a service. That was in 2000. So that was 26 years ago.

That's amazing.

Here's the rub, though. I eventually sold my company to a top 3 GRC software company in the States that offered traditional risk and internal audit services because Sarbanes-Oxley threw all progress back 2 decades.

So I know by doing research for this podcast, you don't like SOX very, very much, but yes.

Yeah. So there it was. So I had 2 companies interested in buying mine. I sold to Paisley, but what that and my 40 years taught me is what I'm promoting. It's not that it doesn't make perfect sense.

Yeah.

It's that the forces against it happening are so powerful.

Yes.

And when I say even the regulators, the regulators could, in a stroke of a pen, call on every listed company for the board to have a stated purpose. That was disclosed. They won't. There is no regulatory regime in the world that calls on the boards, who they claim is the foundation of governance. Yeah, but have a clear stated purpose.

It looks like the FTC should do that, or the SEC, right?

One would think so. I've, I've published posts, why won't the regulators say that boards should oversee risk linked to mission-critical objectives. It's not a hard concept, right?

It makes perfect sense.

They won't. There is not a regulator in the world or a governance code in the world that is clearly stated. Board should ask for clarity on what are this company's mission-critical.

Why, why do you think that is? Looks like from within the organization, we can think, okay, maybe it's human behavior, maybe it's just a process problem, but This is a little bit bigger than that, right?

I, I, I, I have done full posts on it and I've asked my, I've asked AI why regulators won't ask that.

Mm-hmm.

I would go down and talk to the Financial Reporting Council in London when I was there. I, I worked there extensively in, in the UK. There's a 4-year case study. I would go down and promote this idea and say, why don't you, you know, why don't in your governance code, you just simply call on all boards to agree what are the company's mission-critical objectives with the CEO?

Yes.

And ask for information on risk. Here's their answer, Tim. It makes perfect sense. It's too big of a change.

What?

I'm giving you the honest-to-God truth. Now, they wouldn't put that on the record, of course.

Yes.

So now, and then we look at what's— who is— who are the primary players in the SEC? The SEC is heavily populated with lawyers.

Yes.

The US is incredibly compliance and litigation driven.

Mm-hmm.

So although the SEC says their job is to protect shareholders, and broader stakeholders. The SEC has been unwilling to— and I've sat in, in, in Washington and presented these ideas in, in person.

Wow.

To the powers that be at the SEC and the Public Company Accounting Oversight Board later when it emerged after Sarbanes-Oxley. Yes. They are unwilling to do what would obviously improve governance exponentially if they did.

Do you have any insight why?

Uh, I suppose the cynic in me says the lobby actions in the government at the political level make sure that the SEC won't do anything that their political masters, yeah, will be unhappy with. And who do they answer to? Well, There is a strong view that the major corporations have a strong controlling influence on agenda.

Well, thank, thank you for publishing your book. Before we talk more about the book, sir, we have our first live question from the audience. Jam Skinner says, I have a similar approach, that is deriving concept of intangible asset, those asset which support the organization business model and achieving strategic objective and for which we need to steward and grow for the overall sustainability of the firm. However, I found some organizations don't want to spell this out formally. Okay, we talked about that, either effort to do it well or as if somehow creating clarity creates new problem gaps, I guess more work. Can you comment on what you think the reason is why boards, senior management do not want to articulate this? This is really the elephant in the room. My friend. And you really—

Okay, so a piece, a piece that I didn't touch on that's extremely important is Chapter 1. Also, surprisingly enough, in spite of scores of books on corporate governance, governance code guidance, there is no clear definition of governance. So not only do boards not have a clear statement of purpose, Yeah, the purpose of governance is not stated either. So one of the things that—

that sounds so basic though.

Okay, so it goes to the, to, to your, the question. Oftentimes when people are writing— so you have the South African governance code and you have the brand new guidance from COSO, and the NACD withdrew from the project, they didn't want to be associated with that they were associated with the May disclosure, uh, exposure draft, and then they pulled out and, and didn't want to be associated with COSO's final guidance that was issued in July. Unfortunately, many times when you try and define governance, it, it comes down to— everybody's agreed that corporations should have a clear purpose. Well, Does that purpose just focus on enriching shareholders and creating shareholder wealth, or is it— are corporations in our society designed to accomplish broader objectives? And it's— the difference is called shareholder capitalism versus stakeholder capitalism.

Yes.

The US was trending towards more stakeholder capitalism. That has been aggressively reversed under the current political regime.

Mm-hmm.

However, South Africa's governance code, it's clearly a stakeholder governance model in terms of what it says. So What that means is that nobody clearly wants to define governance in terms of its purpose. So is the purpose of governance to enrich people that buy your shares, or is the purpose of governance to ensure the company is establishing and accomplishing some broader purposes? Well, the general consensus is that boards should decide on the purpose of corporations and the corporations should disclose it. Well, that's a pretty new idea, and a lot of American corporations, what they disclose as purpose is rhetoric that it really defies— is that clear what their purpose is?

Yes.

So Unfortunately, in Chapter 1, it isn't just that boards lack purpose. Boards lack purpose because governance lacks a clarity on what its purpose is.

Yes.

So, why do boards— why are most boards purposeless? Well, because governance is not clear on its purpose. If governance was clear on its purpose, boards would be far more pushed into stating what's the board's purpose in fulfilling the purpose of governance. So we have a global— and this is AI-researched all over the world. This isn't unique to the United States.

Yes.

This is a purposeless governance and purposeless boards is the root cause of why governance often fails because there's no clarity on purpose. So you Boards say, well, we just did a board assessment. Well, what did they assess against if they don't have clear purpose? How do you do an effective assessment if you haven't told anybody what your purpose is?

Yeah, yeah. But I, I mean, this is really mind-blowing because what you're saying is not rocket science. It, it makes perfect sense. It's actually basic, but we've been doing this for a long, long, long time, so it's Wow.

Well, what you've identified is one of my sources. So 40 years it's taken me to really crystallize this.

Yes.

So it's, it's the book is the clearest articulation of what's wrong in governance that I've pulled together in terms of persuasive arguments.

Yes.

However, very few people over the 40 years have argued that the core concepts of focusing on mission-critical objectives and making sure that management and boards are aware of the current state of uncertainty in order to drive improvements. And the notion that every company should be able to take all the risks they want, subject to only one caveat, that level of risk should be okay to the board. Yes, that presumes the board is aware of the risk that management is taking. And the majority— so when governance fails, the number one defense Over the last 50 years, boards say, we didn't know, sorry, you know, had we known this, of course we would have done something, but it is your job to know. It was the case in Australia, just got argued. The Australian government concluded that the board defense of I didn't know is fine. But literally the courts in Australia decided that the board defense of I didn't know was acceptable to the court.

How can that be acceptable?

And they wouldn't hold the board accountable. Now, US courts, Chancery Court in Delaware, which is the primary court where derivative shareholder actions against directors are tried.

Yes.

They have said that boards should ensure there is a system that provides the board with information on risk linked to mission-critical objectives.

Yes.

However, they've been pretty, we'll call them, but for lack of another word, chicken shit cases, meaning they weren't seen as real big cases that directors should care about. Now, Boeing and Wells Fargo, those wouldn't have been minor league cases. They got settled. The vast majority of director and officer actions against boards for negligence are quietly settled because it doesn't expose the board to— was the board overseeing mission-critical risk?

Hmm.

So you settle it out of court. You keep all of the details away from the public because of course a court hearing is public.

Yes.

So the D&O insurers settle for billions and billions and billions of dollars. Of course, the shareholders all pay for this.

Yes.

And it becomes, uh, uh, why won't the D&O insurers just point blank ask, is the board getting reliable information on risks linked to mission-critical objectives? Well, if they ask that, they, they are fearful of the answer. So the majority of companies, the answer right now is they don't. The systems are not designed to do that.

Wow. Okay. So looks like we only have about 5 minutes left, but I think what you have uncovered is really critical to everything we do. I mean, this is like, I don't know, I guess mission zero, I would say. So there's definitely this big elephant in the room and looks like everybody knows about it, but nobody wants to do anything about. And again, everybody, we are talking to Tim Lich and the book Mission Critical Governance, focusing on what matter most. And it seems to me like it's really the fiduciary duty of every member of the board to know. It's their job, right, to be that person who is prudent and who should know and needs to know. That's why they get paid all of the big bucks. So to make a very long story short, knowing the state of affairs, and I want to especially focus on the US right now, the majority of people who listen are from the US. What do you think is the way forward? How do we really tackle this problem, which to me seems like it's a pretty simple and basic problem, but looks like there is a lot of politics, fear, and maybe human behavior and processes that get in the way. But what is the way out, you think?

I'd like to give you a nice upbeat answer, but AI, who has been working with me for 2 years and understands all of the massive barriers, the regulators that don't want to do this, the director institutes that don't want to call on boards to oversee mission-critical objectives and risks, the IIA that doesn't want to tell auditors to stop writing up management's deficiencies and weaknesses, the risk institutes whose members are still largely producing risk maps. Yes, AI unfortunately gives me a 10 to 20% chance of meaningful change because the forces against protecting shareholders better are stronger than the shareholders who are not demanding change.

Yes.

So, uh, in the absence, institutional investors have done so. Sometimes what institutional, institutional investors know about the don't tell, don't ask governance syndrome. So you do a hostile takeover and you put your own CEO in. You tell them, you damn well make sure you tell us, us, us being the investors, what's going on.

Yes.

All right. That's how they handle it. They get rid of the public company optics and governance theater and they put in a different regime where they're actually in the know about what's going on.

Yes.

So, um, What are the things? So in Chapter 16 of my book, it says these are the things that might happen that could potentially drive positive change. If the Director Institute, if the Director and Officer Insurance Company said tomorrow, uh, if you don't, if the board doesn't ask for regular reliable reports on mission-critical risk, uh, we'll charge you 100 and 200% more.

Yes.

Everything would change overnight.

Yes. Yes.

So if the regulators, if the SEC said, hmm, the standard of care we expect of boards is that they are overseeing mission-critical objectives and risks management staking in pursuit of them, again, everything would change.

Yes. Yes.

But I've told you, director institutes don't want to do it. Regulators don't want to do it, and D&O insurers don't want to do it.

Yeah, the SEC doesn't want to do it. All right, we get the picture. Now, the C-level suite, let's focus on the CISOs. A significant portion of my audience here, we are in information warfare and cyberspace. As a Chief Information Security Officer or Chief Security Officer, depending on the company. Many of them, they kind of feel trapped, you know, between operational realities and board-level communication gap. No, they're just like a small, uh, crowd, I think, in, in this big system. What advice would you give a security leader trying to influence executive leadership, trying to do the right thing? What would you tell them at that level?

Uh, I would advise them to do everything they can to help their companies adopt mission-critical governance and not get fired, right? Yes, and not get fired. Um, but a lot of IT security people are like internal auditors. They, they say, well, of course you should protect data security, and of course you should make sure that we have wonderful business continuity protection and plans. And it's not their job to decide how much risk to take on those points. It's management's job.

Yes.

So you need, you need to make it clear that it is the C-suite and the board that decide how much risk they should take on IT security and business continuity. However, to do that, you have to overcome the don't tell, don't ask governance syndrome. So the CEO doesn't want the chief information security officer talking about You know, well, what is the, what is the risk that our confidential customer data files are hacked and exploited? Well, let's just first, who owns that objective? Well, if it's the chief information security officer, you're dead in the water. Yes, because they're just setting them up for a fall because they have no ability to resource the treatments that are needed Yeah, you become a scapegoat.

Yeah.

So now, of course, if you get paid enough as a chief information security officer, you may be prepared to accept being a scapegoat. Yes, it comes, you know, you— it's, it's clear you're being set up. If things go bad, you're going to be the one that's hung out.

Yes, yes.

So unless you can get the C-suite to acknowledge it's their decide— it's their job to decide how much IT security, how much business continuity risk the company takes. But don't analyze that in a vacuum. Analyze it in the context of other mission-critical objectives like hitting sales targets and the share price. And yes, don't talk about IT security as if it's a vacuum that has no, no relevance to anything else, like customer service. I mean, customer service, it was probably The company I told you about the barbecue, it has an AI chatbot.

Mm-hmm.

So I'm trying to put in my warranty information and it kept telling me that my model number on my barbecue was wrong.

Hmm.

It was absolutely correct. I got it right off the barbecue. I called my barbecue vendor and verified the model number.

Yes.

All right. So then I just say, okay, well, it's giving me an edit control and not letting me file my warranty. Claim. So I decide to talk to chatbot. Chatbot doesn't know anything about what's causing these problems. Yeah, it doesn't take any responsibility for fixing it. So then I called the customer service number and it just gives me a recorded message saying the wait time is over an hour, call back some other time, uh, and maybe you can talk to somebody.

Wow, this is really Fascinating. Looks like we've already run out of time. Can we stay for another 5 minutes?

I'm fine for time.

Okay. Thank you. Thanks so much. I think this is so critical. We do have one more question from our live audience. Daniel, who is a very active member of my tribe, Daniel Young says, what have you seen actually move the needle? Metrics, incentives, or board behavior that convert first-line fear into candid proof of certainty disclosure the board assurance index can rely on?

Anything? Well, I suppose I believe that it starts with the purpose of the board. If the purpose of the board— if the board said to the CEO, let— I want to be very clear, uh, CEO, one of your primary jobs is to make sure we get regular reports on the true state of risk linked to mission critical. And I don't mean the ones you just make up. We want some independent assurance that it, that it's reliable stuff and it's not clouded with cognitive biases and concealment because you're worried that we'll ask you hard questions. It starts with the purpose of the board. Yes. So the question asked is, in the absence of the board believing it's their job to oversee risk to mission-critical objectives, and in the absence of chief risk officers and chief audit executives believing that part of their purpose is to ensure management and the board get reliable information on the state of risk Yes. It just isn't going to go anywhere. I mean, the other is people are also starting to talk though about whistleblowing mechanisms that go straight to the board without going through the C-suite at all.

Yeah.

The whistleblowing goes to an independent law firm who then provides a report directly to the board. I acknowledge that that would certainly put the fox in the henhouse for sure, particularly if the whistleblowing line said, if you're worried about the state of risk linked to any of this company's declared critical objectives, you should be using the whistleblowing if you don't feel it's safe to talk to your management.

Yeah.

All right. But I accept that that might, but That's not something cultures like.

True.

And I don't believe— I don't know how many CEOs would be happy with anything getting to the board without them looking at it.

Yeah, yeah.

So, it has to start with the board telling the CEO, be very clear. A condition of your employment is that you provide us with candid information on the true risk. And uncertainty. And as long as we're comfortable that you're making wise decisions on what constitutes acceptable uncertainty, we will be there for you because we hired you.

Yes. Yes.

And however, we may sometimes not always agree. We want to have a good discussion with you when you're thinking something is worth taking the risk. But we're not at all comfortable with it. But remember, the number one defense the boards want to use is we didn't know.

Yes.

So as long as boards want to use the number one defense when things go bad, we didn't know, the easiest way to make sure you have a we didn't know defense is don't ask for it.

Yeah, they basically cannot handle Well, I guess this is what I am going to say. I know there is a lot of aspiring leaders who watch this podcast, but we do have a lot of very senior members too, and people who are members of boards, I guess, including myself and a couple of nonprofits. But I think for board members, board directors listening right now, it is your job, right? The buck stops with you. You need to know the purpose of governance and the purpose of the board. That is your job. That's why you are on the payroll.. And that's why that's, that's your fiduciary duty. I mean, there is no way around that. So I think everybody listening to me right now, I think it's critical. That's definitely the elephant in the room. Board members, you need to do your job. It's really as simple as that, isn't it, Tim? If you are—

well, I hate to break this to you, but just because Coach, Coach BZ thinks it's the purpose of boards and the purpose of governance isn't going to change the whole world if they don't believe that it is the purpose of boards and the purpose of governance. So, uh, well, as much as you're a wonderful guy and, and you're influential, uh, unless you can convince some of those D&O insurers, uh, SEC, uh, OCC, um, the IIA, uh, none of those people believe right now that that the board's purpose should be to oversee mission-critical risk.

Yeah. Wow. Oh, well, I don't know what else there is to say, but this is why I believe your book was scheduled to be pre-ordered in July, but in Amazon, it's available right now. People listening, you can pre-order the book, Mission Critical Governance: Focusing on What Matters Most. I believe this is going to be an instant bestseller, and you can now See why. So, I encourage everybody to preorder a copy of the book now. So, thanks again for your time, Tim. I'm going to need to land this plane, but before I do, let me ask you about AI. You've mentioned AI a couple of times. AI has definitely, especially generative AI, changed a lot of things in our industry, almost every single aspect really of society. How do you think internal audit should evolve in the era of artificial intelligence, cyber warfare, and systemic operational risk?

Well, I think every chief audit executive should ask AI, is me going out and identifying what we think are management's deficiencies and weaknesses and writing them up on a small body of the really significant risks and often avoiding mission-critical objectives entirely, Is that the best way for internal audit departments to function?

Yes.

Unfortunately, I believe that AI— they're going to try and use AI to do more fault-finding of management's weaknesses and deficiencies. And AI can figure— they can give you that report in, you know, they would have spent 1,000, 2,000, 4,000 hours of audit, and then AI can write up list of likely management deficiencies in 3 minutes. They better take serious stock that if in a world of AI, and the book closes with the future of governance, AI will expose that current systems are not providing boards with good information on risk linked to mission-critical objectives. Objectives. It's just, it's just a statement of fact, and AI can verify that in, in literally minutes. Yes, that a company is not providing— it can just look at all of the board packs for 5 years, and you ask AI, did this board get reliable information on risk linked to mission-critical objectives key to this company's success? AI will give you an opinion.

Yes, yes.

And the answer is probably going to be, in the majority of companies, no, this board is not getting reliable information. The systems are not designed to give the board that true information on risk. So AI can expose that in minutes.

Yes. So I guess we do need courageous governance. I believe it's really at the board level. I don't think anything the C-suite is responsible for that. It's the board that should tell, hey, C-suite, this is what it is and execute. So for courageous governance or for board members who are listening right now, how do they create cultures where uncomfortable truths can safely travel upward, where they become more and more able to handle the truth? What do you think?

Well, I think the most uncomfortable discussion they have is, can we agree on a board purpose statement that actually looks like something other than rhetoric? Yes, that clearly defines what will be different as a result of our existence. If you're going on to a not-for-profit board, you're, you're not exempt in this. We work with not-for-profits and charities. There's no difference between what I'm saying. Yes, are you going to be the board member that says to the CEO, you make sure you deliver us reliable reports and we don't want a a lot of half-truths. We want to know the state of uncertainty linked to what you're claiming are key to our— are that we've agreed, uh, are key. And if safeguarding confidential donor information is one of them, who's going to be talking to us about the risk of donor data disclosure for others that want to approach them and for other nefarious methods? So the question, it isn't just an academic question, it's, are, will you ask it?

Yes. Well, we should. We should.

Yeah, it's a good idea, right? Yeah, yeah, I know, I know. And then, yes, you know, nobody debates with me. I, I have many good buddies that sit on multiple boards. They chair boards.

Hmm.

Go and ask a board member, why haven't you asked the CEO for regular report on mission-critical objectives risk.

I guess it really takes courage, huh?

Yes. Well, it takes moral fortitude and a belief that you have been appointed to represent the interests of shareholders, not to represent sticking with the status quo and sticking with the game you learned when you were a CEO. Yes, this is about are you truly representing shareholders if the board refuses to ask management for regular reports on risks linked to mission-critical objectives?

That's, that's it. So for people who are going to pre-order your, your book and read it when it comes out, uh, in August, uh, what is one idea from your book you think would create the biggest impact, especially for board members?

I suppose it's, it's for board members. Do, do you, do you really believe that you are representing the interests of shareholders in the company, or are you representing the interests of the management team that you put in place?

Yes.

And if you look at the biggest disasters in history, the, the 2008 global financial financial crises. I mean, the evidence is clear that the don't tell, don't ask governance syndrome was at full force. Yes, yes, during that. And if you look at the Boeings and, and the Wells Fargo and the McDonald's and the— you can look at all of the major governance failures. Um, yes, it, it It's about people are so used to the way the game is played. I use the analogy in the middle centuries, the medical profession concluded that bleeding people was a cure. They honestly believed that. So the majority of doctors at the time believed that bleeding out people was a way to cure them. Now, here's what I have had to come to grips with. Changing that view took centuries. Yes, not decades. It took centuries. Well, the views that boards aren't to ask about the risk to mission-critical objectives and C-suites don't want to tell the board with any candor and reliability the risk, it has taken 100 years to develop those rules of the game. Yes, all the players, just like those doctors, they've been told that governance is having charters and having committees and, and approving the strategic plan and asking the head of audit for their report on the 20 audits they did and asking the head of risk for this year's risk map. They tick all of those boxes, but they are not overseeing the state of risk to mission-critical objectives.

True. Yeah, because what you, you've said is so true with bloodletting, right? King Charles III was just here a couple of weeks ago talking to a joint session of Congress, but one of his direct ancestors was named after King Charles II. He was famously subjected to intense bloodletting, I think over 24 ounces if history says it's right, and purging. And in 1685, after a seizure which accelerated his demise, and then, uh, um, yeah, rather than curing his underlying renal failure. So if the King of England at the time was the most powerful person in the world, was subjected to that, you know, you just have to imagine when that was definitely not the right thing to do. Okay, I think we're gonna have to leave it there. And for people listening, especially board members and members of the C-level suite, you absolutely have to order this book, Mission Critical Governance: Focusing on What Matters Most. Most for your organization, most for your shareholders, but I think for your stakeholders too. I think it's not just people making money and having profit out of what you do, but also the local community and I think society at large as well. Before we end, Tim, I want to focus back on the tribe I care the most about, aspirational military commanders and tech executives in my audience. What advice would you have for those young leaders entering governance, audit, risk, and cybersecurity professions today? What's your advice for them?

I suppose bluntly, it's Speaking the truth may get you killed. So, so, so be very cautious. One of the things in my training, I, you know, when I was learning to be a driver many, many, many years ago, um, you know, I was out with my, my parents and, and other people, and you're approaching an intersection and, and you have a green light Green light says you should be able to go through. However, it's fairly obvious that somebody's coming from your right or left side, and it makes— it looks like they have a red light, but they're not going to stop.

Yes.

So my advice to those young officers is there's no point being dead right. So in the public sector, and I have done a huge amount of work in the public sector all over the world, including looking at the US's, uh, how they look after nuclear weapons. I trained all of the audit folks in that area. So be very clear though, if the culture will not support it, your information about the true state of risk may be completely factual and correct. And it may show great balance in terms of competing resources, but if the culture doesn't want to hear it, you will die trying.

Yes.

So, so I don't want to train anybody to go and commit suicide, career suicide. So if you are in a culture that is don't tell, don't ask, So in the US government, who asks about the state of risk about the stability of your nuclear bomb armaments? Does anybody think it's their job to oversee the state of uncertainty that a bomb goes off in Indiana right now in one of the underground silos?

Yeah.

So when we look at, at risk, you have to understand there is an enormous power imbalance, and there is also, um, an aversion to transparency on the state of risk and uncertainty linked to objectives that political masters or, or CEOs in the private sector say are important. But oftentimes CEOs say something is important, but the facts are quite clear that it isn't.

Yes, yes.

But by the decisions they make. True. So to all of those young folks out there, read my book. Proceed with great caution. Analyze the culture you operate on and its ability and willingness to take the truth and your capability to produce balanced truth. And many times, unfortunately, IT people in particular, they don't show any great understanding of the overall mission of the corporation and the need to allocate scarce competing resources. So you have to be— it has to be clear to your masters that you understand that. But in the final analysis, if they don't want to share the accountability that comes with knowing, the easiest way is to make sure you don't tell them.

Yeah, I don't know.

They make it clear, they make it clear, you know, we're hiring you, and by the way, if things go badly south and it relates to information technology security, we'll be— you'll be out of your— out on your ass faster than we can blink because you were supposed to look after this. Well, that's absurd.

It is.

So, um, those people that work, that, that specialize in that and work in government— and I have done, I've worked across all kinds of government departments, the Department of Transportation, tax, social services, uh, yes, you, you name it. I, uh, City of Detroit was a a customer, uh, they wanted to, to implement. Be very aware though that many boards don't want to know the truth. Oh well, if you have one of those, be very careful about crossing the CEO that doesn't want them to know. Yes, because they're far more powerful than you are.

That is sad but true. Okay. We're going to have to leave it there. We've definitely run out of time. Thank you so much for giving us extra time today, being one of our master teachers. Again, everybody, the book is by CRC Press, and everybody needs to preorder it today. Mission Critical Governance: Focusing on What Matters Most. Hopefully, we're going to help make it like a, not just an Amazon, but hopefully even a New York Times bestseller, so it won't be ignored. So a lot of Fortune 500 folks are going to have to read it. And at least then they they would know, you know, especially for a board member who just have completely clueless. So they can start asking the very, very tough question. So as we end, Tim, how can my audience give value back to you? Thank you so much again for giving us all of your insight and wisdom today.

Well, I hope they'll follow me on LinkedIn. And if you're a user, you can click on— unfortunately, when you go to my profile and you look at my activity, I post on 17 LinkedIn discussion groups. So you gotta— there is an objective-centric risk and uncertainty discussion group that I founded. Um, you can join that and it's a quick and easy way to go and have a look at a couple of years of posts. Uh, if you want to Google me and say, what are the most important articles authored by Tim Leach over the last 40 years?

Yes.

Um, ask an AI agent. Um, the theme of what I've said is, is consistent. My understanding, risk, risk understanding, that it's culturally difficult to challenge is greater now. Yes.

Now we also have a risk oversight in some of your article as well, right?

Yeah, that's in the resources page. It has, uh, 30 years or 40 years of— it has the original article I wrote in 1990 that launched a generation of change. Yes.

Yeah, yeah. Both risk and uncertainty management. Now, can you also tell us this about, uh, your class Certified in Mission Critical Objectives, uh, serious Thanks for bringing that up.

We just updated this whole 11-module certificate. It's $693 US. You can take it at your own pace. It's all updated materials, 11 modules. The first module is a broad overview of the concepts. The second one though is right into common objections you're going to face.

Yes.

Remember, a lot of times the objections won't be very truthful. They'll be disguised because saying why they're objecting with full truthfulness doesn't sound very good.

Yes.

So make no mistake though, you're up against a lot here. If you have boards, and I'm talking about the majority of boards in the world, don't want to ask ask CEOs for regular reports on risk status linked to mission-critical objectives. We're not talking about a few outliers here. Yes, we're talking about the majority of boards don't want to ask that simple, what are our mission-critical objectives and what's the risk linked to them? You have a problem that is so embedded that the regulators have endorsed that, that the director institutes have endorsed that. The Risk Institutes have endorsed that. The IIA has endorsed that. None of those organizations just plain and simply say a key part of governance is boards need clearly stated purpose and yes, ideally need to acknowledge oversight of mission critical. Now, if a board says our purpose isn't that, our purpose is to just go through the motions that, that are expected of us. Get that documented in the minutes that we've reviewed the strategic plan, we've asked some questions, we've reviewed the Chief Audit Exec's report, we asked some questions, we, we looked at the risk map and we asked some questions. That's our purpose. Our purpose is to ask questions about what management brings us.

Yeah, that's— that is really a sad state of affairs. I always like to end with a positive note. Again, thank you so much for giving us extra time today. Before I ask this last question, is there anything, Tim, I should have asked you during this time together? Anything you wanted to share we didn't get a chance to cover?

Maybe you should reflect on, should I actually embrace all of these ideas when I start taking board positions?

Yeah, I think the answer should be yes. And we definitely want everybody to go ahead and sign up for your class, all of the C-level suite people listening now, and especially those who are board members, because really, in my opinion, that decision remains with the board, not even the CEO or the CISO or the CIO should make that decision. It should go from the top down. That's the way it's supposed to work. But thanks again, Tim. One question I wanted to ask before we end is, is if you could go back, right, and give a piece of advice to your 17-year-old self. So you gave us the story at the beginning of the show, you were 17 years old and you almost died in a car accident. But now having lived this long, standing at the edge of this incredible career you have had, especially, you know, I think the impact you are having on the entire industry, what would you say to that 17-year-old Tim?

Try and think through what your purpose as a human being is and what your purpose you would like to pursue in your career is. And try and state— I'm looking at a poster that I built as a mission statement for my first company, Card Decisions, and It's, uh, at the heading it says, changing the way the world thinks about control. So I've had a purpose that wanted to change the way the world thinks about control for, yes, 40 years.

Wow.

I felt it was, it was not good, and it was not good in an important way, and that I should try, yes, my best Well, you are definitely making a dent in that universe, sir, with this upcoming— So that's my advice, is, is— but it's harder to think about what's my purpose as a human being. Now, be very aware, my team of psychiatrists and psychologists say that we as human beings don't want to think about our purpose of ourselves as a human being, yes, or the purpose of the corporations and organizations we run and own. Oversee.

Yeah, which in America, a corporation is now a person, right? Yeah.

Wow.

Remember, you're battling against the human aversion to clarity on one's purpose.

Yes. Wow, that is really deep. Okay, we are going to leave it there. Now, we did talk about some pretty heavy stuff, and it looks like the world is going in the wrong direction right now. Uh, what is one thing you are feeling optimistic about?

I'm feeling optimistic that people like you would, would invite me on this, uh, podcast and that, that I can influence, you know, whatever number of people. And I will send all of my followers and, and my LinkedIn people that do my reading to, to the podcast.

Thank you.

And we hope that thinking about, thinking deeply about, are we really going in the right direction, or should we stop and go back to the fork in the road and rethink? And it's a hard decision because you might be many, many miles down the wrong fork.

Yes. Yes.

It's a big trip back to the fork and then go. And it takes huge human courage to say, we as a profession have been doing this wrong since the inception of the profession.

Well, but this is the burden of leadership. If we are going to lead, we have a decision we need to make. Yeah. Well, thank you. Thank you so much, sir. Very, very last question and we need to end the show. One word that represents our shared experience on this podcast today, sir. One word.

Inspiring. Yeah. Inspiring that you would ask me to all of these questions that Um, they're important questions that you have asked me, and I hope that many, uh, around the world will embrace at least considering my arguments. I mean, I don't accept— yeah, just like my wife, I don't expect her to just say, well, it's clear that you're right and I'm wrong.

Yes, yes, and that's true.

Think about the strength of my arguments and think about— go ahead, ask AI.

Yes.

Ask AI to read my book and then what are the intellectual flaws in Tim's theory?

No, I don't think anybody's going to find any flaws, sir. I think the bottom line is, like you've well stated, there is an elephant in the room and everybody knows it and people just cannot handle the truth. So I think it's going to take Courage, more fortitude and courage for people who are board members, part of the C-level suite of the organization to start making that change. I guess for the first time, I've been doing this podcast for about 5 years now, I've never felt so challenged. So thank you for challenging each and every one of us. Myself, I sit on a couple of nonprofit boards and I need to think, am I going to ask them the question, what are our mission-critical objectives and what are the risks associated to them? That's my job as a board member on the organization. And if I can't do that, then I shouldn't be on the board. I need to do something else, maybe sell ice cream and make people happy, right?

Well, and remember, on those not-for-profits, whether it's this Cancer Society or if you passionately believe in the mission that you're sitting on, and oftentimes you're doing it as a volunteer, correct? This is an approach that will increase the likelihood that that cancer will be cured and that diabetes will, will people, the lives of diabetics like me will be improved. Well, if as a board member you passionately believe that mission-critical governance will increase the likelihood of those outcomes in those causes, you should be just as passionate about convincing your fellow board members and the and the management of those causes to change the way they've been approaching it.

True, true. Yeah, it does take a lot of courage when you do things a completely different way because I had a great, great chance in my life, opportunity to be a commanding officer. Very, very few people, less than 1% of people who joined the Navy end up being commanding officers. But one thing I've really learned is, yeah, this may have been the way we've been doing things since the beginning of time, but is it the right thing to do? Right now. But first, you have to take time to first listen and learn and don't make any changes. Just see how things have been going. And then after you've had enough information, okay, maybe we need to do things different. And having an answer like, oh, that's the way we've always done it, that's not a good answer. No, that's just not.

And sometimes there's a window of opportunity that the culture opens briefly for an opportunity to drive some change. Yes. You have to hope though that some of those powerful institutions like the Director Institutes, the regulators, the people that write governance codes will just clearly state that boards should have disclosed purpose and everything the board does should be aligned with what they claim is their purpose. And if the purpose is to review and ask some tough questions, what management gives us, fair enough. If you're a shareholder, you can decide, is that what I want from my board?

Yes. Oh well, thank you, sir. We're not going to solve this today, but I guess you give us a ray of hope. And I'm really hoping for the courageous leaders out there who are listening to this podcast, the change is going to start with you. All right, thank you so much. I really, really appreciate your help. Thank you for being one of our master teachers today. You've given us a lot of things to really think about.

So I appreciate that. Thank you so much for having me. And I'll make sure that I try and encourage tens of thousands to look at your podcast.

Good. Thank you, sir. I appreciate that.

Thank you, Bob.

All right, everybody, this is one for the book. I think this is one of the few podcasts that actually challenged me myself. And yes, it's something we definitely need to do. So again, everyone, you can preorder it in the US for sure on Amazon only. Mission Critical Governance: Focusing on What Matters Most, right? Tim J. Leach. This is a book every executive and every board director needs to have. And make sure to follow Tim as well, especially on LinkedIn. And you can go LinkedIn.com in Tim-Leach-01950013. And also take his course, CRISC Academy, teachable.com. All right, that's all we have for today. In about an hour or so, I'm gonna be interviewing somebody I met actually when I was at the University of Alabama. She's now an AI expert. We're gonna be talking to Sarah Catherine Carpenter, my good friend. We're gonna be talking about Trustworthy AI: Leadership Lessons from the Front Lines of AI Safety. She's going to be in the green room in about an hour or so. I hope you can join us. And sometime tomorrow, I don't have an interview, but I'm gonna go back to the leadership lesson and ancient wisdom from the book of Proverbs. Last time we studied Proverbs 22. And tomorrow we're going to do Proverbs 23. Again, this is not religious in any way. It's just looking at the leadership lesson from a book written more than 2,000 years ago. But those lessons, believe me, are still very much relevant today in 2026.

All right.

That's all I have for you. I hope to see you in about an hour as we speak with Sarah. And thanks again for watching and see you soon. Bye for now.

Thank you for tuning in to the Leadership and Success Podcast with your host, Coach BZ. If today's episode added value to your leadership journey, be sure to subscribe, share, and join us again for more wisdom nuggets on how to lead better and achieve greater success. Remember, leadership is the most critical skill of our time. The world will always need leaders to inspire others, drive innovation, and execute meaningful strategy. So why not count yourself among the bold leaders shaping 21st century. Until next time, stay inspired, stay committed, and keep leading with excellence.