6.4 Governance of Strategy & Building Resilience

6.4 Governance of Strategy & Building Resilience

Quick Answer: Independent directors govern strategy—they do not write the business plan. Management formulates options; the board challenges assumptions, approves direction, sets risk appetite and capital allocation guardrails, and monitors execution. Resilience means the company can absorb shocks: IDs should press for stress tests, watch concentration and related-party dependency, demand succession readiness, and keep ESG and cyber risks on the board agenda at the right altitude.

Sections 6.1–6.3 built role, entry diligence, and culture. This section applies the ID lens to where the company is going and whether it can survive the trip. Strategy governance is high-yield for Board Practice style questions: the trap is either rubber-stamping strategy slides or micromanaging product features.

Strategy: Approval and Stewardship Versus Formulation

Noses in on strategy means:

• Asking what must be true for the plan to work.
• Comparing management’s base case with downside and severe-but-plausible cases.
• Checking whether the organisation has the people, systems, and capital to execute.
• Watching for strategy-as-slide-deck that never hits capital allocation or risk registers.

Fingers out means:

• Not redesigning the go-to-market plan in the boardroom every quarter.
• Not negotiating the acquisition term sheet line-by-line when advisers and committees exist—unless escalation is warranted.
• Not confusing personal industry nostalgia with the company’s actual capability set.

Scenario. Management proposes “premiumisation” across all product lines. An effective ID asks: which segments show willingness to pay, what is competitor response, what is working-capital impact, what is the two-year cash burn if volumes miss by 20%, and which projects stop if capital is scarce? An ineffective ID either applauds the buzzword or debates font choices on packaging mock-ups.

Capital Allocation: Where Strategy Becomes Cash

Boards reveal their real strategy in where money goes:

• Organic capex vs M&A vs dividends/buybacks vs debt reduction.
• R&D and digital investment versus short-term margin cosmetics.
• Related-party capex or brand payments that may tunnel value.
• Funding mix: internal accruals, equity dilution, promoter support, bank debt.

ID questions that cut through:

1. What is the expected return and payback—and who independently reviewed it?
2. What is the opportunity cost of this rupee versus the next-best use?
3. How is failure defined, and when do we stop?
4. Does this allocation increase fragile concentration (one plant, one customer, one geography)?
5. Are minority shareholders funding a project whose upside sits disproportionately elsewhere in the group?

Capital allocation linked to related parties needs the full RPT process discipline you study under the Companies Act and LODR chapters—strategy enthusiasm is not a waiver.

Risk Appetite

Risk appetite is the board’s statement of how much risk the enterprise will take in pursuit of strategy—not a poster slogan.

Elements IDs should expect:

• Categories: credit, market, liquidity, operational, cyber, compliance, strategic, reputational.
• Quantitative or qualitative boundaries (leverage ceilings, concentration limits, compliance zero-tolerance zones).
• Linkage to strategy: a high-growth digital pivot without cyber appetite discussion is incomplete governance.
• Monitoring: risk dashboards that escalate breaches, not only green dots.

Independent directors should beware appetite without capacity—management may want aggressive growth while systems, talent, and capital cannot absorb the downside.

Crisis and Going-Concern Oversight

Crises compress time. Boards that only practice fair-weather agendas fail the first real test.

Going-concern oversight (especially when auditors signal stress):

• Understand management’s plans for liquidity, refinancing, asset sales, or cost actions.
• Challenge optimistic recovery timelines.
• Ensure disclosures and stakeholder communications are honest within legal bounds.
• Watch for distress RPTs that shift value as the ship lists.

Crisis governance hygiene:

• Pre-agreed escalation triggers (covenant breach risk, cyber incident severity, fatal safety event, promoter dispute).
• Special committee options when conflicts spike.
• Clear external communication ownership.
• Personal preparedness: IDs reachable, packs securable, counsel available.

Optimism bias is a governance risk. “We have always pulled through” is not analysis.

ESG and Sustainability Governance (High Level)

Environmental, social, and governance issues are no longer only CSR brochure material. For board altitude:

• E: Climate, pollution, resource constraints that can hit licences, costs, or lenders.
• S: Labour, safety, community, product responsibility, inclusion.
• G: The board and control environment itself—your core job.

ID role at high level:

• Ensure material ESG risks appear in enterprise risk discussions, not a side CSR slide.
• Connect CSR spend (s.135 where applicable) to genuine policy, not vanity, without turning the board into a grant-making NGO.
• Challenge greenwashing: claims must match controls and data.
• Recognise lender, exporter, and large-customer ESG requirements as commercial risk.

You do not need to become a climate scientist for this exam section; you need to know ESG is board-relevant risk and reputation governance.

Digital and Cyber Risk Awareness for Boards

Digital transformation and cyber threats are strategic, not merely IT:

• Dependency on core systems for revenue recognition, manufacturing, and disclosures.
• Ransomware, data protection, and third-party vendor risk.
• AI and automation changing control environments and fraud patterns.
• Concentration in a single cloud or systems integrator.

Board-level cyber questions (not firewall brand debates):

1. What are our crown-jewel systems and data?
2. How quickly can we restore operations offline?
3. When did we last test incident response with executives and the board briefed?
4. How are third-party and group-IT dependencies governed?
5. Is cyber insurance understood—including exclusions?
6. Are we investing proportionally to the digital strategy we approved?

IDs with limited tech backgrounds still own the oversight questions; they can demand independent assurance rather than pretending expertise they lack.

Building a Resilient Company: The ID Question Set

Resilience is the ability to absorb shocks and adapt. Independent directors can force resilience thinking with a recurring probe list:

Stress tests

• What does a 20–30% demand shock do to covenants and payroll?
• What if interest rates or input costs jump and stay high?
• What if a key licence is suspended for 90 days?

Concentration risk

• Customers, suppliers, geographies, products, key persons, funding sources.
• “If this one node fails, do we fail?”

Related-party dependency

• Is the listed entity viable on a standalone basis if group entities stop buying, selling, lending, or guaranteeing?
• Are brand, IP, or critical services owned outside in ways that strand the company?

Succession

• Emergency CEO coverage and longer-term pipeline.
• Critical technical or relationship roles with no deputies.
• Board succession and ID pipeline—not only management.
• Promoter succession in family-controlled firms (governance flashpoint).

Adaptive capacity

• Can the organisation reallocate capital quickly?
• Are culture and incentives aligned with speaking up about failure early?

Integrating Strategy Governance With Earlier Sections

• Role (6.1): Strategy challenge is a Schedule IV function theme—independent judgment on strategy, performance, and risk.
• Diligence (6.2): Do not join a board whose strategy is pure story without capital or risk architecture.
• Culture (6.3): Strategy debate dies in rubber-stamp cultures; psychological safety is a strategy asset.

Worked Mini-Case: Resilience Challenge

A mid-sized manufacturer’s strategy is export-led growth financed by working-capital debt. One European customer is 45% of export revenue; a promoter-group logistics company handles all outbound freight; the CEO is the founder’s only child with no documented deputy. Cyber backups are on the same network segment as production systems.

ID actions:

1. Commission concentration analysis and customer diversification milestones as strategy conditions.
2. Require RPT benchmarking and contingency logistics options.
3. Put emergency succession and key-person risk on NRC/board agenda.
4. Demand a cyber recovery test result before approving major digital spend.
5. Ask for a downside liquidity case if the top customer cuts orders by half.

None of these actions “run the company.” All of them govern strategy toward resilience.

Study Checklist for Strategy & Resilience

• Separate strategy formulation (management) from approval/stewardship (board).
• List capital allocation questions that expose value and conflict risk.
• Define risk appetite as boundaries linked to strategy, not slogans.
• Describe going-concern and crisis oversight behaviours for IDs.
• Place ESG and cyber at board altitude with sample questions.
• Run resilience probes: stress tests, concentration, RPT dependency, succession.
• Apply a multi-risk scenario without sliding into operations.

Independent directors earn their seat when strategy season arrives—and when the strategy breaks.