Board Director

In other sectors, boards review product-caused harms, recall exposure, and safety culture. That data exists because regulators require it.

Automakers file every communication they send about a defect, plus warranty claims, consumer complaints, and field reports from the technicians who service the cars. Software manufacturers file none of this, and there is no framework that would tell them what to file.

Oversight follows data. Ask what your board would review if the data existed.

Discussion prompts

• Is the customer-centric security reporting your board receives sufficient for meaningful oversight of customer security outcomes?
• In frequency, depth, and accountability, how does your board's oversight of product safety compare to its oversight of financial controls?
• What would a material product security defect cost this organization in financial, reputational, and regulatory terms? Is that risk currently visible at the board level?