The corporate board in an age of collaborative intelligence and complex risk

Abstract

This chapter examines the role and function of boards of directors in the approaching age of AI-dependent organisations characterised by three disruptive features: shifting organisational paradigms; flattening of management structures; and changing board functions. We discuss each of these developments before contending that technology including AI is already playing a critical function in the area of risk management and risk governance, as is evident from its use by financial institutions to monitor transactions for breaches of anti-money laundering and anti-terrorism legislation. While risk management is the traditional purview of management, risk governance is the ultimate responsibility of boards and is part of their broader oversight function, as encapsulated in Australia by the statutory duty of directors to act with care and diligence. AI and technology have made in-roads into the task of risk identification within corporations, the first step in the risk management process, but we contend there are many obstacles in the path of end-to-end AI replacement of risk management and risk governance. Proponents of AI’s expansion into corporate governance tend to avoid micro-governance issues of the kind discussed here by encouraging a broader taxonomy of ‘administrative’ and ‘subjective’ governance functions instead and then arguing AI will at least replace ‘administrative’ functions in the future. We contend that ‘keeping humans in the loop’ remains critical to effective risk governance. We illustrate these issues by way of a case study of the recent AUSTRAC v Westpac litigation in Australia, which provides a unique insight into how large banks are and are not using technology in their management and governance of a global problem, financial crime risk. We conclude by explaining the impact that these insights have for the risk oversight role of boards of directors in the age of AI and complex risk. Business risks may change but the involvement of human actors in risk management and risk oversight must remain until such time as AI ceases to be over-promised-in-its-expectations-and-under-delivered-in-its-reality.