Digital GovernanceRussian Boards Survey 2018

www.pwc.ru/russianboards

2 PwC

PwC would like to express its gratitude to all the board members who shared their opinions with us in the 2018 survey. We would be delighted to answer any questions you may have.

Content

6Executive summary

8How has strategy changed?

12Why invest in technology?

14Launching essential technologies

18Digitalisation: issues and threats

4 PwC

Executive summary

5Russian boards survey 2018

Obviously, digital technologies now affect all areas of life. Last year, the whole world closely followed the course of bitcoin, the most well-known cryptocurrency based on blockchain. The growth of robotics is pushing some governments to adopt revolutionary experiments with guaranteed minimum incomes, while the development of the Internet of Things will soon turn our metropolises into smart cities with enhanced comfort and safety.

For our seventh survey of the members of boards of directors (BoD) of Russian companies, we have therefore decided to focus on eight key technologies. We asked board members to list the technologies that they consider strategically important for their companies (including those they have already launched) and about the benefits that they expect to receive. The survey also provides insights on several options that boards can take to tackle one of the main challenges that has accompanied digitalisation, namely, the shortage of talent. The report also includes a list of steps that board members can take to accelerate the adoption of key technologies and enhance the competitiveness of their companies.

How has strategy changed?Companies are moving away from short- and medium-term towards long-term planning. This is a positive trend, although boards should be more involved in strategy development. Board members believe that disruptive technology is a key driver of long-term development. In addition, 72% of the survey respondents report that launching new technology is a critical part of their company’s overall strategy.

Board members provided two main reasons to invest in technology: to increase profits and to drive service quality. However, only 7% of companies in Russia oversee technology implementation at the board level (in most cases, it is delegated to management). Another issue is that most

boards (57%) only meet with their CIOs or CTOs once or twice a year. According to 71% of the respondents in a similar survey conducted in the US, we should expect these figures to change in future years, as board members are likely to meet with their СIOs or CTOs more frequently.

Status update on essential technologiesWe have outlined the eight essential technologies1 that will have the greatest influence on global business in the nearest future (for more detail, please see Section 4 “Launching essential technologies”). The leading three technologies are the Internet of Things (IoT) (19%), robotics (19%) and blockchain (11%).

37% of our respondents report that most of these technologies have yet to be adopted widely among companies in Russia. Indeed, there are only about 4,000 industrial robots across all of Russia. Blockchain’s position in the top three, meanwhile, is largely explained by the hype of last year. Indeed, blockchain has captured the imagination of companies to such a great extent that board members believe it will have the largest impact on strategy development, along with IoT and artificial intelligence (AI), over the next three years.

The challenges of digitalisationDigitalisation efforts are being held back by a number of obstacles. Around 76% of board members believe that the lack of properly skilled teams is the main barrier to achieving the gains of going digital. A number of companies in the Russian market have successfully met this challenge by investing in prospective employee training. Other challenges include legacy technology and infrastructure.

Cybersecurity: a core element of digital transformationAs more companies undergo digital transformations, they face a number of key threats, including phishing and hacking as well as a complicated regulatory environment. Companies can reduce these threats by providing comprehensive staff training, taking sound approaches to cybersecurity and receiving timely expert advice.

It is essential to protect mobile infrastructure as well as business-critical documents that are often stored on board and management team members’ mobile devices (these are much easier to hack than corporate networks). Companies need to put effective mobile device security policies in place for all employees.

What should boards do?The following three imperatives will help board members and their companies to embrace the eight essential technologies: continuously raise your board’s Digital IQ, prioritise your technologies and integrate them into your strategy oversight procedures and assign persons responsible for cyber risk control.

First, boards need to understand whether their company has a roadmap in place for launching emerging technologies over the next several years and, if so, how comprehensive it is. Otherwise, implementation may get out of hand. Instead of a consistent business transformation, digitalisation will become a wild goose chase as the company chases many opportunities at once. If board members want to stay attuned to the latest technology developments, they need to be more hands-on and use technology in their day-to-day activities to better understand their clients.

72%report that new technologies are part of their company’s overall strategy

57%meet with their CIOs/CTOs less than twice a year

37%claim that new technologies have not been widely adopted in Russia

76%believe that the lack of the right talent is the main obstacle to going digital

1 PwC https://www.pwc.ru/ru/publications/8technologies.html

6 PwC

How has strategy changed?

• Companies are moving towards long-term planning

• Digital technologies have become an important element of corporate strategy

• Trust in new executives

7Russian boards survey 2018

However, the approaches that boards use for strategy oversight still have room for improvement. More than half the respondents (52%) conduct ad hoc off-site meetings, while only one-third discuss strategy at a meeting if all directors are present. Only 13% can challenge strategy and provide alternative standpoints. To compare, in a similar survey conducted in the US, the last two indicators were 71% and 33%, respectively.4 These results indicate the Russian board members are not deeply involved in strategic planning discussions.

Digital technologies have become an important element of corporate strategyDisruptive technology is considered one of the essential megatrends affecting the long-term development of companies. Indeed, technology is seen as more important than demographics, urbanisation or climate change. Incidentally, 41% of our respondents in Russia report that one of the most complex tasks for strategy oversight is analysing emerging and disruptive technologies. In the US, only 26% believe that this task is very complex.

Companies are moving towards long-term planningAs we noted earlier in our 21st CEO Survey, the Russian economy has resumed moderate growth, thanks to the stabilisation of commodity prices.2 Russia has moved up one place in the rankings and re-entered the 10 leading key investment markets for 2018. This indicates that companies are increasingly interested in developing their businesses in Russia, despite sanctions.3

It is only logical that Russian companies advocate a positive outlook. According to our data, more

Russian companies are moving away from short- and medium-term towards long-term planning: if last year every fifth respondent reported that their company develops strategy with a one-year planning horizon, this year the number of short-term planners has dwindled to a mere 10%. At the same time, the number of five-year planners has increased from 18% to 29%. Another 16% noted that their boards discuss company strategy over ten-year planning horizons. An overwhelming 81% believe their strategy is both ambitious and realistic, which is slightly more than last year.

Planning horizons across companies in Russia When your board is discussing the company’s strategy, what time horizon is primarily used?

10%

20%

45%

59%

29%

16%

18%

2%

One year

One to three years

One to five years

One to more than five yearsbut less than 10 years

2018 2017

2 PwC's 21st CEO Survey 2018 https://www.pwc.com/gx/en/ceo-survey/2018/pwc-ceo-survey-report-2018.pdf3 PwC https://www.pwc.ru/ru/press-releases/2018/world-economy-growth.html4 PwC’s 2017 Annual Corporate Directors Survey https://www.pwc.com/us/en/governance-insights-center/

annual-corporate-directors-survey/assets/pwc-2017-annual-corporate--directors--survey.pdf

81%believe their company’s strategy is ambitious and realistic

8 PwC

However, there are positive trends as well. 72% of our respondents are reviewing how to launch new technologies within the framework of their company’s strategy. Almost the same percentage (62%) of board members are engaged in evaluating potential developments that could lead to pivotal changes in their business or industry, while most board members also regularly take part in aligning strategy with emerging challenges and technological advances.

Given the above, it would be logical to ask whether companies have developed separate strategies devoted to digitalisation. The responses were ambivalent. On the one hand, every fifth respondent (21%) replied “yes” (compared with 11% last year), while 18% replied “no” (32% last year). On the other hand, 18% said their companies do not have such a strategy and there is no need for it (9% in 2017), while only six out of every ten respondents claim to understand their company’s strategy. Neither of these trends inspires confidence.

What affects company strategyPlease evaluate the impact of the following megatrends on your company in the long-term: (Rate each element on a scale of 1-5, with 1 = insignificant, 5 = very strong)

19%6%9%

1 2 3 4 5

38%

Climate changeand resource scarcity

Demographicshifts

Shifts in global economic power

Acceleratingurbanisation

Technologicalbreakthrough

13%

38%

31%47%

21%

19%

36%

10%

36%

25%

25%

28%

22%

28%

3%13% 9% 6% 6%

21%have developed separate digitalisation strategies

Do you have a Digital Technology Strategy?

32%

32%

21%

11%

18%

18%

32%

9%

2018 2017

11%

16%

Yes, it is incorporatedin the overall

Strategy of the Company

Yes, we have a separateDigital Technology Strategy

No

No, no need

No idea

9Russian boards survey 2018

Do you believe that the current executives team is capable of executing the adopted Strategy effectively

31%

14%

38%

45%

14%

7%

25%

14%

Absolutely

Somewhat

Rather not

Not at all

No idea

2018 2017

10%

2%

Trust in new executivesAccording to our survey results, board members have become more confident in their companies’ executive teams. More than two-thirds (69%) believe that the current executive team is capable of executing company strategy effectively. Last year, this figure was ten percentage points lower. Thus, we may recognise another positive trend: the growing trust of boards in their executive teams.

This change is primarily linked to the fact that most major Russian companies have already reshuffled

their senior leadership. In 2016, leadership changes were driven by shareholder dissatisfaction with how executive teams were handling strategy execution.5 In 2017, the main driver behind replacing senior executives was the digitalisation of the economy.6 Experts have noted that many companies felt their executives were not sufficiently proficient in modern technology and therefore began to seek out younger and more tech-savvy leaders.

69%believe that their  executive team is capable of executing strategy 

5 2017 PwC Russian Boards Survey Results https://www.pwc.ru/ru/corporate-governance/assets/russian-boards-survey-2017-rus.pdf6 Vedomosti https://www.vedomosti.ru/management/articles/2017/12/28/746796-yarkie-otstavki-naznacheniya

72%oversee the launch of strategic new technologies

10 PwC

• Key targets: higher profits and better customer experience

• Ready for new technology (but not fully)

Why invest in technology?

11Russian boards survey 2018

Key targets: higher profits and better customer experienceGiven that adding value and generating profit are the foundations of any business, it is easy to predict which benefits boards expect to gain from their digital investments. For 54% of the survey respondents, generating profit is key, which, incidentally, correlates with the results of our 2017 Global Digital IQ Survey.7 In Russia, 71% of the Digital IQ respondents noted revenue growth as the main benefit from investing in digital, while another 18% specified increased profits.

What is more interesting is the key difference between the two surveys. In this survey, half the respondents indicated that enhancing the quality of services was the second most important benefit. In Digital IQ, however, building a better customer experience was a priority only for 3% of the Russian respondents. Globally, the percentage was a bit higher (10%). Nonetheless, far more respondents indicated the importance of increased profits.

Perhaps this difference was caused by the varying experience gained and approaches adopted by our respondents. In the Digital IQ survey, we polled core business and technology leaders, i.e. people directly responsible for the effectiveness of digital transformation programmes, whereas board members have a wider strategic vision of company development and can focus on tasks other than revenue growth and increased profits.

In this case, the boards would offer a more comprehensive approach than a simple focus on revenue growth. Our Digital IQ survey confirmed the value of allocating resources to study user experience both inside and outside of a company. Companies that focus more on their people generally have better financial results than their peers, and thus more opportunities to capitalise on their digital products and services.

Ready for new technology (but not fully)All the more surprisingly, technology adoption in Russian companies is rarely overseen at the board level (7% of the surveyed companies), but rather by a member of the executive team (43% of companies). Given that board members and executives have different mindsets, one might question the effectiveness of this approach.

Another controversial issue is the frequency of board meetings with the CIO or CTO. One-third (33%) of our survey respondents conduct such meetings only twice a year, while 25% meet no more than once a year. Only 14% meet and have discussions with subject-matter experts at every official board meeting. Similar surveys in the US suggest that Russian companies will soon come to favour meetings that are more frequent. In 2012, for example, 29% of boards reported meeting with their CIOs and CTOs annually. By 2015, the percentage had dropped to 20%. In the same period, the percentage of responses reporting to “meet and have discussions with subject matter experts at all official BoD meetings” grew from 18% to 25% over the same period.

Our respondents present a mixed picture in terms of their readiness to respond to the challenges of emerging technologies over the next five years. Half of them believe they are well prepared, 18% say there is no need to be prepared, while the rest “don’t know”.

What value do you expect to gain from your digital technology investments?

7%believe that technology adoption in Russian companies is rarely overseen at the board level

54%

50%

36%

29%

29%

11%

21%

Increase profits

Create a better customerexperience

Achieve cost savings

Grow value

Open up new markets

Create innovative products

Prevent disruption fromcompetitors or new entrant

7 2017 Global Digital IQ® Survey: 10th anniversary edition https://www.pwc.com/us/en/advisory-services/digital-iq/assets/pwc-digital-iq-report.pdf

12 PwC

Launching essential technologies

• Russian businesses are in no hurry to adopt new technologies

• Impactful technology: blockchain is more important than robotics

Blockchain: A system of distributed databases (electronic ledgers) that use software algorithms to record and confirm transactions with reliability and anonymity. The record of events is shared between many parties and information, once entered, cannot be altered, as the downstream chain reinforces upstream transactions.

Drones: Air or water-based devices that fly or move without an on-board human pilot. Drones can operate autonomously (via on-board computers) on a predefined flight plan or be controlled remotely.

Internet of Things: A network of objects—devices, vehicles, etc.—that can collect and exchange data over the Internet. The term IoT has come to represent any device that is connected and accessible via a network connection.

Robotics: Electromechanical machines or virtual agents that automate, assist or augment human activities, autonomously or according to set instructions—often a computer program).

3D printing: Additive manufacturing techniques used to create three-dimensional objects based on digital models by layering or “printing” successive layers of material.

Virtual reality: Computer-generated simulation of a three-dimensional (3D) image or full-scale environment within a defined and contained space that users can interact with in realistic ways.

Augmented reality: Addition of visual or other information to the physical environment by supplementing graphics or audio overlays to improve the user experience for a task or product.

Artificial intelligence: Software algorithms that can assist in carrying out tasks that normally require human intelligence, such as visual perception, speech recognition, decision-making and language translation.

13Russian boards survey 2018

A brief overview of the Essential EightIn 2016, PwC evaluated more than 150 technologies globally and developed a methodology to identify the most useful ones. We have short-listed eight essential technologies that we anticipate will have

the greatest influence on business, both worldwide and in Russia, in the very near future.8 As part of this survey is dedicated to these essential technologies, it is worth giving a brief overview of the Essential Eight.

8 PwC https://www.pwc.ru/ru/publications/8technologies.html

14 PwC

Russian businesses are in no hurry to adopt new technologies Most Russian companies have not adopted these technologies, at least according to 37% of our survey respondents. According to our respondents, the three leading technologies are the Internet of Things (19%), robotics (19%) and blockchain (11%). The abnormally high ranking for blockchain is most likely connected with media buzz and hype.

Many leaders do not have a clear understanding of what blockchain is, what it does and for what purposes. Even German Gref, CEO of Sberbank and among the most well-informed prophets of modern technology in Russia, said, “blockchain is not mature enough to include in the list of life-changing technologies that are already here”.9

37%of companies have not adopted new technologies

Which technologies have Russian companies already adopted?

None

Internet of Things (IoT)

Robotics

Blockchain

Drones

3D printing

Artificial intelligenceVirtual reality

Augmented Reality

37%

19%

19%

11%

11%

11%

11%

7%

7%

The Internet of Things has other, more historical, sources of popularity. J’son & Partners Consulting analysts have observed that distributed telemetry, also referred to as M2M (machine to machine) communications, and IoT markets have been evolving in Russia for over 15 years, while certain segments, such as remote security monitoring services, have been around for over 40 years.10 Moreover, in recent years, the transportation industry has emerged as a key driver with projects like Platon and ERA-GLONASS enabled by IoT and M2M concepts.

The high penetration of robotics should also not be surprising. Here, again, we are talking about a lack of uniform understanding of the term. Today, the term “robotics” is most often used to refer to automation and other things that

streamline operations. For instance, a machine-learning solution that detects manufacturing defects at a metals plant is highly likely to be classified as an instance of successful process automation and, consequently, as robotisation.11

In fact, robotics in Russia is advancing at a snail’s pace. According to the International Federation of Robotics, the estimated annual import of industrial robots to Russia in recent years amounts to 290-658 items.12 The Russian Association of Robotics claims that only 4,000 industrial robots have been installed in Russia to date.13 In Germany, for comparison, experts estimate that 130,000 robots were installed and 20,000 more purchased in 2016 alone. In 2016, China purchased 87,000 robots, while the US and France purchased 31,000 and 4,000, respectively.

9 German Gref, public lecture on accelerating the pace of technological innovation, www.youtube.com/watch?v=S0aE0jOGNkA 10 Json.tv http://json.tv/ict_telecom_analytics_view/rossiyskiy-rynok-mejmashinnyh-kommunikatsiy-i-interneta-veschey-po-itogam-2017-goda-

prognoz-do-2022-goda--2018010911213711 Jet Info No. 5-6 http://www.jetinfo.ru/stati/tema-nomera/mashinnoe-obuchenie-fantastika-stavshaya-privychnoj12 World Robotics 2017 http://robotunion.ru/files/Statistics_on_the_market_of_robotics.pdf13 Rbc.ru https://www.rbc.ru/newspaper/2018/03/07/5a9e49c39a79473e0ef8c42b

15Russian boards survey 2018

22%

13%

7%

7%

11%

44% 33%

63% 37% 33%

22%

68%

48% 30%

57%

26%

54%

22%

19%

15%

4%

48%

48%

48%

48%

52%

4%19%

4% 19%

4% 22%

Drones

3D printing

Virtual reality

Augmented Reality

Robotics

Blockchain

Internet of Things (IoT)

Artificial intelligence

Very likelySomewhat likelyNot very likelyDon’t know

Which technology will affect your strategy? How likely is it that the following technologies will affect your company’s strategy over the next 2-3 years?

Impactful technology: blockchain is more important than roboticsAccording to the survey respondents, the top three technologies that will impact their company’s development over the next three years are the Internet of Things, blockchain and artificial intelligence. Answering the same question, our

US colleagues selected the Internet of Things, artificial intelligence and robotics, while blockchain ranked second last above augmented reality. It is quite possible that in the near future, when the hype has diminished, Russian boards will also review their plans with robotics and push blockchain out of the top three.

6%

9%

30%

22%

13%

7%

11% 17% 8%63%

20% 6%68%

24% 6%57%

19% 5%54%

36% 19%

18% 6%47%

42% 24%26%

42% 23%26%

Very likelySomewhat likelyNot very likelyDon’t know

Drones

3D printing

Virtual reality

Augmented Reality

Robotics

Blockchain

Internet of Things (IoT)

Artificial intelligence

8%38%

2018

2017

16 PwC

Digitalisation: issues and threats

• Key issue: talent scarcity

• Other challenges: infrastructure and legacy

• People are the main risk

• Mobile infrastructure needs to be safeguarded

• Boards of directors should influence the adoption of key technologies

17Russian boards survey 2018

Key issue: talent scarcityBoards believe that talent scarcity is one of the main obstacles to achieving the benefits of going digital. On this matter, they are backed up by core business and technology leaders. Last year, the Digital IQ survey also highlighted talent scarcity as an important issue, although not a critical one (44% of Russian respondents and 37% globally said it did not affect ongoing digital transformations).

Boards take talent scarcity far more seriously: 76% of our respondents believe it to be a significant barrier. Russia’s educational system in general responds slowly to change and, with few exceptions, is often incapable of meeting

market demand. Hence, Russian companies tend to develop their own solutions by providing in-house and project trainings.

In project training, trainees solve real-life cases for a specific industry to gain relevant experience and expertise. For example, Russia has seen an increasing number of fintech contests where participants are invited to solve real business challenges set out by major companies and prominent market players.

Compared to project training, institution-based education is a time-consuming process requiring considerable funding.

What prevents you from adopting digital technologies more quickly? How would you characterize the following obstacles to achieving expected results from your digital technology initiatives?

Lackof properly

skilledteams

Lack of integration of

new and existingtechnologies

and data

Inflexibleor slow

processes

Outdatedtechnologies

Lack of collaborationbetween IT

and business

76%

24%

62%

38%

62%

38%

52%

48%

43%

57%

Not a barrierEmerging barrier

However, Russian companies tend to invest more willingly in these initiatives. Typically, large IT players set up online universities and schools for developers and programmers. But some companies go further and provide educational institutions support and development. In both cases, business collaborates with students, talented young people and others who want to attain such skills.

With Industry 4.0 in full swing and digital transformation now inevitable, businesses need to tackle L&D challenges head on as never before. Employees need to learn how to harness technology, be whether building new platforms or operating industrial robots. It is also important for employees to be proficient in adjacent fields beyond their subject-matter area. Given the characteristics of the Russian educational system, tailoring the right talent is becoming key for companies that want to establish a long-lasting market success.

Other challenges: infrastructure and legacyApart from talent issues, boards note a number of other challenges. Specialists with the right skills could probably help mitigate their impact, but these barriers have only become apparent recently. For instance, 62% of the respondents noted that there was no integration of new and existing technologies and data. The same percentage mentioned inflexible processes, while half the respondents blame legacy frameworks for impeding digitalisation.

These challenges are primarily rooted in the need to overcome the hurdles of legacy systems. To be successful, companies need to develop a business strategy that factors in digital realities. Although investing in innovative technology may entail increased risks, unwillingness to change could cause companies to lose their market share. Companies also need to ensure a smooth transition between different IT systems and achieve steady improvements in governance.

62%of the respondentsnoted that there was no integration of new and existing technologies and data

18 PwC

62%noted the lack of integration between new and existing systems

People are the main riskApart from the global issues impeding digital transformation, companies also need to be aware of the threats that follow technology adoption, including cybercrime and regulatory vacuums. Companies may try to fight cyber threats by following regulations, managing risk, hiring subject-matter experts and protecting corporate servers and IP-telephony. However, such solutions are too general and do not provide nearly enough security. Below, we list the main methods for mitigating the risks arising from adopting the Essential Eight.

Social engineeringTechnology may be well advanced. However, the main threat to corporate networks is social engineering (or the art of hacking individuals). One of the most widely used techniques in social engineering is phishing or an attempt to acquire information from an employee that can be used to hack the entire network. Hackers can obtain access to employee corporate user accounts containing business-critical information. These attacks are highly effective, as employees often mistake emails or messages with malware attachments for regular corporate communications.

To counter phishing attacks and social engineering in general, companies should primarily educate their users. Verifying URL addresses and email attachments, using secure https connections and two-factor authentication—all these procedures should become rules of thumb. We also recommend installing solutions that prevent or mitigate the impact of phishing attacks, securing systems against loss of data, managing other applications and filtering web traffic. These measures would facilitate smoother technology implementations.

Network breachesTechnology implementations automatically turn companies into targets for all kinds of cybercriminals. For instance, hackers can create powerful botnets based on your IoT for subsequent attacks on other resources. In 2016, for example, hackers carried out a DDoS attack damaging services like GitHub, Twitter, Spotify and Netflix.14 It appears the attackers used tens of thousands of hacked connected devices like surveillance cameras and routers.

First, companies need to roll out solutions that analyse traffic and detect out-of-band connections to the network or instances of unusual device usage (in particular, to quickly detect abnormal traffic and excessive power consumption). It would be prudent not to connect all IoT devices to the corporate data highway. In any case, prior to any technology implementation, boards need to discuss options to increase their cybersecurity budgets to procure advanced network security systems and to recruit and train the right people.

Legal regulation One of the issues common across all emerging technologies is that they sometimes operate in legal and regulatory vacuums. Take drones, for instance. Since July 2017, all drones in Russia weighing from 250g to 30kg have been subject to mandatory registration. However, in January 2018, the State Duma Committee on Safety and Anti-Corruption announced it was working on a legal regulatory framework to control UAV turnover.15

Another Essential Eight technology—blockchain—is currently in a total legal vacuum, and Russian court practice is still in its infancy on this issue. However, lack of legal precision and persistent ambiguity with respect to blockchain in Russia is, undoubtedly, a temporary phenomenon and the situation will change in the near future. Consequently, when elaborating their corporate development strategies, boards should consult in-house legal professionals and third parties that can bring their expertise to avoid legal risks.

Mobile infrastructure needs to be safeguardedAccording to our survey, the BYOD (Bring Your Own Device) principle applies to almost all Russian companies. Only 19% of the respondents do not store board materials or corporate documents on their private devices. The BYOD principle has three core strengths: cost savings (the company does not need to procure mobile devices centrally), efficiency (always on the line) and convenience (working with the device you are used to).

On the other hand, we see that 81% of Russian boards store valuable proprietary information on their private smartphones. Moreover, 29% of the respondents prefer communicating with other board members via their personal email account. In simpler terms, if anyone would want to obtain business-critical data, it would be enough to hack one executive’s private device. This is an easier and more appealing avenue of attack than raising a siege against a well-fortified corporate network. To block such avenues, we advise the following actions:

• Encrypt all critical data on devices. Even if the device is stolen or lost, the data on it will be unreadable.

• Set up multi-factor authentication.

• Set up access to corporate data via a virtual mobile operating system hosted on the company’s server; this approach will ensure data protection in case the device is compromised.

Employees responsible for cybersecurity should focus on endpoint solutions with anti-malware

14 Fast Company https://www.fastcompany.com/3064904/after-years-of-warnings-internet-of-things-devices-to-blame-for-big-internet-attack15 Interfax https://school.hh.ru/#enrollment

19Russian boards survey 2018

81%store valuable proprietary information on their personal smartphones

functionality and web reputation service that monitor secure usage of selected applications. They should also pay attention to network solutions that can pre-emptively detect malware via network activities. In addition, companies should have a mobile device security policy in place for all employees.

Boards of directors should influence the adoption of key technologies Boards have (or should have) an important role when it comes to digital transformation. Technology is often a critical component of a company’s strategy. Boards will want to take time during their strategic discussions to talk about their companies’ digital initiatives.

Board members may wish to expand their involvement in corporate strategy development and technology impact assessments. To this end, PwC experts have elaborated a concept to help directors embrace and implement the Essential Eight.16

1. Prioritise your technologies and incorporate them into strategic oversightBoards need to discuss a number of key questions with their CEO and senior executives: what emerging technologies is the leadership focusing on? Do these technologies belong to the Essential Eight? Which technologies would be most applicable

to the company’s business given its strategy, goals and customer needs? Answering these questions will enable boards to focus their efforts only on priority technologies.

Boards also need to understand whether the company has a roadmap in place for adopting emerging technologies for the next several years, and, if so, how comprehensive it is. Technology is a means to enhance the competitiveness of your company. It is therefore critical to hold regular discussions about technology and take key decisions at the board and senior leadership level.

Boards need to review the plans that companies have to oversee and monitor the implementation of key technologies that could determine the company’s future and approve them with the executive team. By analysing current strategy, boards will be able to help keep things under control and take effective measures to mitigate related risks.

16 https://www.pwc.ru/ru/assets/pdf/technology-hub/essential-emerging-technologies-corporate-boards_rus.pdf

20 PwC

2. Continuously raise your digital IQBy digital IQ, we mean digital competency index. To raise it, boards need to get more hands-on and use more technology in their day-to-day activities, including augmented reality fitness and sporting activities, wearable fitness devices, digital household assistants and virtual reality tours of real estate offerings. By trying out the latest solutions, board members will gain invaluable personal experience and understand what their clients need when taking on emerging technologies.

The oversight of strategy execution—a core board function- is impossible without practical knowledge about emerging technologies. To increase this index, boards can and should use their company's internal resources to expand and deepen their knowledge of business-critical technologies.

Another effective approach is to solicit assistance from a third party. In any case, board members need to allocate time to

expand and deepen their knowledge in this field, whether as part of the board’s regular agenda or on an ad hoc basis. If technology adoptions are treated as secondary, they will hardly ever have a long-term positive impact.

3. Assign persons responsible for cyber risk controlAccording to the survey results, 57% of boards assign control functions for cyber risks to their audit committees. In the US, audit committees are responsible for cyber risk across 50% of the boards. Nevertheless, the data shows that our American colleagues take cybersecurity more seriously, with 30% of US respondents stating that all members of the board are involved. In Russia, the percentage is only 10%. In 14% of the cases, there is no oversight or control over cyber issues at the board level, while 23% believe cybersecurity issues need not be considered as part of risk management. Obviously, this situation has to change and boards have to decide who is responsible, whether it be a special committee or all board members.

14%of our respondents confirmed that their board exercises no oversight at all

About our respondentsThe Russian Boards Survey was carried out in the beginning of 2018. We surveyed companies across 14 industries including banking, automotive, agriculture, construction, food, information technologies, etc.

21Russian boards survey 2018

More chartsPlease indicate if you would like your board to devote more time in the upcoming year to consider the following matters

40%

48%

38%

45%

42%

42%

48%

Strategic planning

IT/Digital strategy

Executive successionplanning

Cybersecurity

Executive performanceand compensation

Crisis planning &management

Monitoring of accuratefinancial reporting

Monitoring the system of risk management and internal control

ESG/ sustainability

47%

Much more time and focusSome more time and focusNo changeLess time and focus

35%

33%

25%

24%

20%

20%

13%

18%

13%

9%

2%

2%

2%

4%

2%

27%

27%

36%

32%

38%

44%

32%

36%

55%

How would you describe your board’s current composition needs with regard to

7%

51%

51%

49%

49%

49%

44%

44%

44%

44%

30%

35%

30%

28%

28%

21%

40%

37%

40%

2%

16%

14%

21%

23%

23%

28%

14%

19%

16%

Financial expertise

Marketing expertise

Industry expertise

International expertise

Legal expertise

ESG/sustainabilityexpertise

Gender diversity

Risk managementexpertise

Human resourcesexpertise

Cybersecurity expertise

IT/digital expertise

30%

28%

40%

44%

2% 28%

28%

2%

Have it And don’t need more Have it But still need moreDon’t have it But need itDon’t have it And don’t need it

22 PwC

In your opinion, how effective are the following practices at promoting board refreshment?

Does your Board carry out regular evaluations of Board performance

3%

8%

8%

3%

45%

58%

45%

50%

47%

53%

32%

24%

24%

21%

21%

21%

8%

3%

21%

24%

21%

24%

24%

16%

Very effectiveSomewhat effectiveNot very effectiveNot at all effective

Individual director assessments

Director term limits

Seeking input from investorsabout board composition

Mandatory retirement age

Full board/committeeself-assessments

Strong focus on refreshmentfrom board chair or lead director

53%

38%

2018 2017

21%

13%

16%

11%

33%

Yes, in a form of self-evaluation

Yes, in a form of both self-evaluationand externally facilitated evaluation

Yes, in a form of externallyfacilitated evaluation

No

2016

49%

14%

3%

34%

16%

23Russian boards survey 2018

In your opinion, how many directors on your board should be replaced?

How would you evaluate the effectiveness of interaction between your Board and executive management with regard to the following

No Two One More than two

42% 24% 21% 13%

3%

31%

38%

25%

38%

53%

38%

38%

41%

31%

38%

38%

34%

34%

31%

31%

31%

28%

28%

16%

14%

21%

23%

23%

28%

14%

19%

16%

34% 25%28%

Rather effective Very effectiveRather ineffectiveIneffective at all

Developing key personnel

Adequate business planning and budgeting, andmonitoring implementation of plans and budgets

Ensuring constant adoption and development of technology

Ensuring sustainable growth

Overall

Defining an agile strategy and monitoringits effective implementation

Ensuring effective risk managementand internal control

Properly aAssessing businessperformance properly

Defining an optimal executive remuneration and motivation system

Planning the executive succession effectively

3%

3%

3%

3%

www.pwc.ru/russianboardsAt PwC, our purpose is to build trust in society and solve important problems. We’re a network of firms in 158 countries with more than 236,000 people who are committed to delivering quality in assurance, advisory and tax services. Find out more and tell us what matters to you by visiting us at www.pwc.com.

PwC refers to the PwC network and/or one or more of its member firms, each of which is a separate legal entity. Please see www.pwc.com/structure for further details.

© 2018 PwC. All rights reserved.

PwC contacts

Alexey Fegetsyn Partner, Corporate Governance Tel.: +7 (495) 223 6403 alexey.fegetsyn@ru.pwc.com

Elena Dubovitskaya Director, Corporate Governance and Sustainability, PwC Russia Tel.: +7 (495) 967 6441 elena.dubovitskaya@pwc.com

Natalia Parygina Marketing Tel.: +7 (495) 223 3950 natalia.parygina@pwc.com

Alexey Okishev Risk Assurance Leader Tel.: +7 (495) 967 5063 alexey.okishev@pwc.com

Anna Smischenko-Mironova Press Service Tel.: +7 (495) 967 6600, ext. 6172 anna.smischenko-mironova@pwc.com