Corporate governance and CPEC

The China Pakistan Economic Corridor (CPEC) brings to Pakistan an unprecedented opportunity for not only a turnaround of the economy but also for a great take-off. However, this opportunity does not turn into reality without our determination to overcome a massive challenge. This challenge is competition with the Chinese and other international companies that will come to Pakistan to reap the benefits from CPEC.
The CPEC is much more than a simple network of roads and railroads. Even if it is taken to be just a network of roads and railroads, there will be a huge upstream and downstream set of services and industries that will be required to construct, run, maintain and enhance this network. While Pakistani companies may be dreaming of setting up these industries and offering these services, they are far from capability of doing it. This capability is despite the financial strength that Pakistani investors may have - it is because of the lack of corporate governance and quality practices and culture in Pakistan and other countries in the region. The laws and codes required for implementing and assuring corporate governance are non-existent in Pakistan. However, Pakistan is not alone in this regard. The companies laws and corporate governance codes of most countries around the world are weak and concentrate only on legal and financial aspects. The country most advanced in this regard is South Africa. The corporate governance code defined by the South Africa Institute of Directors is commonly known as King IV and has been updated in November 2016.
The other pressing need of the hour is strong information security to protect the government and the corporates from information and cyber warfare. Pakistan does not have an information security framework or even an information security policy.
In the absence of these three vital statutes - a modern company law, a comprehensive code of corporate governance and an information security policy/framework - Pakistani companies cannot compete the foreign companies to win the projects related to the CPEC. In fact, this has already started to happen and there are numerous examples of awarding the vital projects to foreign companies.
Pakistan, therefore, needs a modern companies law, a comprehensive code of corporate governance and an information security policy/framework to enable its corporates to stand up and face the CPEC challenge. The government, in its present state of confusion, can hardly be expected to come up with any of these statutes. Secondly, even if the government starts working on these statutes, the bureaucracy will take years to frame them and get them approved as laws. Then the setting up of the infrastructure towards implementing these statutes will take a long time. Pakistani companies do not have this luxury of time. They will be wiped out in months. This vanishing of Pakistani companies has started.
What is the solution?
The solution is simple. Professionals and trade associations should stand up and make it mandatory for their members to adopt and conform to the international standards and best practices. This is highly achievable. The recent example of mango exporters adopting the international standards could be followed. Similarly, the example of the exporters of surgical instruments of Sialkot is the one, which is worth learning.
What are the minimum set of standards and best practices that Pakistani companies should adopt and implement to be able to compete with international competition?
The first standard is BS 13500:2013 - the code of practice for delivering effective governance of organisations. This is a very simple and effective code that is the only standard for corporate governance and is becoming popular worldwide. This scribe has been involved in the audit and implementation of this code and has witnessed considerable gains in companies that have adopted and implemented it.
The second statute worth adopting is the OECD Principles of Corporate Governance. These six principles were revised as recently as 2015 and help form the basis of the corporate governance framework of any enterprise. It should also provide the basis for the corporate governance code that the government may choose to devise.
The third statute is King IV, the corporate governance code from South Africa. This is a very advanced code and ensures ethical and moral standards that most governments and corporates will not like to come near to. However, companies, specially conglomerates, that adopt it, are bound to experience big benefits.
The above three statutes relate to corporate governance and are listed in increasing level of sophistication. However, even if only the least sophisticated and the minimum statute - BS 13500 - is selected for adoption, it needs some degree of automation to ensure monitoring and control. This scribe has helped automate the corporate governance infrastructures and processes in many companies of various sizes and in some large conglomerates and has witnessed the sighs of relief from respective members of the governing bodies.
Whereas the adoption of and compliance to statutes related to corporate governance is vital, it is not enough in this information age. The most valuable asset of an enterprise is not its tangible assets, nor its human assets - it is its information assets that can be in any form, even human. Weak information security may harm an enterprise more than any other threat may. All countries are formulating and implementing information/cyber security frameworks. These frameworks contain guidelines not only for the government institutions but also for different sectors of the industry, trade and services. With the present state of affairs in Pakistan, and despite the creation of a new Ministry of National Security, this seems to be a distant happening in Pakistan. The private sector, therefore, must act on its own.
The ISO 27001:2013 standard and its supporting standards provide an excellent starting point for the implementation of information security. However, a flag of caution needs to be raised here. Many certification bureaus have mushroomed in Pakistan as in other countries, that provide ISO 27001 certification in less than a week at a paltry amount. The objective for any company that is serious in safeguarding its information assets should not be the acquisition of ISO 27001 compliance certification, but the genuine protection of its vital information.
This scribe has been involved in the audit and implementation of the statutes mentioned above in many countries and has seen tremendous benefits being derived therefrom. Pakistani companies have no choice but to follow the suit. It is not only a matter of their survival, it is vital for the prevention of a recurrence of the East India Company phenomenon.
(The writer is an international consultant practicing in the GCC and Africa in the domains of corporate governance, IT governance, risk management, business continuity and digital enterprise transformation. His recent book titled 'Technology Governance - Principles & Practices' is available on Amazon. He can be contacted at [email protected])