How to Brief Your Board on Policy and Compliance Program Health
A short, regular briefing that tells directors whether the policy program is working, where the risk sits, and what you need them to decide.
In short
A good board briefing on the policy program fits on one page and answers three things: can the board rely on the program, where is the risk, and what does it need to decide. Report the same five to seven measures every time, show the trend, explain anything off track with an owner and a date, and keep the evidence behind every number ready to produce.
Two of the measures below depend on groundwork. For keeping reviews on schedule, see how to build a policy review calendar that actually gets followed. For the management group that should see these numbers before the board does, see how to charter a compliance committee that actually drives action.
What the board actually needs from you
Directors oversee the policy program; they do not run it. A list of everything compliance did this quarter is activity, not oversight.
Assurance
Are the policies current, approved by the right people, and actually read by the staff they apply to?
Risk
Where the gaps are, how serious they are, and whether they are getting better or worse. Name locations and policies rather than hiding them in an average.
Decisions
What you need from them: approval of a policy only the board can adopt, a view on risk appetite, or resources.
Six measures worth reporting
Pick a small set and keep it stable so the board can see movement from one meeting to the next. Define each one in writing and do not change definitions quietly. There is no universal “good” figure for any of these; the useful comparison is against your own last meeting and your own targets.
Policies past their review date
The count, and which ones. List high-risk ones by name.
Acknowledgment completion by location
The share of assigned staff who have acknowledged each key policy, broken out by site. A single company-wide figure can hide one location that is far behind.
Past-due acknowledgments
How many people are past their deadline, and for how long. This separates “recently assigned” from “ignored”.
Approvals pending
Drafts waiting on an approver, and how long they have waited. Long waits often point to an unclear approval chain.
Open exceptions
Approved departures from policy that are still in force, with any past their end date called out.
Changes since last meeting
New, revised and retired policies, with one line each on why.
A seventh, if you have it: material incidents or findings that touched a policy, and whether the policy, the training or the follow-through was the gap. Keep it to items that genuinely rise to board level.
How to present bad news
A briefing that is green every quarter stops being believed. Present each problem the same way, so the board learns to trust the format.
1. Say it first
Lead with the problem
Put it in the summary at the top, not on page three.
2. Size it
Scope and trend
Which policies, which locations, how many people, and whether it is worse or better than last time.
3. Own it
Cause, owner, date
What went wrong, who is fixing it, and when the board will see it closed.
4. Ask
What you need
If the fix needs budget, a decision or pressure on a business unit, say so. Otherwise say it is in hand and will be reported next time.
Do not soften the numbers. If a location’s acknowledgment completion is low, show the figure. Averaging or redefining a measure to make it look better costs you the board’s trust in every other number.
An example one-page outline
Use the same order every meeting so directors know where to look.
- 1
Headline (three lines)
Overall view of program health, the single biggest risk, and whether you are asking for a decision today.
- 2
Measures table
Your five to seven measures with this period, last period, target and a one-word trend. Mark anything off target.
- 3
Off-track items
One short paragraph each: what, how big, cause, owner, date. No more than three; if there are more, that itself is the headline.
- 4
Changes since last meeting
New, revised and retired policies, each with a one-line reason.
- 5
Looking ahead
Upcoming legal or regulatory changes, scheduled reviews of major policies, and planned rollouts to new locations.
- 6
Decisions requested
Each request written as a question the board can answer yes or no to, with your recommendation. Put supporting detail in an appendix.
What to ask the board to decide
Good requests are specific and sit within the board’s role. Typical ones: adopting or reaffirming policies the board itself owns, such as a code of conduct; agreeing the risk tolerance for a known gap while it is being fixed; approving resources when a gap cannot be closed without them; and confirming which measures the board wants to keep seeing.
Cadence
Match the briefing to the board or audit committee calendar, commonly quarterly, with a fuller annual review of the program as a whole. Between meetings, agree a simple rule for what gets escalated immediately, such as a significant incident or a regulator’s inquiry, so nothing material waits for the next scheduled slot. Ideally the numbers go to your compliance committee first.
Keep the evidence behind every number
Any director, auditor or regulator may ask “how do you know?”. For each measure, keep the report it came from, the date it was run, the filters used, and the definition. Save a copy each quarter so later figures can be compared against what was actually reported, not a fresh rerun.
This is where policy management software saves the most time, because the figures come from the records themselves rather than from a spreadsheet someone rebuilt the night before. In PolicyTrak:
Reports and analytics
Filter by location, policy category and date range, with report templates for past-due acknowledgments and policy changes over a period. Reports can run daily, weekly or monthly and export to Excel, CSV or PDF.
Document acknowledgment
Each acknowledgment is recorded per person with date and time, and the dashboard shows completion by policy, location or time period, with trends over time.
Policy management
Every save creates a numbered version with author and timestamp, and the audit log records each change, including status changes during approval.
NotePolicyTrak manages policies and acknowledgments. It does not keep a register of policy exceptions; if you report open exceptions, that figure will come from wherever your register is kept.
Build Your Board Pack From the Records
Acknowledgment completion by location, version history and exportable reports in one place. Sign up and see plans without booking a call.
