Board Pack
How to read the pack
A director's route through the board pack, what to look at first, and the questions each section is designed to let you ask management.
In order, for a first read
- Executive View. The overall position and each domain. If the overall rating says insufficient evidence, stop and read the Evidence Ledger before anything else.
- Evidence Ledger. What the assessment could see. This calibrates everything after it.
- Material Risks. The small number of things leadership should look at first.
- 90-Day Board Action Matrix. What management should do, and by when.
Everything else is reference for the people doing the work.
Questions the pack is built to let you ask
| If you see | Ask |
|---|---|
| A band worse than the score suggests | Was the critical ceiling applied, and to which controls? |
| Insufficient evidence | Which domains were not scored, and what access would change that? |
| A domain marked not assessed | Is that because we have nothing of that kind, or because it could not be reached? |
| An estate-wide materiality band | Which rule produced that band, and how many resources and regions? |
| A large exposure range | What is the basis, and what does it explicitly exclude? |
Every one of those is answerable from the pack itself. That is deliberate.
What to be sceptical of
Movement between assessments where the methodology changed. The pack tells you when scores are not comparable and withholds the comparison rather than presenting it.
A flattering domain score over a small population. The population is printed. Check it.
Any number as a business impact. None of them are. See What the scores do not mean.
What the pack will not tell you
Which findings matter most to your business. It reports reach, not consequence, because consequence depends on facts about your organisation the assessment never sees.