Директорам советов директоров: отчеты о комплаенсе часто создают ложное чувство безопасности

Boards are not short of compliance information. Most receive dashboards, heat maps, training figures, investigation data, audit findings, remediation updates, and regulatory summaries. The difficulty is deciding what all that information really says. A report can be accurate, well presented, and still leave directors with too much confidence. That happens when evidence of activity is treated as evidence that the underlying risk is under control. The problem is rarely a single misleading number. More often, it is the way information is selected, summarized, and presented. Measures that are easy to count move to the front of the report. Uncertainty, recurring failures, weak ownership, and unresolved judgment calls are harder to show, so they can receive less attention. That is how compliance reporting can create false assurance without anyone intending to mislead the board. Activity does not prove effectiveness Training completion is a useful measure. It shows who has completed a required course. It does not show whether employees understood it, whether they would recognize a problem in practice, or whether they feel able to raise concerns. The same distinction applies elsewhere. A policy can be issued without changing behavior. A control can be introduced without being tested. A remediation action can be closed even though the original weakness has not been fully addressed. None of those measures is wrong. The risk lies in asking them to answer a question they were not designed to answer. Compliance reports should therefore separate implementation from effectiveness. Was the action completed? Did it work? Has the risk reduced? Those are three different questions. This matters because some apparently positive indicators are open to more than one interpretation. A fall in hotline reports, for example, could mean fewer concerns. It could also reflect lower awareness of the reporting channel or less confidence in using it. The number needs context before it can support a conclusion. The story can disappear during reporting Information often passes through several stages before it reaches the board. Local issues may be combined into regional reporting. Compliance, legal, risk, internal audit, and governance teams may each review or contribute to the final paper. Some consolidation is unavoidable. Directors cannot work through every incident, control test, and overdue action. But each round of summarizing creates a chance for important context to be lost. Several similar control failures may appear as isolated events rather than a pattern. A long-running disagreement about ownership may be reduced to an overdue action. A concern raised by employees may reach the board without any indication that those employees feared retaliation. Even a stable risk rating can mislead. An issue that remains amber for four quarters may look unchanged, when in reality it has become normalized because the organization has lived with it for so long. Useful reporting preserves the details that directors need in order to exercise judgment. That may include how long an issue has remained open, whether it has happened before, what assumptions sit behind the rating, where management disagrees, and what could cause the position to worsen. Closing an action is not the same as resolving a risk Remediation reporting can be particularly reassuring. The number of overdue actions falls, completion rates improve, and the dashboard moves in the right direction. But an action is often closed when an agreed task has been completed. That is not always the same as confirming that the root cause has been addressed. A new control may exist on paper but not work consistently. A revised procedure may deal with one business unit while the same weakness remains elsewhere. The original action may have been too narrow because the problem was not fully understood when it was agreed. This is why closure should not be the final test. For significant issues, the report should explain how the response was validated, whether the control has operated long enough to assess, and whether similar problems have appeared in other parts of the business. It should also be clear who accepted any remaining exposure. Without that information, a board can see an improving action tracker while the organization continues to carry much the same risk. Shared responsibility can become unclear responsibility Many compliance issues cross functional boundaries. Compliance may identify the concern, the business may own the control, legal may interpret the obligation, risk may assess the exposure, and internal audit may later test the response. That division of responsibilities can work well. It can also make it difficult to see who is responsible for bringing the issue to a conclusion. Reports sometimes conceal this problem through general wording such as “management is addressing the issue” or “the organization is progressing remediation.” Those phrases describe activity without identifying accountability. Boards need to know who owns the decision, who is responsible for delivery, and who must escalate if progress stalls. Where ownership is disputed, dependent on several functions, or waiting for an executive decision, the report should say so plainly. The aim is not to force every issue onto one person. It is to make sure that shared responsibility does not become a reason for delay. What better reporting looks like Better reporting does not necessarily mean a longer board pack. In many cases, it means giving less space to routine activity and more space to exceptions, recurring problems, uncertainty, and decisions that remain unresolved. A few questions can help test whether the report is providing assurance or merely describing process: - What evidence shows that the control is working, rather than simply in place? - Which measures show activity, and which show an actual change in risk or behavior? - What has remained open, returned, or appeared elsewhere? - Which conclusions depend on management judgment or assumptions that have not yet been tested? - Have any actions been closed before the outcome was independently checked? - Is ownership clear where several functions are involved? - What important context was removed when the information was summarized? These questions will not eliminate uncertainty, nor should they. A good compliance report should make uncertainty visible enough for the board to challenge it. The purpose of reporting is not to make the position look settled. It is to help directors understand what is working, what is not yet known, and where further attention or a decision is required. A well-designed dashboard can support that conversation. It should never be allowed to replace it. Glenn Oborne is a director at Ingen Partners, a specialist governance recruitment and consultancy firm supporting listed, regulated, and growing organizations. He advises clients on governance leadership, succession, board effectiveness, and senior governance appointments.