The board pack that supports decisions — not the archive

A 140-page pack sent 18 hours before the meeting proves effort — and prevents oversight. Board members cannot challenge what they cannot absorb, and regulators increasingly read packs as evidence of whether the organ could have exercised its duties. The fix is structural, not cosmetic.

Five changes that carry the weight

• Lead with decisions, not updates. Page one lists what the board is asked to decide, note or challenge — each item labelled accordingly. Everything else is annex.
• One top-risk view. A single page: material risks, movement since last meeting, owner, next action. If the cyber risk has not moved in four quarters, that is the finding.
• Thresholds instead of narratives. Agree escalation thresholds (incidents, losses, findings, vendor failures) and report against them. “Below threshold” is a legitimate, auditable sentence.
• An issue & action log that survives. Decisions and commitments carry forward with owner and due date until closed — the cheapest audit-trail instrument that exists.
• A calendar with a purpose. Annual coverage of strategy, risk, compliance, technology and people — planned, so nothing depends on whether a topic “came up”.

What changes in practice

Packs shrink, preparation time drops, and the minutes start showing challenge — the thing supervisors and diligence teams actually look for. In our governance engagements this restructuring is usually the first two weeks of work, and the one clients keep.

The connected briefing for regulated groups: how the same pack structure feeds AI-, AML- and resilience-oversight duties without tripling the paper.