Board and committee compliance reporting: what a report to directors must contain

What the report is for

A board compliance report exists so that directors can demonstrate they informed themselves about the entity's compliance position and acted on what they were told. It is the primary evidence that oversight occurred.

That framing determines the content. The report is not a status update for the compliance function's benefit, and it is not an assurance that everything is fine. It is a record that specific matters were placed before the board on a specific date, in enough detail for a reasonable director to act.

Directors' duties supply the standard. The duty to exercise care and diligence under section 180 of the Corporations Act 2001, and the associated business judgment rule, are examined in directors' duties and the business judgment rule. The ASX Corporate Governance Council Principles set expectations for listed entities on risk oversight and reporting; for charities, ACNC Governance Standard 5 places duties on Responsible People that the board pack is used to evidence.

The nine standing components

A board compliance report that meets the test carries nine components. The order matters less than the completeness.

Component 9 is the one most often omitted and the one that most protects the compliance function. A board that has been told resourcing is inadequate has made a decision; a board that was never told has not.

A reporting calendar matched to the obligations

Not every component belongs in every pack. Set a calendar so that the depth rotates while the standing items appear each time.

Aligning the calendar to the compliance calendar and the national dates at /deadlines prevents the common failure where a lodgement deadline falls between board meetings and is never reported either side of it.

Writing for directors, not for the compliance team

Directors read many packs and have limited time. Four rules improve the record materially:

1. Lead with the exception. Directors need to know what is wrong first. A report structured as achievements followed by issues invites the issues to be skimmed.
2. Quantify consequence, not activity. "Fourteen controls tested" tells a director nothing. "Two of fourteen tests failed, both on the same manual reconciliation, exposure is a late lodgement penalty and a licence condition" tells them what to decide.
3. Name the decision required. Every item should be marked as for noting, for discussion, or for decision. Items marked for decision should state the options.
4. Avoid regime jargon without a translation. Section numbers and standard references belong in the detail, not in the summary line. Where a technical maximum penalty matters, cite it and stamp the date checked; the penalty estimator provides maximum ranges from the corpus.

Length discipline helps. Two pages of summary with appendices beats fifteen pages of undifferentiated narrative, because the summary is what ends up reflected in the minute.

Escalation: what goes to the board immediately

Some matters cannot wait for the next scheduled report. Define the thresholds in the compliance policy so that escalation is a rule rather than a judgement call made under pressure.

Immediate escalation should be triggered by:

• Any event that starts a statutory notification clock — data breach assessment, work health and safety notifiable incident, cyber incident reporting under the critical infrastructure regime, reportable situations under the financial services regime.
• Any regulator contact that is not routine correspondence: a compulsory information notice, an inspection, an enforcement inquiry.
• Discovery that an obligation has been unmet over an extended period, regardless of individual materiality.
• A control failure affecting customer money, personal information, or safety.
• Loss of a licence condition, accreditation or certification, or a notice threatening one.
• Any matter the compliance function believes should go to the board — an unqualified right that should be written down.

Escalation should be recorded even where the board takes no action. The record that the board was informed on a given date is the artefact that matters; see incident and breach registers for how the underlying event record links to it.

Minutes, packs and the evidentiary value of the record

The pack and the minute do different jobs. The pack shows what the board was given; the minute shows what the board did with it.

A minute that supports the oversight record includes:

• The document tabled, by title and version.
• The substance of the discussion, particularly any questions asked and answers given. Questions asked are the strongest available evidence of engagement.
• Any decision, with the resolution wording and the date it takes effect.
• Actions arising, with owners and due dates.
• Where the board accepted a risk or deferred remediation, the reasons.

"The compliance report was noted" is a weak minute. It establishes that a document existed and nothing more.

Retention matters as much as content. Board packs and minutes should be retained for at least the period applying to the records they discuss — seven years is a common working baseline for corporate records, with longer periods for specific regimes. Version-controlled packs allow the board to establish what it knew and when, which is precisely the question asked when something goes wrong.

Weaknesses that recur in SMB board reporting

• Reporting activity instead of position. Counts of tasks completed, with no statement of whether obligations are being met.
• No regulatory change section, so the board only ever sees obligations after they have commenced.
• Verbal escalation. A material matter raised in conversation and never written down, leaving no record either that it was raised or that the board considered it.
• Assurance reports summarised rather than tabled, so directors never see the findings in the assessor's own words.
• No ageing on open issues. A list of twelve open issues means nothing without knowing that four have been open for over a year.
• Resourcing never reported, so a program known internally to be under-resourced is never a board decision.
• Same report every meeting. If the pack does not change, directors stop reading it, and the evidentiary value of tabling it falls away.