Operational visibility is now a board-level requirement

The paper arrives on Thursday

A board pack lands on Thursday for a meeting on Monday. Inside it is a quality section: nonconformities raised, actions closed, an audit summary, a trend line. Every figure is accurate. Every figure describes a month that finished three weeks ago.

The board reads it, notes it, and moves to the next item. Nothing in that sequence is negligent. It is simply too late to be governance.

A board cannot govern what it can only review. Review is what you do to something that has already happened.

Two things moved in opposite directions

Operations got faster. Supply chains shortened, delivery cycles compressed, and the interval between a decision and its consequence collapsed.

Director accountability got sharper. Regulators, insurers, clients and courts increasingly expect boards to have known — and to have been able to know — about operational exposure inside their own organisations.

Reporting stayed monthly.

Most boards inherited the accountability without inheriting the intelligence layer required to discharge it. That is not a reporting-frequency problem. It is an architecture problem, and increasing the frequency of the wrong report produces the same blindness more often.

From record to instrument

A record tells you what happened. An instrument helps you decide what to do next.

The test is simple and slightly brutal. Take any page of operational reporting and ask whether a director, holding it, can identify a decision that is theirs to take. If not, it is a record. It may be a good record. It is not governance.

Why most assurance reporting fails that test

• It reports activity, not exposure. Actions closed measures administrative throughput. It says nothing about whether the organisation is more or less likely to fail next quarter.
• It aggregates until nothing is visible. A group-level average conceals the one site where the pattern is real. The averaging is what makes the report readable, and it is also what makes it useless.
• It reports what is easy to count. Findings are countable. Erosion of a control between audits is not, so it goes unreported — and it is the thing that matters.
• It arrives on the reporting cycle rather than when something changes. Risk does not schedule itself around board dates.

The question to ask instead

Replace how many findings were raised? with:

Which of our operational risks would we find out about late — and how late?

That question cannot be answered by a dashboard, which is exactly why it is worth asking. It forces a conversation about detection, not about performance.

One thing to do this quarter

Take the last board pack. For each operational figure, write down two dates: the date of the most recent event it describes, and the date the board saw it.

The gap between those two columns is your governance lag. It is a number no existing report contains, it takes an afternoon to establish, and it tells you precisely how far behind reality your board is currently governing.

Most boards find it is longer than they assumed. That is uncomfortable, and it is also the most actionable thing they will learn that quarter.