The board meeting is close, the report is due, and last quarter's version was mostly built by hand. Regulators and prosecutors now ask what the board saw and what it did about it. This guide covers what to include, which metrics to keep, and how to end with a clear ask.
At a glance: what a board compliance report should contain
A board compliance report should give directors a current view of the organization’s most important compliance risks, explain what has changed since the last report, and state clearly what the board is being asked to decide or oversee. It should be short, consistent from meeting to meeting, and built on a small set of metrics drawn from systems of record rather than assembled by hand. Everything else, including the detail behind each metric, belongs in an appendix or a dashboard the board can open on request.
Every board report has to answer three questions:
- Where do we stand today? Current risk status across the frameworks the organization is accountable for.
- What changed? New obligations, new findings, closed findings, control failures, regulatory developments since the last meeting.
- What do you need from us? The decisions, approvals or resourcing the board or committee must act on.
If a page of the report does not help answer one of those three questions, cut it.
What's Inside:
What boards and regulators expect
Board reporting is not a courtesy to directors. Three U.S. sources treat it as evidence that a compliance program is real, and each one asks about the same things: whether the board is informed, whether it follows up, and whether the compliance function can reach the board without going through management.
U.S. Sentencing Guidelines, §8B2.1
What it is. The guideline that defines an effective compliance and ethics program for federal sentencing purposes. Source: U.S. Sentencing Commission, Guidelines Manual, §8B2.1 (archived section text; the current edition is the 2025 Guidelines Manual, effective November 1, 2025).
What it expects of the board. The governing authority is required to be knowledgeable about the program and to exercise reasonable oversight of its implementation and effectiveness.
What it expects of compliance. The person with day-to-day operational responsibility is expected to report periodically to high-level personnel and, as appropriate, to the board or a board subgroup on the program’s effectiveness. This is the origin of the periodic board compliance report.
What to show. A documented cadence, and a report that speaks to effectiveness rather than activity.
DOJ Criminal Division, Evaluation of Corporate Compliance Programs
What it is. The question set federal prosecutors use when deciding how much credit to give a compliance program, updated September 2024. Source: U.S. Department of Justice, Criminal Division, Evaluation of Corporate Compliance Programs (PDF).
What it asks about board reporting.
- Oversight: what compliance expertise sits on the board, whether the board has held private sessions with compliance and control functions, and what information the board examined in the area where misconduct occurred.
- Internal audit: which audit findings and remediation progress have been reported to management and the board on a regular basis, and how they followed up.
- Autonomy: whether compliance has a direct reporting line to the board or audit committee, and how often they meet.
- Risk assessment (new in 2024): whether the periodic review is a point-in-time snapshot or draws on continuous access to operational data across functions.
What to show. Findings, remediation progress and board follow-up over time, in a form the minutes can reference.
FFIEC Information Technology Examination Handbook (financial institutions)
What it is. The set of booklets federal and state examiners use to evaluate technology, security and continuity risk management at banks, credit unions and their service providers. It applies only to regulated financial institutions; if that is not your sector, skip this one. Source: Board of Governors of the Federal Reserve System, SR 19-13, FFIEC Information Technology Examination Handbook (November 2019), which distributes the revised Business Continuity Management booklet to supervised institutions.
What it expects. SR 19-13 describes the BCM booklet as covering governance, resilience, plan development, testing, maintenance and reporting for the board of directors, and as the basis on which examiners judge whether management adequately manages availability risk. The other ten booklets follow the same pattern: board oversight is examined, and examiners look for evidence of it.
What to show. Board and committee minutes that record the report, the discussion and the follow-up, so an examiner can see oversight happened rather than take it on trust.
The common thread: regulators do not ask whether a report exists. They ask what the board saw, what it did about it, and whether the compliance function could get to the board on its own. Build the report so the minutes can answer all three.
How to build the report: nine steps
Work through these in order the first time. After that, steps 1, 2 and 9 are set once and reviewed annually; steps 3 through 8 repeat every reporting cycle.
- Set the audience and cadence. Decide who receives the report (full board, audit committee, risk or compliance committee) and how often. A workable default is a quarterly report to the committee and an annual program review to the full board, plus escalations as they arise. Write the cadence into the committee charter so it survives staff turnover, and agree what triggers an out-of-cycle report (a reportable breach, a regulator inquiry, a material control failure).
- Choose five to eight metrics and keep them. Pick metrics that answer the three board questions, that you can pull from a system of record every period, and that you can explain in one sentence each. Agree them with the committee chair before the first report. Change them rarely and announce the change when you do; a board cannot see a trend if the metric set shifts every quarter.
- Write a one-page summary. The first page states overall status, the two or three things that changed, and what you need from the board. Write it last, after the rest is done, and write it so a director who reads nothing else still has what they need. Use plain words. If a sentence needs a footnote, it belongs in the body, not the summary.
- Report regulatory change and obligation status. Show the obligations register at a summary level: how many obligations are in scope by framework, how many have an owner and a mapped control, and how many are new or amended since the last report. For each material regulatory change, give the effective date, the business impact in one line, and the implementation status. Boards want to know you are tracking the horizon, not just the present.
- Show findings aging, and call out repeat findings. List open findings from audits, assessments and regulator exams by severity and by how long they have been open against their agreed due date. Call out any finding that has been reopened or that recurs in the same area, because repeat findings are what regulators read as a program that is not learning. Pair every overdue item with an owner and a revised date.
- Show testing and evidence status. For each framework, report what portion of controls have been tested in the current cycle, how many failed, and whether evidence is complete for the period. This is the section that proves the program works in practice rather than on paper, and it is the one an external auditor or examiner will ask to see first.
- Add a forward look. One short section on what is coming in the next two quarters: regulations taking effect, scheduled audits and exams, planned control changes, known resourcing gaps. Keep it to what the board might be asked about or need to fund.
- End with the ask, in three groups. Separate every request into for information (no action needed), for discussion (you want the board’s view) and for decision (you need a vote, approval or resourcing). Directors should be able to see at a glance what they are being asked to do. Record the outcome of each decision item in the next report.
- Decide what lives in the dashboard and what lives in the report. The dashboard holds live detail: every finding, every control, every obligation, filterable by framework and owner. The report holds the narrative: status, change, trend and the ask, built from the same data. Directors read the report; they open the dashboard when they want to drill in. Never make the board read the dashboard, and never let the report drift from the numbers in it.
What to automate so the numbers stay current
Step 9 only works if the dashboard updates without someone rebuilding it. The metrics that benefit most from a live feed, and the system each one comes from:
- Findings aging and overdue counts, from the audit and issue management system, refreshed as owners update status
- Control test results and evidence completeness, from the controls platform, updated as tests are recorded
- Obligation and regulatory change status, from the obligations register or regulatory change feed
- Policy attestation and training completion for high-risk populations, from policy and learning systems
- Hotline, case and investigation metrics, from case management, including channel mix where it is captured
- Reportable incidents and notification timeliness, from incident management
What stays manual: the one-page summary, the interpretation beside each metric, the forward look and the ask. Those are judgement, and they are the part the board is paying for.
Metrics boards act on
Pick five to eight from this list. Set targets with the audit or compliance committee, not on your own; no threshold below is a benchmark, and none should be presented as one.
A useful test for each candidate metric: does it help the board answer where we are exposed, how we will mitigate, who owns the risk and what is at stake? It also helps to frame each metric three ways, as a warning sign, a decision lever and a sign of program maturity. The “how to frame it” column below uses that lens.
| Metric | Why the board cares | Source system | How to frame it |
| Obligations with an owner and a mapped control (by framework) | Shows the scope of what the organization is accountable for and whether anyone owns each piece | Obligations register or regulatory change tool | Count and percentage by framework, with the unowned remainder listed by name |
| Areas of regulatory risk and material regulatory changes, with implementation status | Regulators expect the board to know about material changes and to see that management responded; enforcement hotspots and fast-moving rulemaking (AI governance, privacy, supply chain disclosure) are where exposure concentrates | Regulatory change tracker, legal updates, horizon scan | Warning sign: expanded enforcement or heightened scrutiny in an area you operate. Show each change with effective date, impact in one line, status; new since last report flagged |
| Open findings by severity and age against due date | Overdue high-severity findings are the clearest sign of unmanaged risk | Audit and issue management system | Count by severity; show how many are past due and by how much; trend versus last period; bottlenecks by function and control type |
| Repeat findings | A finding that recurs means the fix did not hold; regulators treat this as a program failure | Audit and issue management system | List each one with the area, the original date and what is different this time. Maturity signal: name the policy or workflow changes that eliminated a repeat issue elsewhere |
| Controls tested this period and test failures (by framework) | Evidence that the program works in practice, not only on paper | Controls and testing platform, internal audit workpapers | Tested, passed, failed, not yet tested; failures named with remediation owner |
| Evidence completeness for the period | Missing evidence is an audit finding waiting to happen | Controls platform, document repository | Percentage of in-scope controls with complete evidence; list the gaps |
| Policy attestation and training completion for high-risk populations | Proves the policies reached the people whose conduct creates the risk | Policy management and learning systems | Completion for the defined high-risk group, not the whole company; name the exceptions |
| Incident and breach reporting timeliness | Late regulatory notification carries its own penalties, separate from the incident | Incident management, privacy and security tooling | Incidents in period, how many were reportable, how many met the statutory clock |
| Hotline intelligence | Substantiation rates, category trends and channel usage show where pressure is building; a sudden drop in reporting can be a silence worth probing | Hotline and case management system | Volume, substantiation, time to close, and the mix of formal versus informal channels (hotline, web portal, manager, HR); show the trend, not the raw count; flag spikes or silence in key categories |
| Investigation outcomes and recurrence | Investigations only create value when they change the system | Case management, issue tracking | Time to triage, time to closure, recurrence rate; root causes tied to control design, incentives, workload or access; each finding with an owner and a deadline |
| Third-party exposure across the lifecycle | Partners transfer their risk to the organization, and a vendor’s AI model becomes your liability | TPRM platform, contract repository | Inherent risk scoring, due diligence depth, contract coverage and monitoring status by cohort; flag high-risk groups (privileged-access vendors, AI service providers, distributors in growth regions) |
| Program friction blocking strategy | Shows whether compliance is slowing deals, launches or market entry, in terms directors use | Deal desk, legal intake, product and procurement workflow data | Count and cost of delayed initiatives (deferred revenue, missed partner windows), each paired with an enablement plan such as risk-tiered review paths |
| Open regulatory inquiries, exam findings and litigation | Direct exposure the board must know about; litigation is the lagging indicator of a culture or control failure | Legal and compliance matter tracking | Each matter with status, next milestone and exposure range where appropriate; sort by origin (incentives, supervision, access, privacy) and link each to the program element being fixed |
Two rules for every metric. First, show the trend over at least four periods, because a single number tells the board nothing about direction. Second, put the number and the interpretation together: the board should never have to guess whether a figure is good or bad.
A note on hotline numbers. Hotline volume on its own understates speak-up activity, because most concerns never reach the hotline. Ethisphere’s culture data, drawn from more than four million employee responses across more than 300 organizations, found that 59% of employees who reported misconduct did so through their manager, compared with 11% who used a hotline and 8% who used a web portal. The same data ties manager engagement to reporting: 67% of employees whose managers frequently discuss ethics and culture reported misconduct they observed, against 37% of those whose managers never do (surveys administered January 2022 to November 2024). Source: Malthe Helt, “Why Managers Matter: The Critical Link Between Culture, Ethics, and Trust in the Workplace,” Ethisphere Magazine, July 24, 2025. For the board, the ratio of formal to informal channels and the manager engagement rate are leading indicators; hotline volume is context, not the headline.
Board compliance report template
Copy this outline and keep the section order the same every period. A board learns to read a report by its shape; changing the shape resets that.
# Compliance Report to the [Audit / Risk / Compliance] Committee Period: [quarter and year] Prepared by: [name, title] Date issued: [date] Frameworks in scope: [GDPR, HIPAA, SOX, others] ## 1. Executive summary (one page) - Overall status: [stable / improving / deteriorating], with one sentence on why - Three things that changed since last report - What we need from the committee: [number] decisions, [number] discussion items ## 2. Risk status by framework For each framework: overall rating, top two risks, what moved and why. One table: framework, rating, trend (four periods), top risk, owner. ## 3. What changed - New or amended obligations: count, with material items named - Regulatory changes: change, effective date, impact, implementation status - New findings and closed findings: counts by severity - Incidents and reportable events: count, how many reported on time ## 4. Findings and remediation - Open findings by severity and age against due date (table) - Overdue items: finding, owner, original date, revised date, reason - Repeat findings: area, original date, what is different this time ## 5. Testing and evidence - Controls tested, passed, failed, not yet tested, by framework - Named control failures with remediation owner and date - Evidence completeness for the period, with gaps listed ## 6. Program health - Policy attestation and training completion for high-risk populations - Hotline and investigation metrics, trend over four periods - Resourcing: headcount, budget, open vacancies, external support ## 7. Forward look (next two quarters) - Regulations taking effect - Scheduled audits, exams and certifications - Planned control or system changes - Known gaps and resourcing needs ## 8. The ask - For information: [items] - For discussion: [items, each with the question you want answered] - For decision: [items, each with the recommendation and the alternative] ## 9. Follow-up from last report Each prior decision or action item, with its outcome. ## Appendix (or dashboard link) Full findings register, obligations register, control test detail, methodology and definitions.
Sections 1, 2, 3 and 8 are the ones directors read. Sections 4 through 7 are what the minutes, the auditor and the examiner will look for. Section 9 is what proves the loop closes.
Reporting GDPR, HIPAA and SOX in one view
The board does not want three reports. It wants one view of the organization’s regulatory exposure, with the frameworks as rows, not as separate documents. That only works if the underlying data is organized the same way across frameworks.
Build on a common control set. Map each framework’s obligations to a single set of controls, so one control can satisfy several obligations and be tested once. Access management, change management, vendor oversight, incident response and data retention appear in all three. Testing the shared control once and reporting it against every framework it supports keeps the metrics consistent and the workload sane.
Use the same status scale everywhere. Agree one rating scale for risk status, one for finding severity, and one for remediation status, and apply them to every framework. A GDPR finding rated “high” should mean the same as a SOX finding rated “high.” Define the scales in the appendix and keep them stable.
Show what is different about each framework, not everything about it. The one-view table should carry the few things a director needs to compare across frameworks. The framework-specific detail that follows is where each one gets its own emphasis:
| GDPR | HIPAA | SOX | |
| What the board is accountable for | Lawful processing and data subject rights across every jurisdiction where the company handles EU or UK personal data | Safeguarding protected health information and meeting the Privacy, Security and Breach Notification Rules | Reliability of financial reporting and the internal controls that support it |
| What to show every period | Records of processing, DPIAs on new high-risk processing, data subject request handling, cross-border transfer mechanisms, breach notifications against the regulatory clock | Risk analysis currency, workforce training, business associate agreements and oversight, access reviews, breach notifications against the regulatory clock | Control test results by cycle, deficiencies by severity, management remediation, auditor status, and anything that could affect the CEO and CFO certifications |
| Who else reads it | Supervisory authorities, data protection officer, external counsel | HHS Office for Civil Rights, business associates, cyber insurers | External auditor, SEC, audit committee as a statutory body |
| Typical failure mode in board reporting | Reporting activity (requests handled, policies published) instead of exposure (where personal data flows without a lawful basis or an adequate transfer mechanism) | Treating the annual risk analysis as done rather than as current; reporting training completion company-wide instead of for workforce with PHI access | Reporting on controls only at year end, so the board hears about deficiencies after the auditor does |
Order the view by exposure, not by framework. When the three frameworks share a page, lead with whichever one carries the most open high-severity findings or the nearest regulatory deadline this period. The order can change; the structure should not.
Add rows, not reports, as frameworks grow. When the organization picks up a new obligation set (a state privacy law, PCI DSS, an AI governance requirement), it gets a row in the same table with the same scales. That is the practical meaning of unified risk reporting: the board sees one picture and the compliance team maintains one dataset.
Four mistakes to avoid
- Reporting activity instead of risk. Training delivered, policies published, hotline calls received. These say the program is busy, not that the organization is safer. Every activity number needs a risk it reduces and a line that says whether it did. Hotline volume is the usual offender: it counts one channel, and most concerns go to managers or HR instead (see the note under the metrics table).
- Too much detail, no interpretation. A 40-page pack with every finding and every control, and no sentence that says what it means. Directors cannot find the exposure, so they ask about whatever is on the page in front of them. Put the detail in the appendix and the judgement on page one.
- No trend. A single period’s numbers with nothing to compare them to. The board cannot tell whether findings are aging because the program is overwhelmed or because three big ones closed last month. Four periods minimum, every metric.
- No ask, or an ask the board cannot act on. A report that ends with “for information” has wasted the board’s time, and one that asks for “support” has not asked for anything. State the decision, the recommendation, the alternative and the cost, and record the outcome next time.
"Mitratech listened. They provided recommendations to facilitate our goals and engaged in several cross-functional meetings to ensure they understood our environment and priorities. The responsiveness and reliability have been the difference-maker in this vendor relationship. We feel that they understand our business is 24/7... and they take issue-resolution seriously."
FAQs
How often should compliance report to the board?
How long should a board compliance report be?
Which metrics should a board compliance report include?
Should we use a dashboard or a report?
How do we show program effectiveness to auditors and examiners?
Primary sources cited in this guide:
- U.S. Department of Justice, Criminal Division, Evaluation of Corporate Compliance Programs, updated September 2024 (PDF)
- U.S. Sentencing Commission, Guidelines Manual, §8B2.1 Effective Compliance and Ethics Program (archived section text)
- U.S. Sentencing Commission, 2025 Guidelines Manual Annotated, effective November 1, 2025
- Board of Governors of the Federal Reserve System, SR 19-13, FFIEC Information Technology Examination Handbook, November 2019
- Malthe Helt, “Why Managers Matter: The Critical Link Between Culture, Ethics, and Trust in the Workplace,” Ethisphere Magazine, July 24, 2025
Every statistic in this guide is cited to the publication above where it originally appeared. Any benchmark figures added later (hotline volume, substantiation rates, abandonment rates or similar) should carry a named source, year and publication, traced to the original report rather than to a vendor page.
Related Mitratech resources to link from the published page:
- The Business Case for Ethics and Compliance: It Isn’t Just the Fine You Avoided (Jan Stappers, Mitratech, October 15, 2026): the argument for channel mix and manager engagement over hotline volume as board metrics
- 7 Compliance Metrics Every Board Needs to See in 2026 (Mitratech, LinkedIn): the four board questions and the warning sign, decision lever and program maturity lens used in the metrics table
- 7 Ethics & Compliance Metrics for Board Reporting (gated asset; link the mitratech.com version if one exists)
- Board Rapport is Greater Than Board Reporting (Ethicast episode)
- Top 6 Compliance Management Software Solutions in 2026 (Melissa Paré, Mitratech, October 19, 2026): compares platforms on board-level reporting among other criteria
- Mitratech Board Reporter brochure
Compliance Disclaimer
Note: No fabricated statistics, invented analyst rankings, or unattributed claims are included in this article. Product features, metrics, and pricing plans referenced are based on publicly available data as of October 2026.
Product descriptions are based on publicly available vendor documentation and industry reports. Features and capabilities may change over time. This article does not constitute an endorsement of any vendor or product. Organizations should conduct their own due diligence, including product demonstrations and reference checks, before making purchasing decisions. The cited regulatory guidance is provided for informational context only and does not constitute legal or compliance advice.
Turn the report into a standing conversation
Everything in this guide can be done in spreadsheets and slides. What it costs is the compliance team’s time every quarter, pulled from the systems where the findings, controls, obligations and hotline cases actually live, and reassembled by hand into something a board can read. The alternative is to connect those sources once and let the board view update from them, so the report reflects the same data the team manages day to day and the board sees one picture of risk across every framework.
Mitratech Board Reporter is built for that: it brings policy, training, hotline, case and investigation data into one board-ready view on the Mitratech GRC Platform, with maturity scorecards generated on your cadence. See it in action, read the Board Reporter overview, or compare how leading platforms handle board-level reporting in our top compliance management software roundup for 2026.
