Boards should be overseeing the outcomes and risks of governance, not its operational mechanics. That means holding management accountable for maintaining security, privacy, quality, and AI governance as ongoing organisational capabilities, rather than reviewing documentation or approving policies once a year. The sections below unpack the most common gaps, practical structures, and the right questions every board should be asking in 2026. If you would like to talk through how this applies to your organisation, feel free to get in touch with us.

What areas of governance are boards most often underprepared for?

Boards are most often underprepared for AI governance, supply chain security, and the operational reality of continuous governance. While most boards have some familiarity with financial risk and legal compliance, the technical and operational dimensions of security, privacy, and AI are areas where board-level understanding frequently lags behind the organisation’s actual risk exposure.

In 2026, the regulatory landscape has expanded significantly. Frameworks like NIS2, the EU AI Act, DORA, and ISO 42001 place explicit expectations on organisations to demonstrate active, ongoing governance, not just point-in-time compliance. Boards that are not familiar with what these frameworks actually require are poorly positioned to ask the right questions of management, let alone recognise when something is going wrong.

A few areas stand out consistently:

  • AI governance: Many boards have approved AI adoption without understanding the accountability structures, risk classifications, or documentation requirements that come with the EU AI Act. Knowing that AI is being used is not the same as overseeing it.
  • Supply chain and third-party risk: Boards often assume that procurement controls are sufficient. In practice, third-party dependencies are one of the most common sources of security and compliance failures, and they require active monitoring, not just contractual clauses.
  • Continuous governance: There is a widespread assumption that governance is something that gets done before a certification audit and maintained through documentation. In reality, governance must operate as a living system between audits, and boards are rarely briefed on whether that is actually happening.

The gap is rarely about intent. It is about the information boards receive and the structures management has in place to keep governance active and visible.

What is the difference between management handling governance and board oversight?

Management operates governance day to day, while the board oversees whether governance is functioning as it should. Management owns the processes, controls, roles, and documentation. The board’s role is to ensure that management has built a capable system, that accountability is clearly assigned, and that risks are being surfaced and addressed in a timely way.

This distinction matters because confusing the two leads to one of two failure modes. Either the board becomes operationally involved in governance details that should sit with management, which creates confusion about accountability, or the board steps back entirely and assumes that because governance is “handled,” it does not need to ask hard questions. Neither position is sustainable.

What management should own

Management should own the design and operation of the governance system itself. This includes maintaining security controls, ensuring privacy obligations are met, running internal audits, managing certification timelines, and keeping governance documentation current. Critically, management should also own the process of escalating material risks to the board before they become incidents.

What the board should own

The board should own the governance of governance. That means approving the overall risk appetite, holding management accountable for the quality and continuity of the governance system, ensuring that the right expertise is available to the organisation, and asking structured questions about whether governance is genuinely operational or merely documented. The board should also ensure that governance does not drift during periods of growth, restructuring, or leadership change, because those are precisely the moments when continuous governance is most at risk.

How should a board receive governance information?

A board should receive governance information through structured, regular reporting that distinguishes between status, risk, and action. One-off presentations before an audit, or dense policy documents circulated for approval, do not give a board what it needs to exercise meaningful oversight. Governance reporting should be concise, consistent, and tied to the organisation’s actual risk exposure.

Effective board-level governance reporting typically includes the following elements:

  1. A governance health summary: A brief, standardised overview of whether key governance domains (security, privacy, quality, AI) are operating within expected parameters. This should be comparable period to period so the board can identify trends, not just snapshots.
  2. Open risks and mitigations: A clear view of known risks that are above the organisation’s risk appetite, with the status of mitigation actions and responsible owners named explicitly.
  3. Certification and regulatory timeline: An update on where the organisation stands relative to upcoming audits, renewals, or regulatory deadlines. Boards should never be surprised by a certification lapse or a regulatory submission they were not aware of.
  4. Incidents and near-misses: A factual account of any security, privacy, or compliance incidents since the last reporting cycle, including what happened, how it was handled, and what was changed as a result.

The format matters as much as the content. Boards are not governance specialists, and reporting that requires deep technical knowledge to interpret is not useful. The goal is to give board members enough structured information to ask informed questions and recognise when something requires escalation or deeper scrutiny.

What questions should a board be asking about security and privacy?

A board should be asking questions that test whether security and privacy governance is genuinely operational, not just documented. The right questions focus on accountability, continuity, and the organisation’s ability to detect and respond to problems, rather than on whether policies exist or certifications are current.

Useful questions for security include:

  • Who is accountable for security governance, and do they have the authority and resources to act on it?
  • When was the last time our security controls were tested, and what did we learn?
  • How would we know if a significant security control had failed or drifted out of compliance?
  • What are our top three security risks right now, and what is the status of the mitigations?
  • Are our critical suppliers and third-party providers subject to the same security standards we apply internally?

Useful questions for privacy include:

  • Is our data processing register current, and does it reflect how we actually use data today?
  • Have there been any data subject requests or complaints in the past period, and how were they handled?
  • Are there any new data processing activities, AI tools, or third-party integrations that have not yet been assessed for GDPR compliance?
  • What would happen operationally if we received a data breach notification obligation tomorrow?

These questions are not intended to catch management out. They are designed to create a regular, structured dialogue that keeps governance visible at board level and signals to the organisation that continuous governance is taken seriously from the top.

When should a board escalate a governance concern?

A board should escalate a governance concern when management cannot demonstrate that a known risk is being actively managed, when a regulatory or certification obligation is at risk of being missed, or when there is evidence that governance has drifted without a clear recovery plan. Escalation at board level typically means engaging external expertise, commissioning an independent review, or in serious cases, making structural changes to how governance is resourced and owned.

Specific triggers that warrant board-level escalation include:

  • A security or privacy incident that reveals a systemic control failure rather than an isolated event
  • Repeated findings from internal or external audits that have not been resolved across multiple reporting cycles
  • A significant change in the organisation’s risk profile, such as a major acquisition, a new AI system deployment, or entry into a regulated market, without a corresponding update to the governance system
  • Management turnover in key governance roles without a credible continuity plan in place
  • Evidence that governance documentation is being maintained but the underlying controls are not operational

The distinction between a management issue and a board-level concern is not always sharp, but a useful test is this: if management has the information, the authority, and the resources to resolve the issue and has not done so, that is a board concern. Continuous governance means the board does not wait for an incident to discover that the system has been running on assumptions rather than evidence.

If your board is looking to build a clearer picture of your organisation’s governance posture, or if you want to understand how a structured, ongoing approach to governance could work in practice, contact us and we will walk you through what that looks like. You can also explore our services to see how we support organisations in making governance a permanent capability rather than a periodic exercise.

Frequently Asked Questions

How often should a board formally review governance reporting?

Governance reporting should be a standing agenda item at every board meeting, not an annual or ad hoc exercise. At a minimum, boards should receive a structured governance health summary quarterly, with immediate escalation protocols in place for material incidents or emerging risks between cycles. The frequency should increase during periods of significant organisational change, such as mergers, new technology deployments, or entry into regulated markets, when governance systems are most likely to drift.

What expertise should a board have in-house to oversee governance effectively?

Not every board member needs deep technical expertise, but at least one director should have sufficient familiarity with cybersecurity, data privacy, or technology risk to interrogate management reporting meaningfully. Where that expertise does not exist internally, boards should consider appointing an independent advisor or engaging an external governance specialist on a retainer basis. The goal is not to replicate management's technical knowledge at board level, but to ensure the board can ask informed questions and recognise when answers are incomplete or evasive.

How do we get started if our board has never formally overseen governance before?

The most practical starting point is a governance posture review, an independent assessment that maps what governance structures currently exist, where the gaps are, and what risks the board is currently blind to. From there, the priority is establishing a baseline reporting structure so the board begins receiving consistent, comparable information at each meeting. Starting with the four core domains — security, privacy, quality, and AI governance — gives the board a manageable scope without underestimating the organisation's actual risk exposure.

What is the biggest mistake boards make when trying to improve their governance oversight?

The most common mistake is treating governance improvement as a documentation exercise — commissioning a policy review, updating a risk register, or preparing for a certification audit — without changing the underlying reporting and accountability structures. Governance becomes meaningful at board level only when management is held accountable for the operational continuity of controls, not just the existence of paperwork. Boards that focus on outputs (certifications, policies, audit reports) rather than outcomes (are the controls actually working?) will continue to be caught off guard by incidents that were technically visible but never escalated.

How does the EU AI Act change what boards need to oversee?

The EU AI Act introduces risk-based obligations that sit at the organisational level, meaning boards cannot treat AI governance as a purely technical or product matter. For high-risk AI systems, organisations must maintain conformity assessments, human oversight mechanisms, and documented accountability structures — all of which require board-level awareness and sign-off on risk appetite. Boards should be asking management to produce a clear inventory of AI systems in use, their risk classifications under the Act, and the accountability structures in place for each, rather than assuming that AI adoption decisions made operationally are automatically compliant.

How should a board handle governance oversight during a period of rapid growth or restructuring?

Periods of growth, acquisition, or restructuring are precisely when governance systems are most vulnerable to drift, because attention and resources shift toward operational priorities and governance roles often go unfilled or unclear. Boards should treat any significant organisational change as a trigger for an explicit governance continuity check — confirming that accountability for security, privacy, quality, and AI governance is clearly assigned under the new structure before the transition is complete. A short-term increase in reporting frequency during these periods is a low-cost safeguard against the kind of systemic gaps that typically only become visible after an incident.

What is the difference between a governance audit and continuous governance, and why does it matter?

A governance audit is a point-in-time assessment of whether an organisation's controls and documentation meet a defined standard at the moment of review. Continuous governance, by contrast, means that controls are actively maintained, monitored, and improved between audits, and that material risks are surfaced and addressed as they emerge rather than discovered during the next certification cycle. The practical difference matters enormously: organisations that govern continuously tend to pass audits with fewer findings and, more importantly, experience fewer incidents, because the system is designed to catch problems early rather than confirm they existed after the fact.

Related Articles

Share

  • July 9, 2026