When Every Board Report Is Green: What Directors Should Question
- Katia Ciesielska
· 6 min read
The board pack arrives. Compliance is green. Risk is green. Operations is green. The action tracker is largely complete. It would be easy to move through the reports and spend the meeting on the next transaction.
I would pause over a different question: what would have had to happen for any of those indicators to turn amber?
A green board report may accurately describe a well-run business. But a colour tells directors very little until they understand the judgement behind it. Good board reporting helps directors see where attention is needed, including where the evidence is incomplete. A dashboard that makes everything look settled can make that harder.
What does green actually mean?
Take three possible definitions: no limit has been breached; no material incident has been reported; management believes the position is acceptable. Each could produce a green indicator. They are different statements, supported by different evidence.
I would want the meaning of each important indicator written down in plain language. Who sets the threshold? What period does it cover? Is the rating based on completed checks, or on the absence of reported problems? Where judgement is involved, who exercises it?
Imagine a compliance dashboard showing that 98% of reviews are complete. That figure sounds reassuring. It becomes less useful if the outstanding 2% includes the most complex relationships, or if the completed reviews are the easiest ones. The board needs to understand what remains outstanding and why.
I would also ask whether the definition has changed since the last meeting. A revised threshold may be sensible, but directors should be able to distinguish an improvement in performance from a change in the way performance is measured.
Look at the direction, as well as the position
A metric can remain within its limit while deteriorating for several reporting periods. The colour stays green; the room for error becomes smaller.
For important measures, I would ask to see the recent trend, the distance from the threshold and management’s explanation of the movement. This need not mean another ten pages. One clear chart and a short explanation may be enough.
Timing matters too. The board should know the date of the underlying information, especially where different reports use different cut-offs. A quarterly risk report, a monthly operations report and a current transaction paper may each be accurate while describing different versions of the business.
A useful opening question is simply: what has changed since this pack was prepared? That gives management space to raise a developing concern before directors start discussing information that has already been overtaken.
Revised deadlines can conceal an ageing problem
An action marked “on track” may have missed its original deadline twice. If the tracker shows only the latest agreed date, the history disappears.
I would keep the original deadline visible alongside the revised date, the reason for the extension and the person who approved it. An extension can be justified. Directors still need to understand the exposure that continues while the work remains unfinished.
Consider an access-control weakness awaiting a system change. The project may be progressing exactly as planned under its new timetable. That says nothing about whether the interim checks are working, whether they cover the full population or whether the people performing them have enough time.
At the next meeting, I would ask about the oldest significant open actions, rather than only the percentage completed. A large number of minor closures can make a tracker look healthier without resolving the issue that matters most.
Ask what qualified as complete
“Closed” is another word that deserves a definition. A policy may have been approved, a training session delivered or a system installed. Each is a milestone. The board should understand what evidence shows that the underlying weakness has been addressed.
I would choose one significant closed finding and ask to see the reasoning. What changed? Was the revised control tested? Over what period? Who reviewed the result, and did they identify any remaining limitations?
This should be proportionate. Directors do not need to reopen every action or reproduce the work of internal audit. A small, well-chosen sample can help the board judge whether management and the control functions use a consistent standard for closure.
If the answer is that testing will follow later, I would record that distinction. Implementation may be complete while assurance about effectiveness is still pending.
Read the reports together
The more revealing question may sit between two reports. Operations describes stable service. Human resources reports persistent vacancies. Compliance reports that monitoring is complete, while internal audit notes weaknesses in the quality of supporting evidence.
Those statements are not necessarily contradictory. They do need to be discussed together. Are people maintaining service through sustained overtime? Has work been deferred elsewhere? Does “complete” mean that checks took place, or that the results were satisfactory?
I would ask management and the relevant control-function leaders to explain the connection in the same discussion. Directors should be able to hear where their assessments differ and what would resolve that difference.
This is also a useful role for a risk committee: making sure related concerns reach the board as a coherent account, with the unresolved questions visible.
Make it possible to bring an amber report
A board that asks for candour should examine its own reaction when it receives it. If every amber indicator leads immediately to blame, management may become more cautious about raising concerns before the evidence is conclusive.
I would separate the discussion of an emerging problem from the later assessment of how it was handled. First establish what is known, what remains uncertain, who is taking responsibility and when the board will hear more. That creates room for early escalation while preserving accountability.
The chair can help by asking presenters what concerns them most, even if it has not crossed a reporting threshold. Directors can help by allowing the answer to change the discussion rather than treating it as an interruption to the agenda.
An amber report with a credible explanation and a workable response can give a board more confidence than an unexplained green one.
A practical request for the next board pack
I would start with a modest change: ask each report owner to identify the most important uncertainty, any significant change in the assessment and the decision or support needed from the board. Where nothing requires attention, explain briefly what supports that view.
Keep original deadlines visible. Distinguish work completed from effectiveness verified. Bring material disagreements into the discussion. These are useful points to revisit through a board evaluation, including whether the pack helps directors make decisions in the time available.
The minutes should capture the substantive challenge and the follow-up agreed. At the next meeting, return to it. A question loses much of its value if nobody checks what happened after it was asked.
I would not ask a well-run business to manufacture red flags. I would ask for enough evidence to trust the green ones.
Frequently asked questions
Is a green board dashboard a warning sign?
Not by itself. Directors should understand the thresholds, the age of the information and the evidence behind the ratings before relying on them.
How can directors challenge reporting without micromanaging?
Focus on the significant judgements, exceptions and decisions. Ask management to explain and substantiate its assessment, while leaving operational execution with the people responsible for it.
What is the simplest improvement to an action tracker?
I would preserve the original deadline and make the basis for closure explicit. That makes both delays and progress easier for directors to assess.
Katia Ciesielska is an independent non-executive director based in Luxembourg. The scenarios in this article are illustrative and do not describe any particular organisation.