Compliance board report: findings, exposure, and action

A compliance board report compares open findings, repeat failures, and overdue remediation by risk area, then explains the decisions those exceptions require. Its figures should reconcile to the issue register at a stated cutoff. Directors need to see what changed, what remains exposed, and who owns the response.

Use the board report template for the surrounding pack and its financial summary. This paper expands the compliance oversight section with evidence and actions; it does not need to reproduce the rest of the pack.

Set the scope before counting

Name the entities, risk areas, testing period, and report date. Record the definition of a finding, the basis for severity, and the evidence required for verified closure. Distinguish a failed control test from an issue: several failed tests can belong to the same finding.

The Department of Justice's Evaluation of Corporate Compliance Programs asks about root causes, prior control weaknesses, and specific remediation addressing recurrence. Those questions support an oversight narrative that goes beyond counting completed activities. They do not make an issue-count scorecard an assessment of legal compliance.

Take an issue-register export with a unique finding ID, risk area, severity, opening status, date raised, verified closure date, original due date, current due date, executive owner, and repeat-failure indicator. Keep the control-testing summary separately, with test IDs and linked finding IDs. The existing compliance KPI definitions cover the wider measurement set; select the measures relevant to this meeting.

Define a repeat as the recurrence of a linked control failure after an earlier remediation, supported by prior test or finding IDs. A newly detected issue that has existed for a long time is not automatically a verified repeat.

Build the finding movement from the export

The following illustrative US distributor reports as of September 30, 2026. Its September management schedule uses flags derived from the dated register. A flag of 1 means yes; 0 means no. Dates in the due-date column are current remediation dates.

Put these columns in A:G, with headers in row 1 and data in rows 2:10. Enter the reporting cutoff in L1 as =DATE(2026,9,30). In H2 calculate the closing-open flag, then fill down:

=C2+D2-E2

Each result must be 0 or 1. A negative flag or a result above 1 indicates inconsistent movements or duplicate records. For a longer period, a finding raised and closed during the period carries both movement flags and finishes at zero.

Calculate overdue and repeat exceptions

In I2, flag an open finding with a valid date earlier than the cutoff. In J2, identify a repeat finding that is still open:

=IF(AND(H2=1,ISNUMBER(F2)),--(F2<$L$1),0)
=H2*G2

Fill both formulas down. Dates must be spreadsheet dates, not text. Missing dates belong in a separate exception list; they do not mean that remediation is on time.

For a risk-area name in N2, sum the closing-open flags as follows. Change the sum range to column I for overdue findings or J for open repeats:

=SUMIFS($H$2:$H$10,$B$2:$B$10,N2)

The SUMIFS documentation explains how matching criteria select the rows to add. Keep the sum and criteria ranges aligned. The report becomes:

The movement check is 6 + 3 - 2 = 7. The seven closing IDs must also match the dated register. Overdue findings and repeat findings overlap: P1 and V2 are in both columns, so adding those columns would double count them.

The overdue share is 4 / 7 = 57.1%, rounded to one decimal place. That describes timeliness within the open register, not the probability of misconduct or the dollar value of exposure.

Turn the exceptions into a board decision

Write a short paragraph before the detail: the register increased because new findings exceeded verified closures; overdue work is concentrated in Vendors; open repeats require evidence that the underlying response has changed. Add severity from the register before choosing what merits board attention. Counts alone cannot establish materiality.

For each significant finding, state the business consequence, interim control, accountable executive, original commitment, revised commitment if any, and evidence still needed. Separate confirmed facts from management judgments. If loss exposure has not been assessed, say that; do not multiply findings by an invented average loss.

A request might ask directors to resolve a cross-functional ownership dispute or consider a documented resource proposal. Specify the requested decision and the consequence of deferral. The operations report to the board owns service and capacity exceptions; cross-reference a shared issue rather than describing the same incident twice. A nonprofit board report separately addresses restricted funding and program accountability.

Where it goes wrong

• Extensions erase history. Show original dates alongside approved revisions and explain the change.
• Closure means an action was uploaded. Apply the stated verification standard before recording a closure.
• Tests and findings are added together. Link their IDs and count each population separately.
• A higher count is automatically worse. Changed testing scope can raise detected findings; explain coverage changes.
• Every risk area receives the same weight. Preserve severity and management's assessed consequence beside the counts.

Build this report from your own register in Covirage

Bring a sample of your own issue register and control-testing summary as files or a Google Sheet. Covirage maps the columns, its tools compute and check the movements and exceptions, and the external AI model explains the results with every figure traced to its rows. Create a free Covirage account and use your own reporting cutoff and definitions.

See Covirage for compliance teams for the supporting context.