Part 5 of Governance Beyond Compliance — building accountable leadership, resilient organisations and healthy cultures. First published on LinkedIn, 28 June 2026.
Building the information architecture that allows a board to govern independently and effectively
Key takeaways
- A board can only govern what it can see. Its information comes from three sources: management-mediated, independently verified and informal.
- Every board paper needs a standing information architecture covering financial, people, compliance and governance reporting.
- Some information — external audit findings, staff survey results, exit interviews and company secretary reports — should reach the board independently of the CEO.
A board can only govern what it can see.
This is the most fundamental constraint in NFP governance – and the one most consistently underestimated by boards that believe they are governing effectively because they are receiving regular reports, attending meetings, and asking questions of management.
Receiving information is not the same as having independent sight lines into the organisation. The information a board receives may be accurate. It may also be selective, curated, contextualised, or framed in ways that present a picture of the organisation that is materially different from the one that would emerge if the board could see the raw data directly.
The difference between those two pictures – the managed picture and the independent picture – is the governance gap. And in a small NFP, that gap can be wide enough to contain regulatory exposure, people management failure, financial risk, and cultural damage that the board has never seen because the information architecture of the organisation was never designed to show it.
This article is about how to close that gap – by designing an information architecture that gives the board genuine independent sight lines into the organisation’s health, not merely access to what management has chosen to share.
The three sources of board information
Every piece of information that reaches a board comes from one of three sources. Understanding which source any given piece of information comes from is the first step in assessing how much independent weight it carries.
Source one – management-mediated information.
This is the information that management prepares, curates, and presents to the board. It includes board papers, CEO reports, financial summaries, operational updates, and any other information that passes through the management line before it reaches the board.
Management-mediated information is not inherently unreliable. In a well-governed organisation with a capable and trustworthy CEO, it is the primary and appropriate source of board intelligence. The CEO and the management team are closest to the operation. They have access to information the board does not – and their job includes synthesising that information into a form that is useful for governance purposes.
The limitation of management-mediated information is structural rather than moral. Even the most trustworthy CEO has interests – in how their performance is assessed, in how the organisation’s challenges are perceived, in how their decisions are understood retrospectively – that are not perfectly aligned with the board’s interest in an unfiltered picture of organisational reality. That misalignment does not require dishonesty to produce distortion. Selection, emphasis, framing, and omission – all of which can operate entirely below the threshold of conscious intent – are sufficient to produce a materially incomplete picture.
A board that relies exclusively on management-mediated information is a board whose governance intelligence is bounded by management’s interests – whether or not management is aware of that boundary.
Source two – independently verified information.
This is information that the board accesses through channels that are independent of the management line – external audit, regulatory filings, independent staff surveys, direct exit interviews, the company secretary function when it is genuinely independent, and any other mechanism that produces data the board receives without management intermediation.
Independently verified information is the foundation of genuine board oversight. It provides the corroborating evidence that allows the board to assess management-mediated information against something other than itself. It surfaces the discrepancies – between what management reports and what the independent data shows – that are the most important governance signals available to a board.
The limitation of independently verified information is cost and access. Independent mechanisms require deliberate design, active board commissioning, and in some cases financial investment. In a small NFP where resources are constrained and relationships are close, the instinct is to trust the management relationship rather than invest in the independent mechanism. That instinct is understandable. It is also the instinct that leaves boards governing blind.
Source three – informal information.
This is the information that reaches board members through personal relationships, chance conversations, community connections, and the informal networks that small NFP board members typically maintain with staff, stakeholders, and organisational participants.
Informal information is often the earliest signal of a governance problem – arriving before the formal reporting structures have captured what is happening, and before management has had the opportunity to contextualise it. A board member who hears, through a personal relationship, that staff morale is significantly lower than the CEO’s report suggests has received a governance signal that the formal reporting architecture has not yet delivered.
The limitation of informal information is that it is unverifiable, potentially partial, and procedurally difficult to act on without a formal process. A board that acts on informal information without independent verification risks unfairness – to the management it is questioning and to the staff whose informal accounts it is relying on. A board that ignores informal information because it arrived through an informal channel risks the governance failure that the information was signalling.
The appropriate response to informal information is neither to act on it directly nor to dismiss it. It is to treat it as a prompt for independent inquiry – to commission the independent verification that will allow the board to assess the informal signal against something more substantial than a single account.
What should be in every board paper – a standing information architecture
The most practical step a board can take to improve its information access is to design a standard board paper template – and to treat every item in that template as a standing obligation rather than a discretionary inclusion.
A board paper that includes only what management judges relevant in any given period is a board paper designed by management. A board paper that includes a standard set of items in every period – regardless of what management would prefer to report – is a board paper designed by governance.
The standing items in a well-designed NFP board paper should include the following.
Financial reporting – three mandatory items:
Current financial position against budget – with variance explanation for any item that deviates by more than a defined threshold. The threshold should be set by the board, not by management. And the explanation should be provided by management but assessed independently by the board against the previous period’s explanation – to identify whether variance patterns are being consistently minimised or accurately characterised.
Cash flow position and forecast – current cash position, projected cash position over the next three months, and any funding obligations or revenue uncertainties that affect the projection. A board that does not know its organisation’s cash position at every meeting is not governing its financial risk.
Accounts payable and receivable ageing – particularly any overdue obligations to staff, suppliers, or regulators. Overdue payroll obligations, superannuation payments, and regulatory levies are among the earliest financial signals of organisational distress – and among the most likely to be omitted from board papers until they become crises.
People reporting – four mandatory items:
Staff headcount and movement – every departure and every appointment in the period, with role, tenure, and stated reason for departure. Not a summary statistic. A list. The pattern is in the detail, not the aggregate.
Leave liability – total accrued annual leave and long service leave liability, with any individual accruals that exceed defined thresholds. Excessive leave accrual is both a financial liability and a people management signal – and it is one of the most consistently absent items in small NFP board reporting.
Psychosocial risk indicators – sick leave rates, employee assistance program referral rates, and any other indicators of staff wellbeing that the organisation has access to. These should be reported as standing items, not raised selectively when management judges them significant.
Complaints and incidents – every formal complaint, grievance, or incident report received in the period, with status. Not a summary of resolved matters only. Every open matter, including its current status and the expected resolution timeline.
Compliance reporting – three mandatory items:
Regulatory obligations calendar – every compliance deadline in the next ninety days, with status. Not a reassurance that compliance is being managed. A specific list of obligations, deadlines, and current completion status.
Any regulatory correspondence received – including correspondence that is routine, that has been responded to, or that management assesses as low risk. The board should see all regulatory correspondence, not only the correspondence that management judges significant.
Any legal matters – including any employment disputes, complaints to external bodies, or legal proceedings at any stage. A board that learns about a Fair Work complaint or a WorkSafe investigation from the regulator rather than from management has been denied information it was entitled to receive.
Governance reporting – two mandatory items:
Decisions made under delegation – a record of every significant decision made by the CEO under delegated authority in the period. The purpose of this item is not to second-guess CEO decisions – it is to give the board visibility over how the delegation framework is being used, and to identify any pattern of decisions that may warrant board attention or delegation review.
Conflicts of interest – any conflicts declared or identified in the period, with the manner in which they were managed. This item should be included even when the answer is nil – because a standing nil declaration creates the expectation of disclosure that makes non-disclosure visible.
The information that should come from independent sources
The standing board paper architecture described above relies primarily on management-mediated information – albeit structured and disciplined by board design rather than management preference. That architecture is necessary but not sufficient.
The following information should come to the board from sources that are independent of the management line.
External audit findings – directly from the auditor.
The external auditor’s primary obligation is to the board, not to management. In practice, in many small NFPs, the auditor’s management letter and findings are presented to the board by management – after management has had the opportunity to review, respond to, and contextualise the findings. This is not appropriate. The board should receive the auditor’s findings directly – in a meeting that includes the auditor and excludes the CEO, at least annually – so that the board can ask questions of the auditor without management present.
This is not a hostile act towards management. It is a standard governance practice that protects both the board and the organisation – and that the auditor, as a professional with their own ethical obligations, should welcome.
Staff survey results – directly from the independent provider.
As discussed in the previous article in this series, staff surveys commissioned by the board should be administered by an independent provider whose reporting obligation runs to the board rather than through the CEO. The raw results – not a management summary – should reach the board directly.
Exit interview accounts – directly from the board’s designated interviewer.
Exit conversations conducted by a designated board member or independent party should be reported to the board directly – not through the CEO or HR. The report should include the themes that emerged across multiple exit conversations, any specific governance concerns raised by departing staff, and any discrepancies between the departing staff member’s account of their experience and the management explanation for their departure.
Company secretary reports – independently of the CEO.
Where the company secretary function is genuinely independent of the CEO – reporting to the board rather than to management – the company secretary’s report on compliance, governance obligations, and statutory matters should reach the board directly. In a small NFP where the company secretary reports to the CEO, this independence is structurally compromised – and the board should understand that the company secretary’s report reflects management’s governance position rather than an independent assessment of it.
The information the board should be asking for – and isn’t
Beyond the standing architecture and the independent sources, there is a category of information that most small NFP boards never ask for – not because it is unavailable, but because nobody has established the habit of asking.
This information includes:
The actual employment agreements of senior staff – not summaries, the agreements themselves – so the board can verify that the terms being applied in practice are consistent with what was approved and what is legally required.
The organisation’s insurance coverage – what is covered, what is excluded, and whether the coverage is adequate for the organisation’s current risk profile. Boards that discover their Directors and Officers insurance has lapsed, or that their public liability coverage does not extend to a new program, typically discover it when they need the coverage.
The organisation’s data and privacy obligations – what personal information the organisation holds, how it is stored, who has access to it, and what the organisation’s obligations are under the Privacy Act and any applicable state legislation. In a small NFP handling health information, financial information, or information about vulnerable populations, privacy obligations are a material governance risk that most boards have never formally reviewed.
The organisation’s IT access and security posture – who has administrative access to critical systems, what happens to that access when a staff member or contractor leaves, and whether the organisation’s data is backed up and recoverable. A board that has never asked these questions does not know whether the organisation’s most critical assets – its data, its systems, and the institutional knowledge they contain – are adequately protected.
Building the information architecture – a practical sequence
For a board chair or governance leader looking to build or rebuild the information architecture of a small NFP, the following sequence applies.
Begin with the board paper template. Review the current template against the standing items described in this article. Identify the gaps. Add the missing items as standing obligations – not discretionary inclusions – and communicate to management that these items are required in every board paper, regardless of whether management judges them relevant in any given period.
Establish the independent channels. Identify the three or four pieces of information that most directly reflect the organisation’s governance health – typically the external audit relationship, the staff survey, the exit interview process, and the company secretary function – and assess whether each is currently independent of the management line. Where it is not, design the independence in.
Commission an information audit. Ask a simple question of every board member: in the last twelve months, has there been a significant development in the organisation’s compliance, financial, or people situation that you learned about through an informal channel before you saw it in a board paper? The answers to that question will reveal the gaps in the current information architecture more quickly than any formal review.
Review annually. Information architecture is not static. The organisation’s risk profile changes. The regulatory environment changes. The management team changes. The board paper template and the independent channel design should be reviewed at least annually – and whenever there is a significant change in leadership, funding, or operating environment.
A note on trust
Everything in this article might be read as a prescription for a board that distrusts its management – a set of mechanisms designed to catch management doing something wrong.
That reading would be mistaken.
The information architecture described in this article is not designed for distrust. It is designed for independence – which is a different and more important thing.
Trust is relational. It is built through experience, through consistency, and through the accumulation of evidence that the person or organisation being trusted is worthy of the confidence placed in them. Trust is valuable. In a small NFP where relationships are close and the mission is shared, trust is one of the organisation’s most important assets.
But trust is not governance. And governance – the structural independence of the board’s oversight function – is what allows trust to be maintained honestly rather than assumed indefinitely.
A board that trusts its CEO and has independent information architecture is a board that can verify the trust it extends – and that can respond quickly and appropriately when the verification reveals something the trust did not anticipate.
A board that trusts its CEO and has no independent information architecture is a board whose trust is untested. Untested trust is not a governance asset. It is a governance vulnerability – waiting for the moment when what it has not seen becomes impossible to ignore.
Build the architecture. Extend the trust. Verify both.
That is what independent governance looks like. And it is the foundation on which every other element of this series rests.
Dennis Chew is a Corporate Governance specialist, Company Secretary, and Director of Operations professional with forty years of experience across NFP, faith-based, educational, and corporate organisations in Australia, Malaysia, New Zealand, and Hong Kong. He writes on governance, institutional resilience, and people development.
He is open to conversations about Director of Operations, Non-Executive Director, and governance advisory engagements in Melbourne.
Previous: Part 4 — The Turnover Number Your Board Should Be Watching
Next: Part 6 — When the Leadership Compact Breaks Down
All articles in Governance Beyond Compliance
Working through a governance challenge? Dennis is available for board and non-executive director roles, interim executive engagements and advisory conversations. Get in touch or see Governance & Leadership.