The Board Operations Dashboard: Risk, Service, People and Assets

Why the board cannot use the executive dashboard

An executive dashboard is built for management action: it often contains dozens of operational signals, queues, open incidents and owner-level tasks. A board that sees the same screen gets buried in detail and loses the ability to identify what has changed and what needs oversight. The board's question is not what to do next but whether management's risk and performance narrative is supported by evidence.

The Institute of Internal Auditors' Three Lines Model highlights that the governing body relies on management reports and independent assurance rather than operator-level workflow detail. COSO's enterprise risk management guidance similarly ties risk to strategy and performance. The dashboard should therefore be a controlled summary of source records, not a second spreadsheet created solely for the meeting.

Four blocks, one page

A stable one-page structure helps directors build muscle memory. The four blocks are risk, service, people and assets. Risk shows whether the organisation is inside its agreed risk appetite, which material risks have moved and which accepted risks still require board visibility. Service shows whether commitments to customers and operational counterparties are being kept. People shows dependency, succession and critical skills. Assets shows whether physical, digital and service assets are capable of supporting strategy.

Each block should contain five to seven signals, not twenty. The board needs enough to challenge management, but not enough to duplicate operational reporting. Trend arrows, threshold breach flags and a short owner note for each signal are usually sufficient.

The decision log sits underneath the four blocks and records what requires board attention, who owns it and by when it will return. A dashboard without a decision log tends to become a static status report.

Choosing indicators and thresholds

A board-ready indicator has four features: it can change a decision, it has a documented threshold, it has a named owner, and it can be traced to a source system. If a metric fails any of these tests, move it to the executive or owner layer. For example, percentage of critical transactions completed without delay is more useful to a board than the number of incident tickets, because it connects service quality to revenue and customer impact.

Thresholds should come from risk appetite, service commitments, workforce plans and asset management policy. A threshold set at the industry average is not governance; the board must affirm the boundary that separates acceptable from unacceptable. That affirmation should be recorded as a control decision and reviewed at least annually.

• Risk thresholds: residual risk level beyond appetite, material movement, open remediation outside committed date.
• Service thresholds: critical service availability, customer-impact incidents, backlog outside committed delivery date.
• People thresholds: key-person coverage below target, regrettable turnover above tolerance, safety incidents.
• Asset thresholds: critical asset availability below target, maintenance backlog beyond policy, investment below depreciation.

Cadence, ownership and drill-down

Not every layer needs the same refresh rate. The full board may review the dashboard quarterly or monthly depending on materiality; the risk and audit committees can review risk and control metrics monthly; owners and operators work at weekly or daily cadence. Frequency is itself a governance signal because it tells the organisation what the board considers important.

Drill-down should be controlled by role. Board members need summary, trend and decision framing; executives need owners and remediation status; owners need their own tasks. Raw vulnerability lists, full control matrices and operational ticket queues belong in the back pocket, not on the board dashboard.

From dashboard to decision

The final test is whether the dashboard changes a decision. If the risk block shows a material risk outside appetite, the board should see a proposed mitigation, an owner and a date. If the people block shows three uncovered key-person roles, the board should ask for succession actions, not simply note the red flag.

A practical way to enforce this is to begin every board discussion with the decision log from the previous pack: what was agreed, what happened, and which decisions are still open. This turns the dashboard from a backward-looking report into a live governance instrument.

It is also normal for a dashboard to be imperfect on first release. Start with fewer, well-understood indicators, validate the underlying records, and add complexity only after the board trusts the numbers.