A3 · Advisory
Annual Oversight
The year after the assessment. Quarterly board packs, an annual re-score against your baseline, and a named contact when something goes wrong at six on a Friday.
The board's second question
The first is how exposed are we? The assessment answers that. The second arrives about ninety seconds later, usually from the audit chair: how do we know this stays fixed?
It is a fair question and a hard one, because the things that move are not under the company's control. Vendors ship model changes without notice. Teams adopt tools that did not exist last quarter. Laws arrive on timetables set elsewhere. A score taken once is a photograph of a moving object.
This is the answer to that question: the same instrument, re-run, with the changes in between reported to the board as they happen rather than discovered a year later.
What you get
-
Quarterly board pack — four to six pages
Score trend against baseline, what changed since last quarter, the regulatory developments that reach your systems and jurisdictions specifically, three questions for management, and the status of the remediation plan. Written to go in the papers, not to be presented from.
-
Annual re-score
The full Scorecard re-run in month twelve against the same rubric, compared to baseline. Same instrument, same questions — which is the only way the comparison means anything.
-
Incident on-call
A named contact for the GC when something goes wrong, with a 24-hour response commitment. Up to 20 hours a year included; we will tell you when you are approaching it rather than after.
-
Two board attendances
In person or by video, to present the pack and take questions. Usually the Q2 and Q4 packs.
-
Platform access
Inventory, vendor assessment, incident register and evidence vault for the term, as each ships. Your data stays yours and leaves with you.
Scope
Fixed on both sides. Anything outside it is a separate engagement, quoted separately.
Included
- Four quarterly board packs
- Annual Scorecard re-score against baseline
- Named incident contact, 24-hour response
- 20 hours of incident support per year
- Two board or committee attendances
- Platform access for the term
- Quarterly regulatory update filtered to your exposure
Not included
- Remediation delivery — we report, your team fixes
- Training delivery (routed to the academy)
- Vendor negotiations
- Incident support beyond 20 hours, without a change order
- Additional board attendances
- Legal advice or a compliance opinion
How it runs
| Q1 | Kickoff and platform onboarding. First pack restates the baseline so everyone is working from the same number. |
|---|---|
| Q2 | Pack two. First board attendance. |
| Q3 | Pack three. Incident drill offered as an add-on. |
| Q4 | Annual re-score. Pack four with the year-on-year comparison. Second board attendance. Renewal conversation. |
Common questions
Why is it only offered to assessment clients?
A trend needs a baseline. Without the assessment there is no comparable first measurement, and a score that appears from nowhere in quarter one tells the board nothing about direction — which is the only thing a retainer is for.
What if the score improves and the board thinks we're done?
That is the honest risk, and we say so at the outset. The pack's regulatory section exists partly to make the point concretely: the rules moved this quarter, here is what they now require of your systems. Maintaining a score under changing rules is different work from reaching it.
What does the incident on-call actually cover?
Helping the GC think through the first 48 hours: what to ask management, what the disclosure question turns on, what to record. It is not crisis communications and it is not legal advice — your counsel leads, we help them ask the technical questions.
Who writes the board pack?
It is generated from your own data — inventory, vendor reviews, incidents, the regulatory tracker — and then reviewed and edited by a human before it goes anywhere. The review step is not optional and cannot be skipped; a board document that nobody read before sending is not a governance artifact.
What happens to our data if we don't renew?
You export it and it is deleted on request. The register, the incident history and the evidence are records about your business; we hold them, we do not own them.
NEUBoard provides governance advisory services. Board packs and re-scores are advisory assessments against a published rubric, not legal advice, a compliance certification, or an assurance opinion, and no attorney–client relationship is created. The incident contact is an advisory resource and does not replace counsel.
Already had an assessment?
The conversation usually starts at the board presentation. If yours has passed, it is not too late.