Field notes · 20 January 2026
Preparing a board summary after a control review
Dense working papers help auditors. Boards need a short map of residual risk and who owns each remediation.
After a payment-control or reconciliation engagement, management often asks for “the short version.” That request is fair. Working papers are for the audit trail; the board summary is for decisions.
Three pages, not thirty
Our board summaries usually fit three pages: scope and period, material findings with residual risk, and a remediation ownership table. Appendices can hold detail. Boards that receive only appendices tend to miss the ranking.
Rank by consequence, not by drama
A colourful incident that was contained may rank below a quiet cut-off weakness that repeats every cycle. We rank by potential settlement impact, customer harm, and regulatory exposure — then say so explicitly so readers understand the order.
Owners and dates beat vague intent
“Management will enhance monitoring” is not a remediation plan. We ask for a named owner and a target date before the summary is final. If dates are still under discussion, the summary says that too.
Keeping the tone grounded
The summary should neither alarm nor soothe. It should leave directors able to ask one precise follow-up: whether the highest residual risks have budget and attention. That is the practical purpose of the document.