Boards today receive extensive compliance with information from dashboards and heat maps to training statistics, investigation data, audit findings and remediation updates. Yet the availability of more information does not necessarily provide greater assurance. A recently article examines how compliance reporting can unintentionally create an overly positive picture of an organisation’s risk position when evidence of activity is treated as evidence of effectiveness.

A central distinction is between implementation and effectiveness. High training completion rates demonstrate that training has taken place, but not necessarily that employees understand the relevant requirements or will act appropriately when confronted with a compliance issue. Similarly, the adoption of a policy or implementation of a control does not, by itself, establish that behaviour has changed or that the control operates effectively. Even apparently favourable indicators—such as a decline in whistleblower reports—may require further context before conclusions can be drawn.

The article also highlights the risk that relevant context may be lost as compliance information is consolidated before reaching the board. Recurring control failures may appear as isolated incidents, unresolved questions of responsibility may be reduced to overdue actions, and stable risk ratings may obscure risks that have simply become normalised over time. Remediation statistics present a similar issue: closing an action does not necessarily establish that the underlying root cause has been addressed.

These observations underline the distinction between reporting on compliance processes and reporting on the effectiveness of the compliance framework. From a governance perspective, the article provides a useful examination of how the selection, aggregation and presentation of compliance information can influence the level of assurance derived from it—without the underlying data itself necessarily being inaccurate or misleading.

As the author concludes, effective compliance reporting is not necessarily about providing boards with more information. Rather, its value depends on whether the information enables directors to understand what is working, where uncertainty remains, and which matters may require further scrutiny or decision-making.