Boards · Governance · Board Reporting
What Should Go in a Board Risk Report on Culture?
By Nicole Vaughan · 17 July 2026
Introduction
Ask most boards what they receive on culture, and the honest answer is: an annual engagement score, benchmarked against last year, with a short narrative underneath. It's not nothing, but it's a long way from the kind of structured risk reporting boards receive on financial, operational, or cyber risk. Culture deserves the same discipline, and increasingly, governance expectations assume it gets it.
The Problem With Score-Only Reporting
A single engagement score answers "is the number up or down," and almost nothing else. It doesn't tell the board where the risk is concentrated, what's driving the movement, or whether there's something specific to escalate. Boards making governance judgements off a single number are, in effect, flying with one instrument.
A Structured Format That Actually Works
- Headline metrics with trend, not a single snapshot. Direction of travel matters more than any one score.
- Theme-level findings from open-ended feedback. The specific, recurring things employees are actually saying, not just a sentiment average.
- Distribution, not just aggregate. Culture risk is rarely evenly spread — a report that hides a serious site-level or team-level problem inside a healthy company-wide average isn't doing its job.
- External signal alongside internal. A short section on what's visible in public employee reviews, independent of internal reporting, so the board has a cross-check.
- What's been escalated and what's been done. A closed-loop record connecting findings to action, so the report shows governance in motion, not just data at rest.
Cadence Matters as Much as Content
An annual deep dive, however well structured, is still a once-a-year snapshot of something that changes continuously. Boards that treat culture reporting as a standing item, reviewed on the same cadence as other principal risks, catch emerging patterns while there's still time to act on them, rather than confirming a problem that's already fully formed.
This is exactly the kind of structured, standing reporting board chairs and compliance and risk functions use myCandr to build, combining comprehensive internal feedback analysis with independent external monitoring.
A Simple Test
A useful way to check whether an existing board culture report is doing its job: could a director, reading only that report, name the two or three specific things employees are most concerned about right now, and where they're concentrated? If the honest answer is no — if the report only supports "engagement is broadly stable" or "engagement is broadly declining" — it's operating as a satisfaction tracker, not a risk report, regardless of how it's labelled.
Conclusion
A good board risk report on culture reads less like a satisfaction survey and more like any other risk report: trend, distribution, drivers, and what's being done about it. Getting there mostly requires committing to the reporting standard, not new data most organisations don't already have somewhere in their employee feedback.