Twenty years ago, I joined a small team that set out to build something deceptively simple: give nonprofit boards technology that genuinely elevates their work. I couldn’t have predicted how far that idea would go — or how essential it would become — but I knew boards needed better ways to prepare, make decisions and lead.

What excites me most now, two decades later, is that we’re no longer just digitizing board books or compressing workflows; we’re helping directors “see around the corner,” shifting them from being stewards of the past to architects of the future.

Back when we started BoardEffect, we persuaded directors to trade three-ring binders for digital board books; the iPad made that shift feel inevitable. Then the world changed: cybersecurity, more regulations coming down the tracks, changing stakeholder expectations — these have all pulled oversight forward. Board members started asking for visibility into what might come next, not just what already happened.

The pandemic slammed the accelerator on secure, cloud-based governance, and now generative AI has opened a new chapter: a chance to reimagine how boards navigate complexity, interrogate assumptions and prepare for decisions with greater speed and confidence.

That’s why this move for BoardEffect into the Diligent One Platform matters so much. It brings our customers a modern, unified experience with enhanced security, a consolidated view across governance, risk and compliance, and direct access to education and AI capabilities — all in one place, while retaining the BoardEffect functionality and ease of use our clients have come to rely on in the last twenty years.

The Diligent One Platform makes it easier for boards and administrators to work together. It brings everything into one place, so you can log in securely and access what you need without extra steps. Learning tools and dashboards are built right into your daily board activities, helping administrators support their boards with less hassle. Plus, new AI-powered features simplify tasks for everyone on the governance team, saving time and reducing complexity. It's still BoardEffect, but it's better than before.

What we’ve delivered this year for our BoardEffect community

This past year, we focused on three things: making the everyday easier, turning activity into insight and modernizing the user experience using native AI.

First, the everyday: a refreshed BoardEffect home experience makes the start of work more intuitive, so admins and directors can get to essential tasks faster. For leaders with multiple BoardEffect sites, the new Board Switcher means you log in once and move across sites without the usual juggling of passwords and URLs. We also added the ability to share annotations directly with anyone who can access a meeting book, lightweight collaboration that reduces email loops and keeps context where it belongs.

Second, turning activity into insight. Our AI Smart Minutes convert typed notes and transcripts into professional minutes in seconds, automatically capturing decisions and action items and supporting compliant recordkeeping. AI Smart Summary distils complex board books into concise, actionable overviews so board members arrive prepared and aligned, even on busy cycles. And for admins who need to tell the board’s story in numbers, Customizable Reporting now lets you visualize key metrics — terms, attendance, logins — and filter to what matters, then share with stakeholders.

Third, a modern design that keeps everything in one place, so you don’t have to jump between tools or feel overwhelmed. AI Smart Prep surfaces themes, decisions and questions from your meeting materials so members can focus quickly on the substance of the conversation. With Microsoft 365 integration enhancements, teams can create and collaborate on Excel files directly in BoardEffect, eliminating context switching and preserving controls.

. These AI assisted governance tools are built right into BoardEffect and are designed specifically for nonprofit and volunteer boards.

GovernAI speeds up the jobs that have historically slowed you down: summarizing dense materials, accelerating preparation, generating accurate minutes and finding the right information without digging.

Just as importantly, GovernAI is grounded in principles that put customers in control: the AI is only trained for your use, it produces clearly labelled AI outputs and it is 

Looking forward, we’re continuing to invest in BoardEffect where you’ve asked us to deliver most: productivity, insight and seamless engagement.

You’ll soon see AI Smart Search, with natural language answers grounded in your permissions, so directors and admins can find relevant documents, events and highlights in seconds.

You’ll soon gain Board Engagement Reporting to understand how members interact with materials and where readiness can improve over time, helping you tailor support and spark better questions in the room.

We’re modernizing the UI across BoardEffect's web and mobile applications to make navigation cleaner, faster and more accessible, and we’re refreshing the mobile app to keep the on the go experience responsive and dependable.

Across all of this, we’re continuing accessibility improvements aligned to WCAG standards, alongside practical guidance to help teams prepare accessible materials.

Why I’m so excited about BoardEffect’s future

BoardEffect is not going away. On the contrary, it’s getting even better and more innovative for our customers as a result of moving onto the Diligent One Platform.

What began as a push to remove friction from board work has become something much bigger: an opportunity to help mission driven leaders govern with more foresight, more clarity and more confidence. We’re meeting boards where they are, on a secure, modern platform, with AI that saves real time, respects privacy and elevates preparation, and we’re doing it with the nuance that governance demands.

I’m excited for what BoardEffect will unlock in the year ahead: better prepared directors, crisper discussions and faster, more informed decisions that move your mission forward. That’s why we built BoardEffect in the first place, and it’s why I’m as energized now as I was on day one.

If you’d like a walkthrough tailored to your board’s needs, 

 to see GovernAI and the latest BoardEffect enhancements in action.

20 years of BoardEffect: Reflections on the past, focused on the future

The days of simple business operations are long behind us. Today’s organizations face rapid growth, evolving risks, shifting regulations, globalization, and a flood of technology and data. For a GRC board, keeping strategy, performance, and risk aligned amid all this complexity is no small feat.

The board's role in GRC has never been more critical — helping executives and management teams navigate uncertainty and stay in sync with constant change.

GRC (governance, risk management and compliance)

 by definition starts with the G for governance. Because of the board's role in corporate governance, one would think that GRC is a 

 and initiative. However, the opposite is most often the case. It is the R for risk management and C for compliance that drive most GRC initiatives — and fail to engage senior executives and the board who ultimately have fiduciary obligations for all aspects of GRC.

This article explores how boards can lead effective GRC strategies by covering:

What the board's role in GRC encompasses and why board leadership matters

How governance, risk management and compliance interconnect at the board level

The shortcomings of siloed, department-led GRC approaches

The benefits of board-driven, integrated GRC strategies

How boards enable organization-wide GRC excellence

How AI-powered platforms transform board-level GRC oversight

 role in GRC encompasses setting strategic direction, approving risk appetite, ensuring adequate resources and holding management accountable for GRC performance across the enterprise.

Boards hold ultimate accountability for governance, risk management and compliance — a responsibility that cannot be delegated despite operational execution residing with management.

This accountability has intensified as regulatory scrutiny increases and stakeholders demand greater transparency. According to 

 conducted by Corporate Board Member, FTI Consulting and Diligent Institute, strategy has emerged as the most challenging issue for directors to oversee at 42%, surpassing cybersecurity for the first time in years.

Additionally, 24% of directors identify enterprise risk management as a significant oversight challenge, reflecting the complexity boards face in connecting GRC activities to strategic objectives.

The board's role now extends beyond reviewing periodic reports to actively shaping how organizations approach governance, risk and compliance as interconnected disciplines.

 establish clear expectations for the information they need, create accountability structures that ensure management execution, and continuously evaluate whether GRC investments deliver value in proportion to the resources consumed.

Setting strategic direction for GRC programs

 that shapes how organizations make decisions, allocate resources and hold leadership accountable. This includes:

Approving risk appetite statements that clarify acceptable risk-taking parameters

Establishing governance structures that align with business strategy

Ensuring compliance programs reflect organizational values and stakeholder commitments

Strategic direction requires boards to understand how GRC activities support business objectives rather than viewing governance, risk and compliance as separate compliance exercises.

, drives principled performance. It represents an organization's capability to reliably achieve objectives (

), while addressing uncertainty (risk management) and acting with integrity (compliance). The flow starts with governance, which provides context for risk management and compliance.

This is the governance function of GRC — to set, direct and govern the reliable achievement of objectives. Objectives can be overall entity-level objectives, but also can be divisional, departmental, project, process or even asset-level objectives.

Governance involves directing and steering the organization to reliably achieve objectives.

 defines risk as "the effect of uncertainty on objectives." Good risk management is done in the context of achieving objectives — to optimize risk-taking to ensure that the organization creates value.

This is the compliance function of GRC. It extends beyond regulatory compliance to encompass the organization's adherence and integrity in meeting its commitments and obligations.

These commitments and obligations can stem from regulations, but also can be found in ethical statements, values, codes of conduct, ESG commitments and contracts.

As you can see, GRC by definition and concept flows from governance into risk management and compliance. However, most organizations implement GRC strategies that start with risk and compliance and fail to connect or even consider governance. Boards have both the responsibility and authority to correct this fundamental misalignment.

The shortcomings of a siloed approach to GRC

"There needs to be collaboration between risk and the business, vertically up and down, but then also horizontally across the organization. It is absolutely essential — collaboration across risk departments. The problem is that there are silos. Risk and audit are interconnected and interdependent. Collaboration helps provide audit's perspective, their insight across company policies and procedures that help improve risk's function," says Michael Rasmussen, CEO of GRC Report.

Rasmussen identifies the fundamental challenge facing most organizations: GRC functions operate in isolation when they should work as an integrated system. When risk management, audit and compliance teams maintain separate processes and reporting structures, organizations lose the critical connections between these disciplines.

A compliance issue may signal broader risk exposures, while an audit finding may reveal governance gaps that affect strategic decision-making. These relationships remain invisible when teams work in departmental silos.

This interconnectedness and demand for contextual awareness apply to the world of business. Organizations need contextual awareness of GRC to understand the intricate relationships among objectives, risks and integrity across the enterprise.

Without this integrated view, boards cannot effectively oversee how governance decisions impact risk exposure, how compliance obligations constrain strategic options or how risk-taking aligns with approved objectives.

The core issue is that in GRC, the ‘G’ often goes silent. Too frequently, organizations approach GRC from a compliance, audit or risk perspective, leaving governance buried deep within departments instead of driving a top-down, board-led strategy.

True GRC should be an integrated discipline that connects governance with performance and decision-making at the highest level.

Organizations need to understand how to monitor risk-taking in the context of governance and objectives, measure whether associated risks taken are the right risks to achieve objectives, and review whether risks are effectively managed.

The benefits of a board-driven, integrated approach to GRC

Organizations that take a board-driven approach to GRC led from the top realize significant advantages in organizational performance, risk management effectiveness and compliance maturity.

These benefits extend beyond avoiding regulatory penalties to creating competitive advantages through superior governance infrastructure.

When boards actively lead GRC strategies, organizations become:

 Leaders have a finger on the pulse of the business and watch for changes in internal and external environments that introduce risk to objectives. Key to this is the ability to turn data into information that can be analyzed and shared in every relevant direction.

Boards need synthesized intelligence that highlights significant exposures, emerging threats and risk appetite alignment — not raw data dumps from operational departments.

 They align performance, risk management and compliance to support and inform business objectives. This requires continuously aligning objectives and operations of the 

 capability to those of the entity, and giving strategic consideration to information from GRC management capabilities to effect appropriate change.

The What Directors Think 2025 report reveals that only 30% of directors rate their board's ability to understand the company's long-term strategy as "excellent," evidencing the challenge with maintaining this alignment.

 Organizations cannot react to something they do not sense. Mature GRC management focuses on gaining greater awareness and understanding of information that drives decisions and actions, improves transparency, and quickly cuts through the morass of data to uncover what an organization needs to know to make the right decisions.

 and the board require the organization to be more than fast — they need it to be nimble. Being fast isn't helpful if the organization is headed in the wrong direction. GRC enables decisions and actions that are quick, coordinated and well thought-out.

Agility allows an entity to use GRC to its advantage, grasp strategic opportunities and be confident in its ability to stay on course.

 The best-laid plans fail. Organizations need to be able to bounce back quickly from changes in context and risks with limited business impact. They need sufficient tolerances to allow for some missteps and have the confidence necessary to adapt and respond to opportunities rapidly.

"Resilience is key," says Lisa Bougie, speaker at Diligent Institute's Elevate Leadership Summit. "To build resilience, an organization needs to both acknowledge known risks and appreciate the reality of uncertainty. Scenario planning can help to ensure an organization is as prepared as possible when the unexpected hits."

 They build business muscle and trim unnecessary expense from duplication, redundancy and misallocation of resources — making the organization leaner overall with enhanced GRC capability and related decisions about resource application.

Discover how modern platforms unify governance, risk and compliance oversight for board-level decision making.

Enhance your GRC integration

How boards can enable organization-wide GRC excellence

Beyond setting strategic direction, boards must create organizational conditions that enable effective GRC execution.

This requires establishing governance structures, allocating resources appropriately, ensuring management accountability and continuously evaluating program effectiveness.

Boards should define explicit accountability for governance, risk management and 

 activities across the organization. This includes clarifying:

Which executives own specific GRC domains

What escalation paths exist for significant issues

How information flows from operational activities to board oversight

Effective governance structures also address committee responsibilities. Many boards are reevaluating committee structures to ensure they don't overburden audit committees with expanding GRC responsibilities.

Diligent’s 2025 Risk and Opportunity Outlook report

 emphasizes that "the winners will be the companies that recognize that risk and opportunities need to be standing discussion topics on the board agenda. Think about changing your committee structure to reflect this — and make sure that you aren't throwing everything under the Audit Committee's purview."

Ensure adequate capabilities and technology

 that provide boards with real-time visibility into risk exposure and compliance status.

The What Directors Think 2025 survey reveals that 37% of directors believe implementing new tools and technology at the board level would help modern boards function better, ranking third among all potential improvements.

"Tell the board what they need to know, not what you know," says David Platt, Chief Strategic Development Officer at Moody's.

This principle recognizes that boards need synthesized intelligence delivered through technology platforms that aggregate data from across the enterprise and present actionable insights rather than overwhelming detail about departmental activities.

Create feedback loops for continuous improvement

Board-driven GRC requires mechanisms for learning from incidents, near-misses and changing conditions.

Organizations should establish processes for capturing lessons learned, updating risk assessments based on new information, and adjusting governance structures as business strategy evolves.

"2025 is the year we put the 'G' back in ESG," notes Pav Gill, CEO of Confide. "The strongest defense against emerging risks lies in sound, well-structured governance systems."

The takeaway? Governance infrastructure creates the foundation for effective risk management and compliance — not the reverse.

Effective GRC requires partnership between boards and management rather than adversarial oversight relationships. Boards should create environments where management feels comfortable escalating emerging risks, admitting uncertainties and requesting resources for capability development.

The What Directors Think survey reveals shifting board information needs. Beyond the CEO and CFO, 35% of directors want to hear more from the Chief Human Resources Officer, 31% from the Chief Marketing Officer, and 24% from the Chief Technology Officer.

This diversification of board-management dialogue reflects the expanding scope of GRC oversight beyond traditional financial and legal domains.

For boards navigating today's complex GRC landscape, AI-powered governance platforms provide the integrated visibility and intelligence needed to fulfill oversight responsibilities effectively.

These solutions address the fundamental challenge where most organizations maintain siloed GRC and finance systems, preventing comprehensive risk visibility.

Unified GRC visibility for strategic oversight

 delivers comprehensive GRC capabilities that integrate board management, enterprise risk management, compliance tracking and audit activities in a single unified interface.

This consolidation enables boards to see how governance decisions impact risk exposure, how compliance obligations constrain strategic options and how risk-taking aligns with approved objectives.

The platform's board-ready reporting templates synthesize data from across the enterprise into actionable intelligence.

AI-powered analytics identify significant patterns, emerging threats and risk appetite deviations that require board attention, rather than overwhelming directors with operational detail.

AI-enhanced board meeting preparation and decision support

 transforms board engagement with GRC oversight through AI-powered preparation capabilities. Smart Risk Scanner automatically identifies risky language and legal red flags in board materials before meetings, while Smart Prep Insights generates pointed questions by topic with supporting citations.

Additionally, Smart Builder reduces board preparation time, eliminating manual compilation burden and enabling boards to focus meeting time on substantive GRC discussions.

The board's role in leading and enabling GRC

Ten insights shaping boards in the year ahead

Boards entered 2025 facing rising risk, economic volatility, and an urgent mandate to modernize oversight. At Diligent, we recently hosted the Elevate Leadership Summit, a by‑invitation gathering of corporate directors and executives alongside a curated set of experts, for confidential, Chatham House Rule-style discussions to dissect these issues and look to the future of corporate governance.

Across sessions, a clear through‑line emerged: the most effective boards are shifting from moving from passive oversight to active, data‑driven governance with disciplined processes and human judgment at the center. Here’s what our expert speakers and experienced director attendees had to say about the trends to watch out for in 2026:

1) From passive to active GRC—augmented by AI

Active GRC is replacing passive oversight as directors confront increasing risk and low confidence in near‑term conditions. Speakers suggested augmenting teams with AI agents to handle foundational tasks and “ask the next question,” freeing leaders to focus on strategy amid resource constraints.

2) AI governance: Measure what people actually do 

The biggest AI risk isn’t only technical, it’s invisible usage. AI governance should incorporate real usage metrics, not just periodic sentiment surveys, and pair cultural encouragement (safe experimentation and knowledge‑sharing) with “lighthouse” projects that prove measurable value to employees and shareholders.

3) Culture oversight is expanding and needs better data

Board oversight of culture has outgrown legacy tools. Public trust continues to concentrate on employers and brands, and employees increasingly make choices based on societal beliefs. Activism is rising, and many boards still haven’t discussed company stances on social issues. Our speakers discussed the possibility of utilizing a broader range of anonymized unstructured data - such as employee intranet messages and chat data - into decisio useful insights, while ensuring individual employees aren’t being singled out or retaliated against for escalating concerns.

4) AI literacy and security remain non‑negotiable

Boards need AI literacy and strong cyber foundations; there’s no leapfrogging weak security into trustworthy AI. Keep a human in the loop, test for bias systematically (using available benchmarks), and consider experimenting with smaller models and improved licensing terms where they fit the use case and data‑governance needs.

Early red flags require pre‑defined protocols, not improvisation. The first 72 hours following a crisis event should trigger escalation playbooks, evidence preservation (including email freezes), independent counsel where appropriate, and non‑retaliation toward whistleblowers, all paired with board‑level visibility and documented independence.

Continuous monitoring (increasingly AI‑enabled) can surface fraud risk indicators earlier, narrowing the expectation gap around what audit and compliance actually do.

6) Speak‑up culture is a strategic asset

A speak‑up culture with higher hotline usage is a positive signal, but only if organizations close the loop, protect anonymity, and report metrics to the board. Leaders should be encouraged to normalize and celebrate reporting, which reduces fear and builds trust across the enterprise.

7) Board-executive dynamics are shifting under scrutiny

Executives are pushing for director refreshment, and more of them see boards overstepping compared to last year. Meanwhile, CEO turnover is up, with most U.S. departures described as unplanned. These themes raise the premium on preparedness, role clarity, and disciplined engagement between boards and management.

8) Succession planning must be continuous and robust 

Effective succession planning should be continuous and discussed at every meeting, with directors knowing the pipeline at least one level down and preparing for unexpected transitions – including mission-critical roles beyond the CEO.

The board chair’s (or independent lead director’s) role in tone‑setting and inclusion is pivotal. Boards can benefit greatly from periodic third‑party evaluations to raise effectiveness.

9) Executive compensation is evolving amid volatility

Executive compensation committees are recalibrating discretion, which allows boards to award compensation based not only on results, but qualitative assessment. COVID‑era lessons showed shareholders tolerate discretion in executive compensation when the rationale is strong and disclosure is clear.

Executive security as part of the compensation package is rising as a governance and risk issue; Policy and regulatory discussions happening at the SEC point to potentially simpler disclosures as early as the 2027 proxy season, while state‑level rules are reshaping proxy‑advisor practices.

10) Better questions and diverse composition strengthen oversight

Directors who ask, “What do I need to understand?” and “Do I have all the information?” sharpen risk oversight. Building formal and informal trusted channels with audit and compliance leaders can improve signal quality, while targeted training helps boards recognize fraud indicators. Evidence that boards with a broader range of perspectives are more effective highlights the value of having a well-balanced and diverse composition.

The year ahead will reward boards that operationalize judgment: clear protocols for crises, richer data streams on people and culture, pragmatic approaches to compensation, and step‑wise AI adoption that starts with the reality of how employees are using it. The common denominator is disciplined curiosity. The best directors will ask better questions, measure what matters, and adapt faster.

If these insights resonate with your board or leadership team, consider a structured review of your speak‑up mechanisms, succession playbooks, culture data sources, and AI governance metrics to ensure they’re meeting today’s pace of change. Then, pick one “lighthouse” initiative to prove value within the next two quarters and use the learning to scale.

Note: The Elevate Leadership Summit is an annual, by‑invitation gathering of corporate directors and CEOs, alongside a curated set of experts, for confidential, Chatham House Rule-style panel discussions.

Top board trends in 2026

This article originally appeared in our November 6 edition of the Diligent Minute Newsletter. For more insights like these, delivered straight to your inbox, subscribe

Cyber threats, AI disruption, and geopolitical instability are reshaping the audit landscape — and 4,000 audit leaders across 131 countries have weighed in. Whether you’re on the internal audit team, serving on your board’s audit committee, or working in partnership with them, the IIA’s 2026 Global Risk in Focus report has insights for you. This year’s edition reveals the key risk areas
to focus on and highlights how risk is changing across regions and sectors (with tips on how to achieve compliance with updated 

2026 Global Risk in Focus: Top risks for internal audit (Cybersecurity, AI, Geopolitics)

 remains the number one concern for organizations worldwide, with 73% of respondents naming it a top five risk. 

pronounced in North America and Europe, where more

than 80% of organizations put it at the top of their list.

, has seen the second largest jump in perceived risk with an increase of 9 percentage points year-over-year. Organizations are racing to implement new technologies,
but many are running into infrastructure and skills gaps.

3.Geopolitical uncertainty leapt 10 percentage points 

globally, now ranking sixth overall. North America saw the sharpest spike (up 19 points), driven by shifting U.S. trade policies and global conflicts.

4.Business resilience (47%) and human capital (43%) round out the top global risks.

 Organizations are feeling the pressure to shore up supply chains and crisis response capabilities. Meanwhile, talent shortages, wage competition, and generational shifts keep human capital risk firmly on the agenda. 

 Regulatory change (41%) is closely linked to geopolitical risk. Where political uncertainty is high, regulatory challenges follow.

How audit committees can close the risk-to-audit gap

I asked Curtis Warfield, experienced public company director, Audit Committee Chair, and former Chief Audit Executive, his thoughts on bridging the risk-to-audit gap. He outlined five steps:

“As an Audit Chair, I see the gaps as driven by limited expertise in emerging areas like AI and digital disruption, audits taking longer than planned, and the need to balance enterprise-wide coverage with limited resources.” says
Warfield. 

“It’s a risk–reward trade-off,” he goes on. “Sometimes management also has major deliverables in progress, which limits timing for audits. Audit committees can help by understanding these constraints, supporting skills development, and encouraging dynamic adjustments to the plan when new or fast-moving risks emerge.”

“Internal audit should not just police — it should partner,” says Warfield. “The key is alignment with senior leadership so internal audit can help ensure technology risks are managed without slowing innovation.” He adds, “Audit leaders should focus on being strategic partners, not just reviewers, and work closely with the business to embed technology risk considerations into
transformation projects from the start.”

Audit committees add the most value when they understand the process behind the audit plan. “Members should take time to learn how the ERM process connects to strategy and how audit allocates time across the risk
profile,” advises Warfield. “That understanding makes it easier to have meaningful dialogue about priorities. Regular communication and progress updates help keep the plan dynamic and aligned with emerging risks.”

4.Support advisory work while maintaining independence

“Tone at the top is critical,” Warfield emphasizes. “The audit committee and board chair can reinforce that internal audit’s role is not to police management, but to be a strategic partner while maintaining independence. It’s a delicate balance — audit must still provide objective assurance, but it can also offer valuable advisory input on AI governance,

, or scenario planning. Clear boundaries and communication make both roles possible.”

5.Build an agile, forward-looking partnership

Agility starts with alignment. “Everyone should understand the audit process, how it ties to enterprise risk and strategy, and how resources are deployed,” says Warfield. “The audit committee should be willing to adjust its agenda
throughout the year for new risks and ensure flexibility in hours and resources to respond to change. That’s how audit and the board can stay proactive and effective in uncertain environments.”

Looking to stay ahead of the curve on audit governance? Check out the 

IIA’s new Center for Audit Committee Leadership. 

The Center offers audit committee members tailored strategic advice, best practices, and educational resources to help ensure internal audit functions are effectively structured and integrated within your organization’s governance framework.

Diligent

Blog

20 years of BoardEffect: Reflections on the past, focused on the future

The board's role in leading and enabling GRC

Your Data Matters