What board-ready governance means, and how a school gets there
Board-ready governance is a chain of records where every link is owned, and where the board can follow a risk from the register to the decision it produced, on a day when the school is busy with everything else.
Board-ready governance is a school's accountability spine: a board-reportable risk register whose controls and treatments have named owners, whose owners receive actions, whose actions return evidence, whose evidence feeds assurance and reporting, and whose reports lead to governed decisions recorded as resolutions.
What we keep hearing
It is the Wednesday before the board meets. The chair has the pack open on her phone, the risk section is a snapshot stitched from an export, and the question she wants to ask has no obvious owner. The principal will read it tonight, after the incident report and the parent meeting. A control promised by email in term one has nobody minding it, and the register behind it was last opened before the previous meeting. Somewhere in that week, the board still has to decide on what is true. This is the room where the chain holds.
David Ruggiero, Principal, Blackfriars Priory School: "School governance and risk is a complex area without a clear solution, a time-poor disconnect with governance and risk management that relies on Frankenstein models of electronic and paper-based reporting and measuring."
A risk register the board can read
Board-ready starts with a register that is real, not a tick-box exercise, and that is kept separate from the operational assessments staff write for excursions and equipment. In EthosOne the organisation sets its risk categories, impact definitions and governance-approved appetite statements once, the likelihood and impact scale is agreed at onboarding and then held read-only, and separate registers for board, ICT, AI and operational risk share that language. Each risk records cause, event, consequence, owner, category and inherent and residual likelihood and impact, and a risk whose residual score sits above appetite says so. Snapshots preserve the baseline the board saw last time. Risk management
Controls and treatments with named owners
A residual score means nothing without the controls that earn it. A control is what already reduces exposure; a treatment is planned work to change it further. Each carries a named owner, a status and a due or review date, and the register warns when no controls have been recorded for a risk. Ownership is what turns a register into a governing mechanism. ISO 31000 risk registers
Owners who receive actions
Control and treatment work shows in each owner's accountability dashboard, alongside their actions from strategy, compliance, meetings and projects. Every action shows its owner, who delegated it and its due date, and a read-only audit history records who changed what and when. Group Actions gives boardroom owners one portfolio view across entities. Actions
Actions that return evidence
An action closes when its completion conditions are met, with evidence attached where the source requires it, and the evidence returns to the risk, obligation or decision that asked for it. Structured assurance logs capture recurring observations, exceptions and forms under one schema with a history of every edit, and the File Vault holds the exact governed version a record relied on. Assurance logs and forms
Evidence that feeds assurance and reporting
Reports assemble from live risk, compliance, strategy and governance records rather than pasted extracts. The author chooses the sources, entities and period, and every report names its organisation, entities, filters and as-at time. Board packs are then assembled, reviewed, approved and published as one fixed version, with contributions allocated to source owners. Reporting and board reports and packs
Reports that lead to governed decisions
The last link is the decision. A resolution captures exact text, mover, seconder and governing body before a vote, records the outcome as Carried or Lost, and links the actions it creates, with review dates for time-bound decisions and versioned amendment or rescission later. A decision made in the boardroom becomes owned work, and the spine begins again. Meetings and resolutions
See how these principles become a live operating model in school governance software for independent schools.
Along the whole chain the helper knows your context and drafts what you need.
- Risk, control, treatment and appetite wording with its rationale.
- Action language and success criteria.
- A summary of what moved between two register snapshots.
- Report narrative tied to the frozen source manifest.
- Resolution wording ready for the secretary to edit.
It cites the record it read. Judgement stays with people. The helper cannot change scoring or calculate a rating, cannot accept a risk, cannot mark an action complete, cannot alter a published pack, and is unavailable for a vote's eligibility or outcome.
Frontier AI, hosted via Amazon Bedrock in AWS Sydney and Melbourne.- Stored in AustraliaAWS Sydney and Melbourne, one database per school
- AI stays in the country tooAmazon Bedrock; never trained on your content
- Published, not describedTrust Centre · ISMS policy · How we handle your data
The six we are asked every time.
Still weighing something up? Thirty minutes with us, on your own registers, answers the rest.
Take the AI maturity assessment01What is board-ready governance?
A state where every material risk has an owner, every control and treatment has an owner and a date, the resulting work returns evidence, reports are generated from those records with provenance, and decisions are recorded as resolutions that create the next work. The test is whether a director can follow any line in the pack back to its source.
02What should a school board see each meeting?
Which risks sit above appetite and what changed since the last snapshot; which treatments are overdue and who owns them; what evidence came back and what is outstanding; compliance exceptions rather than a blended score; and the decisions the meeting is being asked to make, with the resolution text ready.
03What is the difference between a risk register and a risk assessment?
A risk register is the board-reportable view of strategic exposure, appetite and response, owned by named people. A risk assessment is an in-situ evaluation of one activity, excursion, piece of equipment or situation, with hazards, controls and a responsible person. EthosOne keeps them apart so an excursion assessment is never presented to the board as the school's risk position.
04How often should a board review the risk register?
At every scheduled meeting, against the previous snapshot, so the conversation is about movement and overdue treatments rather than the whole register. Appetite statements and categories are reviewed with the strategy cycle, since they define what the board is willing to accept.
05Is board-ready governance a product or a standard?
A standard. EthosOne is built to help a school reach and hold it, and this page is the definition we work to.
06Board-ready governance for schools, defined, in full: what does it cover?
EthosOne, governance, risk and compliance software built only for schools, is built around that spine, so a chair, principal or business manager can trace any board question back to a source record with an owner and a date. The register and evidence live in the Risk and Compliance focus module; actions and reporting are part of Core; the decision record sits in Board Engagement. Board-ready in 30 days means that within thirty days of starting, your State's registration framework and obligations are loaded, your risk and compliance registers hold named owners and review dates, and your first board pack is produced from that live record rather than assembled by hand. If it is not, you do not pay until it is.
What are the AI paragraphs you are currently missing from your policies? Watch how we do it.
Free, under ten minutes, and yours to keep whether or not you talk to us.
More free templates and tools
AI Risk Register
Free AI Risk Register for independent schools: AI-Risk-Register.xlsx with a worked example, a four-page How-to and the What-next brochure for EthosOne Risk Management. Twelve AI risks on your register before the board asks.
Your next five edits
Regulators rarely ask a school for a new document. They ask for a paragraph in one the school already holds. Answer five questions and watch PolicyAI draft each paragraph against the provision it rests on, with your school's name written in.
Strategic Plan
Free Strategic Plan for independent schools: Strategic-Plan.xlsx with a worked example, a four-page How-to and the What-next brochure for EthosOne Strategy and Improvement. Mission to activity to KPI, in one cascade.
Risk Appetite Statement
Free Risk Appetite Statement for independent schools: Risk-Appetite-Statement.docx with a worked example, a four-page How-to and the What-next brochure for EthosOne Risk Management. Nine sentences your board can vote on.
We would be glad to spend a day with your leadership team,no licence and no obligation
Defines board-ready governance as the accountability spine from risk register to governed decision, link by link.