How it works
An independent check, built from records you already have.
One cycle takes a few weeks. Nothing is installed, nothing is connected to your systems, and directors spend about ten minutes each.
Directors answer, confidentially
Each director completes a short questionnaire on oversight of cyber, fraud, BSA/AML and AI, and rates their confidence in each answer. Responses are pooled, so no one, including management, sees any individual director's answers.
The record is gathered
Your coordinator sees everything the review needs on one page: board packets and minutes, policies, test and exam reports, the cyber insurance policy and application, the risk register and asset counts. Each item goes to the person who holds it, with a due date. We send the requests and reminders and tell the coordinator if anything is late. Last cycle's answers carry forward, so only what changed needs updating.
The accounts are compared
What directors believe is compared with what they have been told, what testing has found and what management tracks. All of it is also checked against the commitments in management's own policies. Every gap is recorded with its source: reports that disagree, policy commitments missed or measured differently, and reporting that falls short of what the board should receive.
A named person reviews every finding
No finding reaches the board until a named reviewer has signed off on it. Each one cites document, date and page it rests on.
The board receives its readout
The readout shows where the board stands, how it compares with peers, and each risk area on one card. Key insights set each risk out, then options to address it. It also shows which policy commitments the board can and cannot see management keeping. Action plans list what to act on now, questions for management, actions with owners and dates, and work to consider, with time and complexity but never cost.
Four risk areas, read the same way
Cyber and resilience
The information security program, testing, incidents, vendors, recovery and insurance.
Fraud
Losses, controls, account takeover and how fraud reporting lines up with cyber reporting.
BSA/AML
The program the board approves, its independent test, and how its figures reconcile with the fraud report.
AI and models
Where AI is in use, how it was approved, and what the board hears about it.
What BoardAlign deliberately does not do
Staying inside these lines is what keeps the result independent and useful.
- It is not an audit, and it gives no opinion on whether a control works.
- It does not certify compliance with any regulation.
- It does not remediate, manage or sell security services.
- It needs no access to your systems, networks or member and customer data.
Credit unions and banks
For credit unions the record is read against 12 CFR Part 748 and NCUA guidance. For banks it is read against the safeguarding standards set by the bank's regulator (OCC or FDIC for almost all banks), the BSA program rules, and the 36-hour incident notification rule. Where a standard is recognized practice rather than a rule for your charter, the readout says so in those words.
See it applied to your board.
A short conversation is the fastest way to see whether it fits.