Illustrative data. Meridian Valley Credit Union is a fictional institution.
Board evidence position
73 / 100
Established. Up from 41 last year.
Where the board stands
Evidenced and aware
The record supports what directors believe they have seen.
Against peers
Peer median 43
Ahead of 4 of 6 peers on evidence. Credit unions, $1B to $2B in assets.
Board metrics by risk area
Cyber and resilience needs attention first. Good looks like every bar fully green.
Cyber and resilienceStart here
5 of 7 figures outside the board's limit. Testing disagrees on one. 2 rest on management's figure alone.
2 within the board's limit, 5 outside it
Fraud
4 of 5 figures outside the board's limit. Testing disagrees on one.
1 within the board's limit, 4 outside it
BSA/AML
1 of 3 figures outside the board's limit. Testing disagrees on one.
2 within the board's limit, 1 outside it
AI and models
1 of 4 figures outside the board's limit, 1 near it. 3 rest on management's figure alone.
2 within the board's limit, 1 outside it
Findings, each with its source
- Two high-severity penetration test issues were reported to the board without their severitySource: External penetration test, February 2026, page 6; Q1 2026 board packet, page 17
- Incident response plan last approved before the mobile banking launchSource: Incident response plan, November 2024, page 1
- Directors are more confident about vendor oversight than the record showsSource: Director questionnaire (pooled); board packets reviewed for the period
Questions for the board to ask management
- What were the two high-severity issues in the February penetration test, and when will each be closed?
- Which risk register items are past the remediation window in our policy, and why were they not escalated?
- Where is AI in use today, and who reviews it?
This reports what the record shows. It does not say whether any control is effective.