Perspectives from both sides of the board table

Boards govern off financial statements, yet an accountant’s involvement does not always carry the same weight. The difference between an audit and a review is not an accounting technicality — it is a governance decision about how much confidence to place in the numbers in front of you.

An audit provides reasonable assurance: a high, but not absolute, level of confidence that the statements are free of material misstatement. The auditor tests transactions, inspects documentation, confirms selected balances with outside parties, and evaluates estimates and relevant internal controls before expressing an opinion on whether the statements are fairly presented. No audit catches every error or instance of fraud.

A formal audit must be performed by an independent Certified Public Accountant (CPA) or a licensed public accounting firm. CPAs answer to the AICPA and state boards of accountancy and must work under Generally Accepted Auditing Standards. Banks, bonding companies, investors, regulators, and grantors generally accept audited statements only when a licensed independent CPA signs them — that signature is what gives the opinion legal and fiduciary weight, and independence is what makes it objective.

A review provides limited assurance. The accountant mainly questions management and runs analytical comparisons, generally without testing records, confirming balances, or evaluating controls. The report says nothing came to the accountant’s attention suggesting the statements need material modification — meaningful, but far narrower than an audit opinion.

Cost should not decide the engagement. A review is often practical when limited assurance meets stakeholders’ needs; an audit may be appropriate — or required — because of debt, restricted or public funding, complex transactions, or lender and legal requirements. The audit or finance committee should weigh those questions with management and the independent accountant, document its reasoning, and revisit the decision as circumstances change. This discussion is educational; make the final call with a qualified independent accountant and counsel.

An effective board meeting is not measured by how many reports directors hear. It is measured by whether the board uses its time to exercise judgment on the issues that matter most.

Routine updates are necessary, but directors can often review them before the meeting. That leaves more time together for questions, differing perspectives, and decisions that benefit from the board’s collective experience.

The pressure on board agendas makes that choice increasingly important. In a 2025 NACD survey, 74 percent of directors said the number of agenda topics had expanded, and 73 percent reported more issues requiring monitoring than five years earlier. A 2024 McKinsey survey of 913 directors and executives found that two-thirds of directors believed the complexity of board responsibilities had increased over the preceding two years.

A useful agenda therefore starts with a question: What needs the board’s discussion, rather than simply its attention? Meeting time should be reserved for matters such as strategic priorities and major organizational challenges; assumptions that need to be tested; opportunities to improve performance, impact, or governance; significant risks, tradeoffs, and resource choices; and decisions that require clear direction and follow-up.

Reports should inform those conversations, not replace them. A consent agenda can help the board handle appropriate routine matters efficiently, provided directors receive the materials in advance and can request that an item be discussed separately. Presenters can then focus on exceptions, emerging concerns, and decisions the board needs to make.

This does not mean looking backward has no value. Understanding results is essential. But the most valuable discussion asks what those results mean for what comes next: What is working? What needs to change? Where should the organization direct its attention and resources?

When a board builds its meetings around those questions, it does more than work through an agenda. It turns limited time together into better oversight, clearer decisions, and stronger direction for the organization.

Many boards close their agenda with a single line covering weeks of decisions: a resolution affirming that everything directors and officers did since the last meeting was carried out in good faith and with reasonable care. If your board has one, you have probably never questioned it. If it doesn’t, someone will eventually suggest it. No law requires it. It is a governance choice, worth making deliberately rather than inheriting. The wording usually reads something like this:

What it actually does is ratify. It records that the board reviewed and accepted what officers and committees did between meetings. That record can matter: it shows oversight was exercised, which is the substance the business judgment rule protects; it closes off later arguments that an officer exceeded delegated authority; and it reinforces fiduciary norms where delegation is informal. Nonprofits, service clubs, and smaller corporations get the most from it.

Most of the time, though, the board already has that record. Officers act within authority the bylaws set. Committee decisions come forward for approval. Significant actions are documented as they happen. Where that is true, a blanket affirmation adds a line to the minutes without adding oversight — and a resolution routine enough to be adopted without being read is not doing the protective work it is meant to do.

So the question is not whether to include it, but what the board wants its record to show. Where officers act often between meetings, where authority boundaries are still settling, or where the board wants to state plainly that it is paying attention, a periodic affirmation — quarterly, annually, or whenever significant action has occurred — makes sense. Where it does appear, keep it short, place it near the end of the agenda, and let a director ask questions rather than wave it through.

Whether any resolution belongs on your agenda depends on your bylaws, your delegation practices, and your state law. Treat this as a starting point for a conversation with your secretary and counsel, not a compliance template.

Artificial intelligence can help corporate and nonprofit boards prepare more efficiently, analyze complex information, identify emerging risks, test strategic assumptions, and ask sharper questions of management. It can also streamline agendas, meeting summaries, follow-up tracking, and director education, giving boards more time for strategy, oversight, and informed debate.

Adoption is already accelerating. Morgan Stanley reported in August 2026 that 68% of S&P 500 companies had at least one non-executive director with AI skills, while 41% of executives in a separate survey identified human review in higher-risk situations as the most important guidance for employees using AI. These findings reinforce the central governance principle that AI should enhance — not replace — human judgment, ethics, and accountability.

Boards should establish approved uses, protect confidential information, validate material outputs, require human review of consequential decisions, and begin with a few low-risk, high-value applications before expanding as their knowledge, controls, and confidence grow.

One of the most immediate applications is board preparation. AI tools can summarize lengthy board packets, compare current reports with prior versions, identify changes in assumptions, and extract decisions, risks, and unresolved questions. A director serving on the audit committee could receive a briefing focused on financial controls and risk indicators, while another director could concentrate on strategy, talent, or customer issues.

AI can also help shape agendas around strategic priorities, summarize meeting discussions, and track follow-up commitments. These applications should not replace careful reading or the corporate secretary’s governance responsibilities. Their value lies in reducing administrative burden so directors can spend more time debating the matters that require experience, perspective, and judgment.

Real-World Example: Diligent reports that ELCO Mutual Life and Annuity reduced board-preparation time from one or two days to one or two hours after adopting Diligent Boards. Diligent attributes the improvement in part to AI-powered board-book summaries and automated meeting minutes. ELCO’s general counsel also reported that executive committee meetings fell from roughly two and a half hours to an average of 30 minutes, crediting agenda time limits within the broader platform. Because the performance claims come from Diligent’s customer materials, they should be treated as vendor-reported rather than independently validated.

AI can expand the board’s ability to evaluate strategic choices — organizing market intelligence, testing assumptions, and developing scenarios across economic, regulatory, technological, or workforce change. When management presents a major investment or acquisition, AI-assisted analysis helps directors explore alternative outcomes and surface questions a traditional presentation might miss.

The same capabilities strengthen risk oversight: detecting anomalies in financial and operating data, monitoring emerging threats, and connecting risk indicators across the enterprise. But the board should govern AI as enterprise transformation and risk — not merely an IT project — with visibility into where AI is used, what value it is expected to deliver, who is accountable, and how outcomes and risks will be measured.

Real-World Example: PwC’s July 2026 guidance advises boards to oversee AI as an enterprise transformation, not a technology initiative, and identifies six areas for attention: governance and accountability; strategic positioning; talent and culture; the evolving workforce; risks and controls; and monitoring outcomes and risks. This is professional guidance, not evidence of outcomes at a particular company, but it offers a credible framework for board questions and oversight.

AI offers new ways to develop directors and executives — personalized learning plans, explanations of unfamiliar topics, questions for management presentations, and simulated boardroom situations involving strategy, ethics, cybersecurity, or crisis response. Directors can practice reasoning through difficult choices before facing them in real time.

For executives and emerging leaders, AI can support coaching, role-play challenging stakeholder conversations, and suggest development activities tied to defined competencies. It can make learning more accessible and responsive, but it should not make employment decisions or replace the context, empathy, and accountability of experienced leaders and coaches. Confidentiality is especially important whenever leadership assessments or employee information are involved.

Real-World Example: Advantexe describes an AI Board of Directors debriefing tool embedded in its business simulations. Participants present their strategy, decisions, and results to AI personas with perspectives such as finance, marketing, operations, ESG, and innovation; the personas challenge assumptions and provide immediate feedback. The example confirms that this type of simulation is commercially offered, but Advantexe’s article does not provide independent outcome data demonstrating improved on-the-job performance. It is best presented as an illustrative learning application, not proof of effectiveness.

Boards need not become technology experts, but every director should develop enough AI literacy to understand its opportunities, limitations, and risks. Governance should define approved tools and uses, protect confidential and personal information, require validation of important outputs, and establish escalation procedures when results appear inaccurate, biased, or inconsistent with company values.

Board and committee responsibilities should be explicit — oversight may involve the full board as well as audit, risk, technology, compensation, or governance committees. Management should provide regular, forward-looking reporting on major AI initiatives, investments, incidents, workforce effects, and performance. The goal is not to slow innovation but to ensure it advances strategy without creating unmanaged risk.

A practical starting point is two or three low-risk applications — summarizing public information, preparing director education materials, or generating questions for strategic discussion. Establish safeguards, test the outputs, measure whether the tools improve board effectiveness, and expand only after the organization learns what works.

Real-World Example: Microsoft, Google, and IBM each publish first-party materials describing how they organize responsible-AI development and deployment, with documented practices including governance roles, risk assessment, human oversight, testing, documentation, monitoring, feedback, and accountability across the AI lifecycle. These are self-reported and do not independently establish how consistently or effectively every practice is implemented. The NIST AI Risk Management Framework 1.0 adds an independent, voluntary structure organized around four functions — Govern, Map, Measure, and Manage — for managing AI risk.

The assignment was to determine whether a nonprofit conference’s final profit-and-loss statement, balance sheet, and several months of bank statements told the same story. The records covered more than 12 months of activity, from early planning through the event’s completion. The goal was not simply to compare ending balances, but to understand and explain the differences among the financial reports and the underlying cash activity.

I gave an AI model the statements and asked it to review them, reconcile the information, and identify discrepancies, with follow-up prompts on timing issues such as delayed accrual transactions. Within about 20 to 30 minutes, I had a structured analysis that gave me a strong starting point for the final report. The AI organized the information, highlighted inconsistencies that required closer investigation, and created tables that made the findings easier to understand and communicate.

The value carried through to the writing. After drafting the report, I had the AI review the narrative for duplication, clarity, and conciseness. That second pass turned the financial analysis into a more polished document — one that presented the key issues clearly without overwhelming readers with unnecessary detail.

What did the AI do well? It compared information across several financial documents quickly, flagged differences that warranted deeper review, helped isolate timing and accrual-related explanations, and organized the findings into a logical reporting structure. What it did not do was replace judgment. Every finding still required human review, and every discrepancy had to be evaluated in its organizational and accounting context. The technology performed much of the heavy lifting, but responsibility for validating the information, judging whether the explanations were reasonable, and approving the final conclusions remained with people.

For nonprofit leaders and boards, the lesson is straightforward. AI can make financial review faster, more organized, and more accessible — helping leaders focus their attention on the exceptions, explanations, and decisions that matter most. But it is a decision-support tool, not a substitute for sound controls, professional expertise, or board oversight. Used thoughtfully, it shortens the path from raw financial records to a clear, useful report. The result is not automated accountability, but better-informed human accountability.

AI is changing how leaders work and how they learn. It can summarize information, identify patterns, generate alternatives, and provide immediate support before a difficult conversation — extending customized development beyond a small group of senior executives. Leaders can use it to test assumptions, explore unfamiliar issues, and prepare for new responsibilities.

Yet AI cannot set aspirations, earn trust, understand the full human context of a choice, or accept responsibility for the consequences. The strongest leaders will use AI to think with them, not for them. Development must combine digital fluency with curiosity, ethical judgment, empathy, and discernment — the ability to ask useful questions, evaluate AI responses, recognize missing context, and know when human expertise must take precedence.

Organizations should first define the capabilities their strategy requires, then determine where AI can help. Effective development combines AI-enabled practice with feedback, real-world assignments, mentoring, coaching, and reflection.

Real-World Example: The Center for Creative Leadership uses its HiFi Conversation Analytics™ tool in a senior-leadership business simulation. The technology measures patterns such as speaking time and interaction across the group, while human experts interpret the findings, supply context, and guide development — demonstrating how AI can make behavior more visible without replacing human judgment, wisdom, or connection.

Executive coaching traditionally depends on a confidential relationship between a leader and an experienced coach. AI offers a different kind of help: immediate support for reflection, difficult conversations, presentations, goals, and problem-solving. This accessibility can broaden development — managers who may never receive individual coaching can gain structured support between formal sessions.

But availability is not wisdom. AI sees only the information provided and may miss organizational history, culture, power dynamics, or blind spots. Its responses can sound confident while remaining incomplete or inappropriate. Human coaches build trust, notice patterns, ask uncomfortable questions, interpret context, and provide accountability. AI may be an effective sparring partner; a skilled coach understands the whole person.

A thoughtful model combines both: AI for preparation, repetition, and follow-through; a human coach for deeper insight, values, relationships, and consequential choices. Organizations should also establish clear rules for confidentiality, approved platforms, data storage, and human review.

Real-World Example: Microsoft partnered with Coachello to embed leadership skills into the daily work of more than 150 managers, giving them real-time support through a hybrid AI and human coaching platform in Microsoft Teams. Coachello reports that 90% of participants gained greater clarity about their development path. Because the performance claims come from Coachello's customer materials, they should be treated as vendor-reported rather than independently validated. The case illustrates the reach and immediacy of AI coaching while reinforcing the value of pairing technology-enabled support with human coaching for deeper context and accountability.

Leadership is often tested with little time to prepare — a crisis, a personnel issue, an ethical conflict, a major presentation, a decision under uncertainty. Instruction alone does not create readiness. Leaders also need practice.

AI can role-play an employee, customer, board member, or regulator. Leaders can rehearse difficult news, resistance to change, unexpected questions, and competing priorities in scenarios that adapt as the conversation develops. Practice can be repeated privately, tailored to a role, and scheduled close to the real event.

Still, a simulation is only as useful as its design. Weak scenarios can reinforce poor assumptions, and automated feedback may miss context, credibility, timing, or effects on real people. Confidential information should be excluded unless both the platform and process are approved. Organizations should define clear learning objectives and pair simulation with human observation or debriefing — the key question is not whether the leader completed the exercise, but what was learned and what will change.

Real-World Example: ZEALAXX AG uses Retorio’s AI-powered leadership simulations to help leaders rehearse workplace conversations and receive immediate, personalized feedback. Platforms such as Retorio and Virti allow managers to practice performance reviews, conflict resolution, difficult feedback, and other high-stakes situations repeatedly in a private environment before facing them at work. Because the performance claims come from Retorio’s customer materials, they should be treated as vendor-reported rather than independently validated. The applications demonstrate how simulated practice can build readiness and self-awareness when followed by thoughtful reflection and debriefing.

Leadership development often centers on an annual workshop, retreat, or cohort. These experiences matter, but leadership challenges rarely follow a training calendar — leaders need support while managing change, resolving conflict, or entering a new role.

AI can turn development into an ongoing practice through short learning activities, explanations, reflection prompts, and timely rehearsal. Learning can adapt to different roles, experience levels, and needs, translating broad competencies into practical actions leaders can try in daily work.

However, personalization should not become isolation. Leadership grows through relationships, shared experience, observation, feedback, and accountability — usage data alone does not prove that behavior or performance has improved. A strong model combines brief AI-supported learning with peer discussion, applied assignments, coaching, and reflection. Progress should be judged through observable behavior and business results, not completed modules.

Real-World Example: A Fortune 100 technology company developed “Knowledge Nuggets,” concise six-minute learning videos delivered directly through Microsoft Teams. AI and Microsoft Power Platform tools supported content development, personalized recommendations, automated delivery, and usage reporting. Because the performance claims come from a consulting partner’s case study, they should be treated as vendor-reported rather than independently validated. The initiative shows how development can move from occasional courses to brief, accessible learning embedded in the flow of work.

As AI becomes part of everyday work, leaders will manage systems in which people and intelligent tools contribute together. The first task is deciding what should — and should not — be delegated. AI may search information, identify patterns, generate options, or automate routine work; people remain responsible for context, relationships, value conflicts, and consequential judgments.

Leaders must also evaluate AI-supported recommendations — a polished answer is not necessarily a sound one. They should explain why AI is being introduced, how work may change, and where employees can raise concerns. Trust will depend on fairness and transparency as well as performance.

Real-World Example: Bank of America’s EricaAssist works alongside more than 18,000 customer-service representatives during client conversations. The AI summarizes why a client is calling, surfaces relevant information, and recommends next steps in seconds, while employees remain responsible for listening, judgment, and the relationship. Bank of America reports the system reduces average call time by nearly one minute. Because the performance claims come from the company’s own announcement, they should be treated as company-reported rather than independently validated.

This series is educational and does not constitute legal advice; corporate law varies by jurisdiction, entity type, and circumstance, and directors should consult qualified counsel. The duty of care asks whether directors prepared, understood the material facts, tested management’s assumptions, and exercised independent judgment before voting. Courts applying the business judgment rule generally defer to informed, disinterested decisions made in good faith — even when the outcome is disappointing. Protection weakens when the record suggests grossly inadequate preparation, conflicts, bad faith, or a failure to deliberate.

Good process means receiving materials early enough to review them, identifying missing data and downside risks, asking direct questions and ensuring management answers, using independent expertise when needed, allowing adequate time for discussion rather than treating approval as a formality, and recording the principal issues considered and the reasons for the decision.

The duty of loyalty requires directors to place the interests of the corporation ahead of personal, financial, professional, or affiliated interests — beyond obvious self-dealing to undisclosed conflicts, misuse of confidential information, diversion of corporate opportunities, and conduct driven by an improper purpose. A conflict is not automatically a breach; the danger is an unmanaged conflict.

A director should disclose relevant facts promptly, follow the organization’s governing documents and applicable law, avoid influencing the process when appropriate, and permit disinterested decision-makers to act on a complete record. Before acting, ask: Do I or an affiliated organization have an interest? Have I disclosed all material facts? Should I leave the discussion or abstain? Would an objective outsider view the process as fair to the corporation?

Oversight is not passive. Under the line of Delaware cases associated with Caremark, directors must make a good-faith effort to establish board-level reporting and monitoring systems and must respond appropriately when warning signs appear.

Real-World Example: In Marchand v. Barnhill (2019), the Delaware Supreme Court found that allegations of no board-level food-safety reporting system could support an oversight claim against the directors of Blue Bell Creameries, where food safety was a mission-critical risk. The case underscores that for a company whose business depends on a particular area of safety or compliance, the board must ensure that area receives regular, board-level attention.

A practical oversight framework: identify mission-critical risks; assign responsibility across the board, committees, management, and advisers; set reporting expectations with useful metrics and escalation thresholds; track red flags and management’s response; and periodically test whether information reaches the board soon enough and whether actions are completed.

Cyber risk can disrupt operations, create financial and legal exposure, damage reputation, and weaken stakeholder trust. AI raises the stakes by making fraudulent messages, voices, and video more convincing. Boards should treat cybersecurity as enterprise risk: assign oversight, identify critical systems and third parties, connect technical exposure to business consequences, and require tested response and continuity plans.

Real-World Example: Attackers inserted SUNBURST malware into SolarWinds Orion updates distributed to customers in 2020. The SEC later alleged that internal assessments had identified serious weaknesses while public disclosures described risks more generally. A court dismissed most of the SEC's claims in 2024, and the SEC dismissed the remainder with prejudice in November 2025. The governance lesson is not the litigation's outcome: boards need a process that brings significant internal warnings forward, reconciles them with public disclosures, and tracks corrective action.

Most payment fraud starts with a message that looks like it came from someone you trust — a chief executive, a board officer, a vendor, a program director — asking for a wire, an invoice payment, or a reimbursement. The request always sounds urgent, and the urgency is the point: it exists to get money out the door before your financial controls can work. Attackers get there through look-alike domains, spoofed addresses, or a compromised mailbox that already holds the real conversation.

The scale is no longer marginal. The FBI’s Internet Crime Complaint Center recorded 21,442 business email compromise complaints in 2024, with adjusted losses of about $2.77 billion. Volunteer-led organizations are exposed for structural reasons: leaders use personal email for official business, a familiar name is treated as proof, event deadlines supply the urgency the attacker needs, one person can approve a payment, and nobody has bandwidth to check an unusual request. Those are governance gaps, not missing software.

Real-World Example: Save the Children Federation wired $997,400 to a fraudulent entity in Japan after attackers broke into an employee’s email, posed as that employee, and submitted false invoices for solar panels meant for health centers in Pakistan; insurance recovered all but about $112,000, and the loss surfaced in the organization’s IRS Form 990. In 2024, an Arup finance employee in Hong Kong transferred HK$200 million—about US$25.6 million—after a video call appeared to include the company’s CFO and colleagues who were deepfake impersonations. A familiar name, plausible paperwork, and a payment nobody independently verified is the whole mechanism.

The controls are not complicated. Adopt a written funds-transfer policy with no exceptions and no email or text overrides. Require two approvals for every transfer — the single step that prevents most losses. Refuse payment and bank-change instructions sent from personal accounts. Verify any request that is new, urgent, or out of pattern by phone or in person, using a contact already on file rather than a number inside the message. Use role-based addresses such as treasurer@ or finance@ instead of one person’s inbox, train directors and volunteers every year, and document each approval so the record protects everyone.

Controls fail without culture. Verification has to be normal rather than awkward: staff and volunteers must be able to question an instruction without offending a senior leader, and leaders have to model it by expecting to be checked. If saying “I need to confirm this before I pay” costs someone standing, the policy will quietly stop being followed.

Keep the detail where it can change. Authorization thresholds, verification steps, and vendor-onboarding rules belong in policies and procedures the board reviews and updates as the threat changes—not in bylaws. And the board should see the exception log, not only the policy: what was flagged, what was refused, and what slipped through.

Boards need useful governance information, not more technical detail. Directors should ask: Who is accountable? Which operations, systems, and data are critical? How are AI-enabled impersonation and payment fraud assessed? Which transactions require independent approval? How often are response and recovery plans tested? Which incidents and near misses reach the board? How are vendors and AI tools evaluated before and after deployment?

Real-World Example: MGM Resorts shut down certain systems after detecting a cybersecurity issue in September 2023, disrupting interconnected hotel and casino operations. MGM later estimated a roughly $100 million negative impact to adjusted property EBITDAR and less than $10 million in one-time expenses. The widely reported social-engineering attack on its IT help desk was not detailed in MGM's regulatory filing. The incident illustrates why authority, manual procedures, communications, financial tracking, and recovery priorities should be settled before a crisis.