Board Portal and Governance Software: When Directors Are Reading Three Different Versions of the Same Paper

Why board packs go wrong in the last 48 hours

The board meets Thursday. Papers were due to the company secretary on Friday. By Monday afternoon four of eleven have arrived. The finance pack lands Tuesday morning, the strategy paper Tuesday evening with a note that the numbers on page six are provisional. The secretary assembles a PDF, paginates it, and emails it to eleven directors. Wednesday at 11pm the CFO sends a corrected page six.

Now there are two packs in eleven inboxes, and one director downloaded the first to an iPad, annotated it on the train, and will arrive Thursday having prepared against a superseded number. A second director forwarded the pack to their assistant to print. A third is a non executive who sits on a competitor's board in an adjacent sector and has just received a paper about a transaction they should have been walled out of, because the distribution list is a group in the secretary's email client and nobody edits it under pressure.

Then the meeting happens. Minutes get drafted from the secretary's notes over the following fortnight, circulated by email for comment, revised, and approved at the next meeting, by which point the action from item seven has been forgotten by everyone except the person who did not do it. Attendance is recorded in the minutes. Declarations of interest are in a standing register that lives in a Word document updated annually.

Every part of that is common at organisations that take governance seriously. The cost is not usually a dramatic breach. It is decisions taken on inconsistent information, an action log that exists in three places, and a paper trail that will not stand up if a regulator or a litigant asks how a decision was reached.

Problem 1: the pack is a build process and email cannot manage it

Assembling a board pack is a production job with contributors, deadlines, formats, page limits and an order. Doing it by email means the secretary is a manual build server: chasing, converting, paginating, bookmarking, and reissuing when anything changes.

What a custom build does: papers are items with an owner, a due date and a status. Contributors upload against the agenda item, and the pack compiles itself, paginated and bookmarked, at any point. If a paper changes after distribution, the pack version increments and every director's device gets the new version with the change flagged, rather than a second attachment arriving beside the first. Directors keep their annotations across versions where the page still exists, which is the feature that decides whether they use the portal or go back to printing.

Diligent Boards and Nasdaq Boardvantage both do this well. If pack assembly is your only pain, buy one of them. The reason to keep reading is what sits around the pack.

Problem 2: distribution is a security control, and email is not one

Board papers are the most sensitive documents most organisations produce: transactions before announcement, executive remuneration, litigation strategy, regulatory correspondence, security incidents. They are read by non employees on personal devices, sometimes on aircraft, sometimes by people who serve on several boards.

Email cannot revoke. When a director resigns, their inbox keeps every pack they ever received. A shared drive is barely better, because access removal does not touch what was downloaded.

What a custom build does: documents are served, not sent. Access is per director per pack, revocable, and revocation reaches the device. Offline access, which directors genuinely need, is granted as an encrypted local cache tied to the app and the user, wiped when access is withdrawn. Every open is logged, so if a paper leaks you have a distribution record rather than a shrug. Personalised watermarking on each rendering is a modest deterrent and worth having. We will also be honest about a limit: you cannot reliably stop someone photographing a screen, and any vendor claiming otherwise is overselling. What you can do is make casual copying inconvenient and deliberate copying attributable.

Problem 3: minutes, resolutions and the register are three documents that should be one record

The meeting produces several artefacts that most organisations manage separately. Minutes drafted after the fact. Resolutions passed in the meeting or later by written consent. Attendance, including who joined for which items, which matters when a director recuses. Declarations of interest made at the meeting, which should update a standing register. Actions with owners and dates.

Managed separately, these disagree. The minutes say a director declared an interest and withdrew for item five, and the standing register was never updated. A written resolution passed by circulation in August is filed in a folder and never makes it into the minute book.

What a custom build does: the meeting is the record. Minutes are drafted against agenda items with the pack still attached, so the paper the decision was based on is one click from the decision. Resolutions are objects with a status, a voting record and where required an e-signature, whether passed in the room or by written consent. A declared interest at the meeting updates the standing register and can trigger the recusal that removes that director's access to the relevant paper. Actions become tracked items that appear on the next agenda automatically with their status, which is the mechanism that stops the action log rotting.

Problem 4: subsidiary boards and committees break the simple model

A single board with four committees is a straightforward access model. A group with a plc board, an audit committee, a remuneration committee, a risk committee, two regulated subsidiary boards with independent non executives, a joint venture board with partner appointees and a charitable foundation is not. Membership overlaps. A director on the group board must not automatically see the regulated subsidiary's papers. The joint venture partner's appointees see their board and nothing else.

Products aimed at a single board handle this with separate workspaces, which means separate logins, separate packs and a secretary administering several instances. OnBoard and BoardEffect are good tools that are shaped for that simpler world.

What a custom build does: one identity per person, membership per body with dates, and access derived from membership at the time the pack was issued. A director who leaves the audit committee in March loses access to April's papers automatically and keeps the record of what they saw before. Where a group already maintains an entity register, the board and committee structures should be sourced from it rather than typed twice, which is one of the strongest genuine arguments for building rather than buying.

Problem 5: retention and residency are policy questions the software has to answer

Minutes and resolutions are corporate records with statutory retention expectations. Board packs, working drafts and annotations usually are not, and keeping them forever is a liability rather than a virtue, because everything retained is discoverable. Most organisations have never applied a deliberate retention rule to board material, so nine years of packs sit in a portal.

Regulated boards often also cannot accept a shared cloud tenancy, or need data held in a specific country. That constraint alone puts some organisations outside what the major vendors offer.

What a custom build does: retention as a rule per artefact type, with minutes and resolutions retained per policy and drafts and packs expiring on a schedule with a documented exception process for anything under legal hold. Hosting goes wherever your regulator or your risk committee requires, including your own tenancy. If residency is your reason for building, say so early, because it changes the architecture and the cost more than any feature does.

What this costs and how long it takes

Across the 2,000-plus projects Digital Heroes has delivered, the shape here is this. A first release covering agenda and paper collection with contributor deadlines, versioned pack compilation, controlled distribution with revocation, and director annotation on web and tablet runs $80,000 to $160,000 and ships in 12 to 18 weeks. A full governance platform adding minutes drafting and approval, resolutions with e-signature, attendance and conflicts registers, action tracking, subsidiary and committee structures and retention rules runs $200,000 to $500,000 phased over 7 to 12 months.

What drives cost up specifically for board systems: native tablet applications with offline access, which is a genuine second and third build rather than a responsive web page, and directors will demand it. Self hosting or a specific residency, which adds deployment and operations work. The number of boards and committees, since the access model is where complexity lives. E-signature integration for written resolutions. And the security review itself, because a board portal will be examined by your own risk function and possibly your regulator, and penetration testing plus remediation is a real line item you should budget rather than discover.

What keeps cost down: launching on the main board and one committee, with a web application first and the tablet app in the second phase once the pack model is settled.

Build versus buy, and when buying is the right call

We will say this more plainly here than in most categories: buy, unless you have a structural reason not to. Diligent Boards is the market standard and it is expensive because it is genuinely capable and because board material is unforgiving. OnBoard is a strong mid market option with better usability than its price suggests. BoardEffect fits nonprofit and healthcare governance well. If your problem is that pack assembly is painful and directors read old versions, a product solves that next quarter and a build solves it next year.

Build when one of these is true, and they are structural rather than about features. Your regulator or your risk appetite requires data in a specific jurisdiction or in your own tenancy, and no vendor offers it on acceptable terms. Your group has enough boards, committees, subsidiaries and joint ventures that per workspace licensing and administration has become its own job. You already run an entity management system and the duplication between it and a board portal is causing errors. Or your governance process has requirements the products genuinely cannot express, which is rarer than people think and should be tested against a real product demonstration before you commit a budget.

How to choose a developer for board and governance software

Ask what happens to a downloaded pack when a director resigns. If the answer does not include remote revocation of the offline cache, they are building a document sharing site and calling it a board portal.

Ask them to model a director who sits on the group board and the audit committee but must be walled out of one subsidiary. If they reach for a per document permission list maintained by hand, the company secretary will be maintaining that list forever and will make a mistake during a transaction.

Ask how annotations survive a pack reissue. Directors will not adopt a portal that discards their notes when page six changes, and this is the detail that decides whether the system is used or bypassed.

Ask about the security assurance you will get: penetration testing by an independent firm, the remediation process, and what evidence they will provide to your risk committee. Then ask who owns the code and where it is hosted, in writing, before kickoff. You should own the repository and the infrastructure accounts. At Digital Heroes the client owns the code from the first commit, and for a board portal we would insist on an independent security test before a single real pack is loaded.