Board Portal Software Problems: The 7 That Undermine the Record, and How to Avoid Them

Why does the scope collapse into a secure document library?

Because that is the part everyone can picture. The brief says directors need a safe place to read papers, a developer hears file storage with permissions, and the first demonstration shows folders, uploads and a viewer. Everyone nods, because it is visibly better than eleven attachments in eleven inboxes.

What has been dropped is everything that makes it a board system. A pack is not a folder, it is a compiled artefact with an agenda order, pagination, bookmarks and a version. Papers are not files, they are items with an owner, a due date and a status, so the company secretary can see on Monday that four of eleven have arrived. Distribution is not a permission, it is an act with a record. And a reissue is not a second upload, it is a version increment that reaches every device with the change flagged.

The specific harm in governance is that a document library gives directors no reason to stop printing. They download, they annotate on paper or in a separate application, and within two meetings the portal is a delivery mechanism rather than a working environment. The fix is to specify the pack as the central object at the whiteboard stage, before anyone designs a screen, and to write acceptance criteria for the reissue path first: paper changes on Wednesday night, what does each of eleven directors see on Thursday morning, and what happens to the notes they made on Tuesday. If the developer cannot answer that in the first meeting, they are building a library.

What goes wrong when you migrate the minute book and historical packs?

The board record predates the software by decades, and it is not tidy. Minutes exist as signed scans, as Word files with tracked changes still in them, and in a bound book for the years before that. Written resolutions passed by circulation sit in a folder that only the company secretary knows about, and some were never filed into the minute book at all. Attendance lives inside the minutes as prose rather than as data. Declarations of interest sit in a standing register that was last reviewed at an annual general meeting.

Teams then try to migrate all of it, and the project stalls on questions nobody can answer: which of three files is the approved version of the March minutes, whether a resolution circulated in August was ever formally noted, whether an interest declared verbally was recorded anywhere. These are governance questions dressed as data questions, and a developer cannot resolve them.

The workable approach is to split the migration in two. Corporate records that carry statutory retention expectations, meaning approved minutes and resolutions, get migrated deliberately, with a named person confirming the approved version of each and the provenance recorded. Everything else, meaning old packs, drafts and annotations, stays where it is and is retired on a schedule rather than imported. Migrating nine years of packs into a new portal recreates the discovery liability you had, in a system with better search, which is the opposite of what the risk committee wanted.

Why do identity, entity register and e-signature integrations break after launch?

Board portals sit at an awkward junction. Executives and the secretariat are employees in your directory. Non executive directors are not, and putting them in your staff directory gives them an email address, a payroll adjacency and a set of group memberships nobody intended. Teams solve this at launch with a separate identity store, then discover that a director who joins a committee in March has to be updated in two places, and that the leaver process for employees does not touch the director store at all.

The entity register is the second break. If your group already maintains company, board and committee structures somewhere, and the portal holds its own copy, they diverge within a quarter. A subsidiary is renamed, a committee is dissolved, an appointment date is corrected in one system and not the other, and access is then derived from a structure that is quietly wrong.

Electronic signature integration for written resolutions breaks differently. It works at launch, then a director signs from a personal device, the return callback fails, and the resolution sits in a signed state in the signature provider and an unsigned state in your portal. Nobody notices until the minute book is assembled.

The fixes are ordinary engineering discipline applied where it usually is not. One identity per person with membership held as dated records, sourced from the entity register rather than typed twice. Reconciliation jobs that compare the portal's view of memberships against the register and raise a difference rather than overwriting. And for signature callbacks, a poll as well as a webhook, so a missed callback becomes a delay rather than a silent inconsistency in a corporate record.

What happens when retention and recusal are not covered?

These are the two governance gaps that get discovered at the worst possible moment. Retention is discovered by a litigant or a regulator asking what board material you hold, and the answer being everything since the portal went live. Every pack, every draft, every annotation a director made on a train, all indexed and searchable, none of it required to be kept. A deliberate policy would have expired packs and drafts on a schedule while retaining minutes and resolutions, with a documented exception for anything under legal hold. Most builds never apply one, because retention is a policy decision and nobody in the project has authority to make it.

Recusal is discovered when a director declares an interest, withdraws for item five, and still has the paper for item five in their offline cache. The minutes record the withdrawal. The access log records the paper being opened the following week. That is a worse record than having no log at all, because the log is now evidence against you.

Both fixes are cheap if specified early and expensive if retrofitted. Retention is a rule per artefact type, decided by the general counsel or company secretary before build starts, with the exception process documented. Recusal is a state on the director for a specific item, which removes the paper from their access and reaches the device, and which the minutes reference rather than duplicate. If the specification does not name who signs off the retention rule, that decision will not be made, and the default is to keep everything forever.

Should you build custom or configure the board product you already own?

Most organisations reading this should buy, and we will say so on the call. If your pain is that pack assembly is painful and directors read old versions, Diligent Boards, Nasdaq Boardvantage, OnBoard or BoardEffect solve that next quarter for a licence fee, and a custom build solves it next year for six figures. Board material is unforgiving, these products have been examined by more risk committees than any new build will be in its first five years, and reproducing their versioning, annotation and tablet applications to arrive at parity is a poor use of budget.

Three reasons to build are genuine, and all three are structural rather than about features. Data residency or self hosting that no vendor will meet on acceptable terms, which is a regulator or risk appetite question and not a preference. Group complexity, meaning enough boards, committees, subsidiaries and joint ventures that per workspace licensing and administration has become somebody's job. And an existing entity management system whose duplication with a portal is already causing access errors.

Before committing a budget, run a real product demonstration against your hardest case: the director who sits on the group board and the audit committee but must be walled out of one regulated subsidiary. Products fail that test more often than their sales material suggests, and if a product passes it, your build case has just evaporated for the price of a meeting.

How do hidden costs get into a board portal quote?

Five items account for most of the gap between the quote and the outturn, and none of them appear in a feature list.

• Native tablet applications with offline access. Directors read on aircraft. A responsive web page is not that, and a native application with an encrypted local cache is a second and third build, not a styling exercise.
• Independent penetration testing and remediation. Your own risk function will require it, and remediation of findings is real work. Budget it rather than discover it.
• Self hosting or a specific residency. If this is your reason for building, it changes deployment, operations and support, and it belongs in the architecture conversation on day one rather than in month five.
• The number of boards and committees. Complexity lives in the access model, not in the screens, so a group with nine bodies is not three times a group with three.
• Signature integration for written resolutions. Straightforward to demonstrate, fiddly to make reliable, and it touches a corporate record.

The way to keep the number down is to launch on the main board plus one committee, web first, with the tablet application in a second phase once the pack model has survived two real meetings.

What separates a board build that works from one that fails?

Four things, and none of them are visual. First, annotation carry over across a reissue. Directors will not adopt a system that discards their notes when page six changes, and this single behaviour decides whether the portal is used or bypassed. Test it before acceptance with a real reissue, not a demonstration.

Second, revocation that reaches the device. Access is per director per pack, offline copies are an encrypted cache tied to the application and the user, and withdrawal wipes it. If a developer answers the resignation question with a permissions change, they have not built this before.

Third, one record rather than several documents. Minutes drafted against agenda items with the pack attached, resolutions as objects with a voting record, an interest declared at the meeting updating the standing register, and actions carrying forward onto the next agenda with their status. Managed as separate documents, these disagree within two meetings.

Fourth, an honest limit stated out loud. Nobody can stop a director photographing a screen. What you can do is make casual copying inconvenient and deliberate copying attributable through per director watermarking and an access log that records every open. A developer who claims otherwise is overselling, and overselling a security property to a board is a bad way to start.