A research report, however well produced, is an input. It becomes a decision only when someone with the authority to act reads it, decides what it implies for this organization specifically, and commits to something as a result. A great many reports are read, discussed and filed without that middle step ever happening.Why the Middle Step Gets SkippedReading a report and discussing it in a meeting both feel like governance activity, and both are considerably easier than committing to a specific action with a named owner and a date. The discussion produces a sense that something has been addressed; without a decision attached, nothing actually has.Turning a Report Into an Actual DecisionName the one implication that matters most: a 40-page report usually has one or two findings genuinely relevant to your organization — surface those, not a summary of everything.Force a yes/no on each relevant finding: does this change what we do, or not — a genuine 'no, and here is why' is a real decision; silence is not.Assign the action to a person, not a function: 'security will look into this' rarely produces a follow-up; a named owner and a date usually does.Record the decision where it will be checked later: the same register or minute-taking discipline used for any other governance decision, so 'we read the report and decided X' survives past the meeting it was made in.“A report that everyone found interesting and nobody acted on has produced exactly the same outcome as a report nobody read.”A Reasonable Standard to Hold Reports ToBefore circulating any external report, it is worth asking what decision it is meant to inform. A report added to an agenda with no attached question rarely produces one once it gets there — the discipline has to be applied on the way in, not hoped for on the way out.Share this articleX (Twitter)LinkedInFacebookCopy Link
Research ReportAug 30, 2026What 'GRC Maturity' Actually Means Before You Benchmark Against ItEvery maturity model produces a number. Very few of them agree on what the number is supposed to represent, which makes comparing your score to anyone else's a riskier exercise than it looks.
Industry SurveyJul 24, 2026What a Board Survey Cannot Tell You About Your Own RiskAn industry survey describes what other boards say they worry about. It says nothing about what your board should actually be worried about, and the two get conflated more often than either side notices.
Benchmark StudyAug 16, 2026Why Cross-Industry Benchmarks Rarely Transfer to Your OrganizationA benchmark built from a mixed sample of industries tells you what an average organization does. It rarely tells you what your organization, with your specific risk profile, should do.
