Board Confidence Framework

I1 How to Use This Framework

This framework is built for the people who sit around the NFP board table — and for those who want to. It is practical before it is theoretical. Every chapter is built around what you will actually face: the decisions, the moments, the conversations, and the things that go wrong.

I have sat at this table from both sides — as a CEO reporting to boards for fifteen years, and as a Non-Executive Director. I have seen governance done well and I have seen it fail. This framework reflects what I know works.

Three reading paths

The five-minute path. If a situation is in front of you right now, go straight to Part C and find the chapter that names your scenario. Each chapter gives you the next step in under five minutes.

The thirty-minute path. If you are preparing for a board meeting, a difficult conversation, or a governance decision, read the relevant Part B chapter for your role, then the Part C chapter that names the moment.

The full path. If you are new to NFP governance — or returning to it after a gap — read Part A end to end before going anywhere else. Part A sets the model, the language, and the foundations you need. Parts B through E build on it.

The box system

Five box types appear throughout the framework.

A1 What a Board Is Actually For

Most governance problems start here. A board that is not clear about its own purpose will drift into management, avoid hard decisions, or consume the CEO's time without adding value.

A board has one fundamental job: to ensure that the organisation fulfils its mission sustainably and within the law. Everything else — the meetings, the committees, the strategic planning days, the financial reports — is in service of that job.

The four things a board must do

A board provides four things that the executive cannot provide for itself.

• Direction. The board sets or approves the strategy. It determines where the organisation is going and why.
• Oversight. The board monitors performance against strategy and holds the CEO accountable. It asks the questions the organisation needs asked.
• Stewardship. The board protects the assets, reputation, and mission of the organisation for the people it serves and the community that trusts it.
• Legitimacy. In an NFP, the board provides democratic or representative accountability. It answers to members, funders, communities, or regulators. The CEO does not.

These four functions are the board's territory. When a board drifts out of them — into running programs, managing staff, approving every purchase, or doing the CEO's job — governance fails.

What a board is not for

A board is not an advisory committee. It does not exist to help the CEO think through problems (though good boards do this as a by-product). It is not a fundraising team, a volunteer workforce, or an extension of the staff. It is not a place to honour long service or reward loyal supporters.

These misunderstandings are common in NFP governance. When people join a board for the wrong reasons, or when a board is recruited for the wrong purposes, the organisation pays the price.

A practical framework: the four functions

A complementary way to think about the board's work comes from the corporate governance literature. Where the four things above describe the board's purpose, these four functions describe how that purpose is exercised in practice.

These four functions apply across every part of this framework. When a chapter describes what a board should do in a specific situation, it is almost always performing one or more of these functions.

A2 The Governance and Management Line

The single most important concept in NFP governance is the line between governance and management. Most governance failures — and most CEO-board relationship failures — trace back to this line being unclear, ignored, or crossed.

The line is not always sharp. Strategy, for example, sits at the boundary — it is the board's responsibility to set or approve it, and the CEO's responsibility to develop it. Financial performance sits at the boundary too — the board oversees it, the CEO manages it. This is not a problem. The boundary is meant to be a working zone, not a wall. The problem arises when one party crosses into the other's territory — and stays there.

When the board crosses the line

Board overreach is more common than most directors realise — and more damaging than most boards acknowledge.

• Directors contact staff directly to ask for information or raise concerns, bypassing the CEO.
• The board approves operational decisions — program changes, staff appointments below the CEO, procurement below a reasonable threshold.
• Individual directors give the CEO direction outside of board meetings.
• The board rewrites the CEO's documents rather than approving or rejecting them.
• Board members attend operational meetings or join working groups that are properly the CEO's domain.

Each of these erodes the CEO's authority and creates confusion in the organisation about who is actually in charge.

When the CEO crosses the line

Executive overreach is less visible but equally damaging.

• The CEO controls what information the board receives, filtering out bad news or risk.
• The CEO presents strategy as a fait accompli rather than as a proposal for board consideration.
• The CEO manages the chair rather than working with the board.
• The CEO builds relationships with individual directors outside the board process to secure support.
• The CEO treats board questions as interference rather than oversight.

A board that is managed by the CEO has lost its governance function. The organisation is, in practice, ungoverned.

A3 Why NFP Governance Is Different

Corporate governance frameworks do not translate directly to the NFP context. NFP boards operate under different pressures, with different resources, toward different ends. Understanding what makes NFP governance distinctive is not an excuse for lower standards — it is the starting point for appropriate ones.

Six ways NFP governance differs

None of these differences reduce the legal obligations of NFP directors. The duty of care, the duty to act in the organisation's best interests, and the duty to avoid conflicts of interest apply equally to volunteer directors and paid ones. What differs is the environment in which directors discharge those duties.

Social licence to operate

NFP boards answer not just to their formal stakeholders (members, funders, regulators) but to the broader community whose trust they depend on. This is sometimes called the "social licence to operate": the community's ongoing acceptance of the organisation's right to exist and act.

Social licence is not granted once. It is continuously earned or lost through the quality of the organisation's conduct, governance, and outcomes. The ACNC's 2024 NFP Governance Principles make this explicit, treating stakeholder accountability as a distinct governance obligation rather than a by-product of good management.

A4 Your Legal Duties in Plain English

Every NFP director carries legal duties. Most are not lawyers. This chapter translates the core duties into plain language. It is not legal advice — if you face a specific legal question, get a lawyer.

The core duties

In Australia, NFPs incorporated under the Corporations Act (companies limited by guarantee) are subject to ASIC regulation and the Corporations Act duties. Those incorporated under state associations legislation are subject to state law. Those registered as charities with the ACNC have additional obligations under the ACNC Act. Know which regime applies to your organisation.

A5 The Five Most Common Governance Failures

Governance failure rarely announces itself. It accumulates — through small compromises, avoided conversations, and structures that look fine until they are not. These are the five patterns I have seen most often.

Failure 1: The rubber-stamp board

The board approves everything the CEO presents without meaningful scrutiny. Papers arrive the day before the meeting. Questions are discouraged — implicitly or explicitly. The CEO is de facto governing the organisation.

Failure 2: The management board

Directors involve themselves in operational decisions. The CEO cannot hire, fire, spend, or change a program without board involvement. Staff go to directors with problems. The CEO is effectively a senior manager, not an executive leader.

Failure 3: The personality board

Decisions are made to please the chair, the founder, or the dominant director — not to serve the mission. Dissent is treated as disloyalty. The board culture suppresses the honest challenge that governance requires.

Failure 4: The information vacuum

The board does not receive the information it needs to govern. Financial reports are late, incomplete, or impenetrable. Risk is not reported. The board makes decisions without knowing what it does not know.

Failure 5: The conflict of interest ignored

A director participates in a decision from which they — or a person or organisation connected to them — will benefit. Nobody raises it. The decision is made. The damage, when it becomes visible, is to the organisation's reputation and the board's integrity.

A6 What Good Governance Looks Like

Good governance in an NFP is not complicated. It is consistent. It is a board that meets its obligations reliably, asks hard questions respectfully, supports the CEO without protecting them from accountability, and keeps the mission in view at all times.

The six markers of an effective NFP board

• Clear purpose. Every director can articulate what the board is there to do and what it is not there to do.
• The right people. The board has the skills the organisation needs — and a plan for renewing them.
• Good information. Directors receive timely, accurate, and complete information and know how to use it.
• Productive meetings. Board meetings focus on governance, not management. Time is used well.
• A working CEO relationship. The chair and CEO have a clear, trusted, and boundaried relationship.
• A culture of honest challenge. Directors ask hard questions without it being personal. Dissent is welcomed.

The six Cs of board behaviour

A useful framework from the governance research literature describes effective board members through six behavioural characteristics. They apply whether a director is new or has served for a decade.

The value of this framework is in the conversation it enables. A board that asks "where are we strong on these six characteristics, and where are we weak?" is doing useful self-assessment without the formality of a structured review.

A7 The Six ACNC Governance Standards

Every charity registered with the Australian Charities and Not-for-profits Commission must meet six governance standards. These are minimum legal requirements, not aspirational targets. Understanding them is part of every NFP director's responsibility.

The ACNC can investigate and take action where standards are not met. Sanctions range from a written warning to revocation of charity registration. The board is accountable.

The six standards mapped to board practice

The annual compliance review

Best practice is to include a brief ACNC governance standards review on the board's annual agenda. It does not need to be long. A standing item that asks "are we meeting all six standards?" takes fifteen minutes and closes a significant governance gap.

A8 Financial Oversight for Directors

Financial oversight is a core director duty. You do not need to be an accountant. You do need to understand what you are looking at, know which questions to ask, and recognise the signs that something is wrong.

This chapter is about what the board sees and what it does with it. For the financial management of the organisation, that is the CEO and the finance team.

The three documents every director must be able to read

Restricted and unrestricted funds

Many NFPs hold both restricted and unrestricted funds. Restricted funds are grants or donations given for a specific purpose and cannot be used for anything else. Unrestricted funds can be used at the board's discretion.

A board that approves expenditure from restricted funds for a purpose outside the grant conditions has created a serious legal and reputational problem. Always ask: which funds are we using, and are they restricted?

The five questions every director should ask at every finance report

1. Are we on budget? If not, is the variance explained and managed?
2. What is our cash position? How many months of operating expenses can the organisation meet from current cash?
3. Are our restricted funds being used for their designated purpose?
4. Are we meeting our financial obligations to staff, creditors, and the tax office?
5. Are there any items that have changed significantly since last month? What explains the change?

Early warning signs of financial distress

• Declining reserves. The organisation's reserve balance has been falling over several consecutive periods.
• Growing creditor balances. Unpaid invoices are accumulating, suggesting cash is not available to pay them.
• Delayed financial reporting. Reports arrive late or with unexplained gaps. This is often a symptom, not just an administrative problem.
• Revenue concentration risk. One funder or revenue source represents more than 40 per cent of total income.
• Deferred maintenance and investment. The organisation is choosing not to spend on things it needs in order to show a better result.
• Management drawing down restricted funds for general purposes. A clear sign that unrestricted cash has been exhausted.

See C3 (Financial Stress) for the board's response when distress is confirmed.

The insolvency obligation in plain English

An organisation is insolvent when it cannot pay its debts as and when they fall due. Directors of an insolvent organisation who allow it to continue incurring debts may be personally liable for those debts. This applies to NFP directors as much as to company directors.

If you believe the organisation may be insolvent, do not delay. Seek legal and financial advice immediately. Document every decision. The duty to prevent insolvent trading does not pause because the cause is good.

A9 Stakeholder Engagement and Community Accountability

A corporate board answers primarily to its shareholders. An NFP board answers to a much wider group: members, beneficiaries, funders, government, regulators, volunteers, and the broader community whose trust the organisation holds. This wider accountability is one of the defining features of NFP governance, and one of the most underused levers for improving it.

The NFP stakeholder map

What genuine stakeholder engagement looks like

The AICD's updated NFP Governance Principles treat stakeholder accountability as a distinct governance obligation. Beyond the annual report and the AGM, effective stakeholder engagement includes:

• Regular board exposure to beneficiary experience. At least once a year, the board should hear directly from people the organisation serves, in a format that is honest rather than curated. This is not a presentation by management. It is a direct conversation.
• Meaningful member participation. An AGM where the real decisions have already been made, and members are simply asked to ratify them, is not accountability. Members should have genuine opportunities to raise concerns and expect them to be heard.
• Staff and volunteer voice. The board should have visibility of staff satisfaction, volunteer retention, and any systemic concerns raised through internal channels. This does not mean managing staff. It means governing the organisation people want to work for.
• Community presence. Board members who are visible in the communities the organisation serves build trust and gain insight that board papers cannot provide.

The danger of mistaking consultation for accountability

Consultation is asking people what they think before a decision is made. Accountability is answering for the decision after it has been made, and being genuinely open to the consequences if you got it wrong.

Many NFPs run community consultation processes as part of strategic planning. This is good practice. But consultation that produces a report that sits on the shelf is not accountability. The board that consults and then ignores the findings, or uses consultation as cover for a direction it had already decided to take, damages trust more than no consultation at all.

Genuine accountability requires the board to be willing to change course based on what stakeholders say. That willingness is what makes the engagement real.

B1 The Director

Being a director is not the same as being a good professional in another field. Technical expertise, sector knowledge, and personal reputation are the starting point — not the finish line. Directorship is a distinct role with its own skills, disciplines, and obligations.

What a director brings

• Independent judgement — the capacity to assess proposals on their merits, not on who presented them.
• Specialist knowledge — finance, legal, sector expertise, community connection — offered to the whole board, not used to take over a function.
• Accountability — an active participant in governance, not a passenger.
• Challenge — the willingness to ask the question nobody else is asking.

What a director does not do

• Direct staff. The CEO is the only person the board manages.
• Represent a constituency. A director elected by a member group governs for the whole organisation, not the group that elected them.
• Act alone. A board governs collectively. Individual directors have no authority outside a board resolution.
• Confuse their professional role with their director role. The finance director is not the CFO.

B2 The Chair

The chair is the most consequential role in NFP governance. A strong chair creates the conditions for effective governance. A weak or inappropriate chair is the single biggest governance risk a board faces.

The chair's distinct responsibilities

• Board leadership. The chair leads the board as a team — setting culture, building capacity, managing performance.
• Meeting management. The chair runs meetings that are focused, efficient, and create space for genuine deliberation.
• CEO relationship. The chair is the primary relationship between the board and the CEO — supporting, challenging, and holding to account.
• External representation. The chair represents the board, not themselves, in public and stakeholder contexts.
• Director performance. The chair manages the board's own performance, including difficult conversations with individual directors.

Where chairs most often fail

• Becoming a second CEO — involving themselves in operational decisions, shadowing the executive.
• Protecting the CEO from board scrutiny rather than enabling it.
• Suppressing dissent in the name of harmony.
• Overstaying — chairs who have been in the role too long often do not see their own stagnation.

The chair as custodian of board culture

The chair sets the culture of the boardroom more directly than any other individual. How the chair opens a meeting, how they respond to the first question that challenges the CEO's position, how they treat the director who raises an uncomfortable issue: these behaviours establish what the board's culture actually is, regardless of what the governance documents say it should be.

Psychological safety is the specific cultural condition that makes boards effective. It is the belief, held by each director, that they can raise a concern, challenge an assumption, or disagree with the majority without being dismissed, ridiculed, or excluded. Boards without psychological safety become rubber-stamp boards. Directors who do not feel safe to challenge stop challenging.

• The chair who interrupts directors mid-point teaches the board that not all voices are welcome.
• The chair who thanks the CEO for an excellent presentation before any questions have been asked signals that scrutiny is unwelcome.
• The chair who notices that the quietest director has not spoken and makes space for them actively builds the culture that makes good governance possible.

B3 The CEO and Executive Director

The CEO operates under the authority of the board and within the limits the board sets. Understanding the board relationship is not optional for an effective CEO — it is a core leadership competency.

What the CEO owes the board

• Transparency. The board needs accurate, timely, complete information. Filtering bad news is a governance failure, not a management decision.
• Strategy development. The CEO develops strategy for the board to consider. The board does not write strategy — but neither does the CEO impose it.
• Respect for the line. The CEO who manages the board rather than working with it has broken the governance relationship.
• The board's time. Board members are volunteers. Papers should be on time, readable, and focused.

What the CEO can expect from the board

• Clarity on authority — a written delegation of authority that tells the CEO what they can decide alone.
• Honest performance feedback — not just at annual review, but through the year.
• Support in difficulty — a board that backs the CEO when things are hard, while holding to account when performance falls short.
• Not being managed — the board sets direction and oversees performance; it does not run the organisation.

B4 The Aspiring Director

Joining an NFP board is a significant commitment and a genuine opportunity. Go in with clear eyes about what it involves.

What to know before you join

• Read the constitution and the last two annual reports before you accept. Know what the organisation does and how it is governed.
• Understand the time commitment. Board meetings are the visible part. Papers, committee work, and preparation take more time than most new directors expect.
• Ask about the culture. Talk to a current or recent director before you join. A board with a poor culture is harder to change from the inside than it looks from the outside.
• Know your legal obligations. You are personally liable as a director. Understand what that means before you sign.
• Be clear about what you bring. The best boards recruit for skills gaps, not familiarity. Know what you contribute and make sure the board needs it.

B5 Board Succession Planning

Board succession planning is one of the most neglected governance functions in the NFP sector. Organisations that do not plan for board renewal end up with one of two problems: an ageing board that has stopped refreshing itself, or a sudden skills gap when an unexpected departure leaves a hole nobody planned for.

Succession planning is the board's responsibility, not the CEO's. And it belongs to the whole board, not just the chair.

The annual succession cycle

Board succession should sit on the board's annual agenda as a standing item. A good succession review takes less than an hour and covers four questions.

1. What does the board need? Review the skills matrix (E1) against the organisation's current strategy. What skills will you need in the next three to five years that you do not currently have?
2. What is coming up? Which directors are approaching the end of their terms? Which terms expire in the next twelve to eighteen months?
3. Who is in the pipeline? Are there candidates the board has identified and is cultivating? Are there people in the organisation's networks who have the skills you need?
4. What is the nominations process? Does the constitution require member election, committee appointment, or a combination? Is that process ready to run?

Term limits

Term limits are the governance mechanism that forces renewal. Without them, boards renew only when directors choose to leave, which is often too late or too infrequent.

Common practice is a maximum of two or three consecutive terms of two or three years each. Six to nine years of continuous service is a reasonable outer limit for most NFP boards. Beyond that, the risk of groupthink, entrenched dynamics, and reduced external challenge increases significantly.

Managing an effective director who has reached their term limit is uncomfortable. It is also necessary. The conversation is easier when the term limit was agreed by the board before it applied to anyone. "The board made a rule, and the rule applies to everyone" is a much easier conversation than "we think it is time for you to go."

Staggered terms

If a significant number of directors retire at the same time, the board loses institutional memory and relationship continuity. Staggered terms prevent this. The goal is to have a mix of directors in the early, middle, and later stages of their terms at any given time.

If your constitution does not currently provide for staggered terms, it is worth reviewing. The constitution change process can be slow, but the governance benefit is substantial.

Building a candidate pipeline

The worst time to look for a new director is when you urgently need one. Effective succession planning means maintaining a list of potential candidates even when there are no vacancies. This list should include people from the organisation's professional networks, people who have expressed interest in the board, and people identified through the skills gap analysis.

Not every person on the list will be suitable. That is not the point. The point is that when a position becomes available, the board has somewhere to start other than a blank page.

Managing unexpected departures

Directors resign mid-term, become ill, relocate, or face conflicts that require them to step down. When this happens without notice, the board needs to be able to act quickly.

• Check the constitution. Does it permit co-option between AGMs? If so, the board can appoint an interim director.
• Consult the succession pipeline. Is there a candidate already identified who could fill the skills gap?
• Assess the urgency. If the departing director held a critical skill (legal, financial, clinical), the board needs to act quickly. If the departure is from a less critical domain, a considered process is better than a rushed one.
• Brief the remaining board. The departure should be communicated clearly and without speculation about the reasons.

B6 Director Induction

A new director who is not properly inducted takes eighteen months to contribute meaningfully. That is eighteen months of meetings where they are guessing at context they should have been given. It wastes their time and the board's.

Director induction is the chair's responsibility. It is not something the CEO organises as a courtesy. It is a governance function that the chair owns.

What every new director needs before their first meeting

Five things. No new director should sit down at their first board meeting without them.

1. The governance framework. The constitution or rules, the current terms of reference for any committees, the conflict of interest policy, and the delegated authority matrix. These documents define the board's operating parameters.
2. The strategic context. The current strategic plan, the most recent annual report, and a summary of the major priorities for the year ahead.
3. The financial position. A plain-English summary of where the organisation stands financially: reserves, operating result, major funding sources, and any current financial risks.
4. The risk picture. A summary of the organisation's major risks and how they are being managed. This should come from the CEO, not from board papers alone.
5. The people. A briefing on the leadership team, the chair-CEO relationship, any active committee structures, and any current board dynamics the new director should understand.

Beyond documents: the conversations that matter

Documents tell a new director what the organisation says about itself. Conversations tell them how it actually works.

• A one-on-one with the chair. Not a formal briefing. A conversation about the board's culture, the current priorities, and the chair's expectations of the director.
• A briefing from the CEO. The CEO should spend an hour with every new director. Not presenting, but answering questions. This builds the relationship that will matter when things get hard.
• A site visit or program observation. For organisations with physical operations, seeing the mission in practice is the fastest way to ground a new director in the reality the board governs.
• Introductions to key stakeholders. The company secretary or governance officer, the finance manager, committee chairs, and any major external stakeholders the new director will need to know.

Mentoring new directors

Pairing a new director with an experienced one accelerates the induction significantly. The experienced director can answer the questions a new director is reluctant to raise in a board meeting. They can explain the history behind a position, the context behind a tension, and the cultural norms that are not written anywhere.

The mentoring relationship works best when it is informal and time-limited: a few check-ins over the first six months, and then left to evolve naturally.

Checking in at month three

The induction does not end after the first meeting. At the three-month mark, the chair should have a brief conversation with each new director: how is it going? What questions do you still have? Is there anything you expected that you have not seen? This signals that the chair is paying attention and gives the new director a safe moment to raise anything that felt odd.

B7 Board Culture and the Conditions for Good Governance

Culture is not what a board says about itself. It is how decisions are actually made: who speaks and who stays quiet, which questions get asked and which are left unasked, whether disagreement is welcomed or suppressed. A board can have excellent governance documents, a strong chair, and capable individual directors, and still have a culture that prevents good governance.

This chapter covers the whole-board dimension of culture. Chapter B2 covers the chair's specific role in setting it. These two chapters are read best together.

Groupthink: the specific failure mode of well-intentioned boards

Groupthink occurs when the desire for consensus overrides a realistic appraisal of alternatives. It is not a failure of intelligence or commitment. It is a social dynamic that affects capable, well-meaning people when they work together long enough to prioritise agreement over accuracy.

Conditions that produce groupthink in NFP boards:

• Long-serving director cohorts. Directors who have worked together for many years develop shared assumptions, shared blind spots, and a shared reluctance to challenge each other.
• A dominant chair or founder. When one person's view carries disproportionate weight, others gradually stop offering alternatives. The dynamic becomes self-reinforcing.
• Mission loyalty that overrides critical thinking. Directors who care deeply about the cause can find it hard to critically evaluate the organisation that delivers it. Questioning the strategy can feel like questioning the mission.
• The taboo topic. Every board with a groupthink problem has topics nobody raises. Directors know this about themselves and about each other. The governance cost of the unasked question accumulates over time.

Diversity of thought: the most undervalued governance resource

Much of the governance discussion about board diversity focuses on demographic representation: gender, ethnicity, age, and community connection. These matter. But the form of diversity that most directly improves decision quality is cognitive and experiential diversity: directors who have faced different kinds of failure, worked in different sectors, hold different mental models, and bring different instincts to complex problems.

A board of highly capable people who all think in similar ways will reach conclusions faster and agree more easily. That is not the same as reaching better conclusions. The board that includes a director who instinctively asks "what could go wrong?" alongside one who asks "what is the opportunity here?" will make better risk-adjusted decisions than a board where everyone gravitates to the same end of that spectrum.

The skills matrix (E1) is the right tool for assessing technical skill gaps. Cognitive diversity is harder to measure but worth the conversation. Ask: do we all tend to approach problems the same way? Do we all share the same assumptions about risk? Do we have anyone at the table who will reliably see what the rest of us are missing?

Recognising a dysfunctional board culture

What to do when culture is the problem

Culture problems are the hardest governance problems to address because they require the board to change itself, using itself as the instrument of change. This is inherently difficult. The people who need to change are the same people who would need to agree that change is necessary.

Three approaches that work:

• An external board review. An independent facilitator who can observe the board in action and report without the filter of internal politics. The findings carry weight that internally generated findings rarely do. See E2 for the full board review process.
• Deliberate board renewal. New directors who do not share the existing culture's assumptions are the most powerful lever for cultural change. This is one reason why succession planning (B5) and term limits are governance tools, not just administrative processes.
• The chair who names it. A chair with the courage to say, in a board discussion, "I notice we are not really engaging with the concern that was just raised. I want to come back to it" is doing the most direct form of culture leadership available. Not every chair can do this. The ones who can are rare and valuable.

C1 Setting Strategy with the Board

Strategic planning is the moment where the governance/management line is most commonly crossed — in both directions.

What good looks like

The CEO and the executive team develop a strategic proposal, drawing on environmental analysis, stakeholder input, and organisational capability. The board engages with the proposal seriously — testing assumptions, challenging priorities, and bringing external perspective. The board approves a strategy that is genuinely the product of both governance and management working in their proper roles.

Strategy and risk are the same conversation

A board that approves a strategic plan without discussing the risks that strategy carries has not fully done its governance job. Strategy and risk are inseparable. Every strategic choice involves accepting some risks and declining to accept others. The board's risk appetite (see F2) should directly inform which strategic options are available.

Questions the board should ask of every strategic proposal before approval:

• What are the principal risks this strategy introduces, and how will they be managed?
• Does this strategy take us into risk territory that exceeds our current appetite?
• What would have to go wrong for this strategy to fail, and how likely is that?
• What is the cost of being wrong, and can the organisation absorb it?

These questions are not reasons to avoid strategic ambition. They are the governance test that makes ambition responsible.

C2 The CEO Performance Review

The CEO performance review is the most important accountability function the board performs. Most boards do it badly.

What good looks like

Performance expectations are set at the start of the year — in writing, agreed by both the board and CEO, tied to the strategy. The review at the end of the year measures performance against those expectations. Feedback is honest, specific, and delivered by the chair with board endorsement. The conversation goes both ways — the CEO should have the opportunity to give the board feedback too.

C3 Financial Stress

Financial stress tests every dimension of governance — the board's oversight function, the CEO relationship, and the board's own cohesion under pressure.

What the board must do

• Get accurate information fast. The board cannot govern what it cannot see. If the financial reports are not current and accurate, that is the first problem to solve.
• Distinguish governance from management. The board oversees the financial response; the CEO manages it. The board that starts running the recovery has created a second crisis.
• Consider the organisation's obligations. Staff, creditors, beneficiaries, and funders all have interests. The board must weigh them in order.
• Take legal advice early. Financial stress can create personal liability for directors. Know where you stand.

Early warning signals: the financial dashboard every board needs

Financial stress rarely arrives without warning. The signals are in the reports. The problem is that most boards see them too late, either because the reports are not structured to surface them or because nobody asks the right questions.

C4 Conflict on the Board

Boards that never disagree are not functioning. Boards that cannot manage disagreement are dangerous. The difference is whether conflict is about ideas or about people.

C5 Mission Drift

Mission drift is the slow movement of an organisation away from its founding purpose — usually driven by funding opportunity, stakeholder pressure, or leadership change. It is almost always gradual and rarely visible until it is significant.

C6 A Director Who Will Not Contribute

Non-contributing directors are a governance risk. They consume quorum, dilute collective responsibility, and model disengagement to the rest of the board.

Signs of non-contribution

• Consistent non-attendance or late arrival.
• Papers not read before the meeting.
• No participation in board discussion.
• Unavailability between meetings.
• Resignation of committee responsibilities.

The chair's responsibility is to address this directly and privately. Not in the meeting. Not through a third party. A direct conversation: "I have noticed you have been less engaged recently. Is everything alright? Is there something about the role we should discuss?"

C7 A Broken Chair-CEO Relationship

The chair-CEO relationship is the axis around which NFP governance turns. When it breaks, everything is harder — board culture, strategic momentum, and staff confidence all suffer.

How it breaks

• Loss of trust — usually following an incident where one party acted without informing the other.
• Role confusion — the chair crossing into management, or the CEO managing the chair.
• Communication failure — the informal channel that keeps the formal relationship functional has stopped working.
• Personality incompatibility — genuine and sometimes irreducible.

C8 A CEO Who Is Underperforming

Addressing CEO underperformance is the hardest conversation in NFP governance. It is also one of the most important.

Before the conversation

• Be specific. "Not performing" is not a performance concern. Identify the specific areas, with specific evidence.
• Be fair. Has the CEO been given the resources, clarity, and support they need to perform? Is the performance gap the CEO's or the organisation's?
• Be timely. A performance concern that has existed for twelve months without being raised is a board failure, not just a CEO failure.

C9 Planning for a CEO Transition

CEO succession is one of the most consequential decisions a board makes. It is also one of the most neglected. Many boards manage succession reactively, which means they manage it badly. A planned transition becomes a scramble. An unplanned departure becomes a crisis. A crisis departure creates lasting damage that a good appointment alone cannot repair.

The board that has thought about CEO succession before it needs to act on it will handle every type of transition better.

Three types of transition, three different board responses

What the board must decide before it starts searching

Before the position is advertised, the board needs to answer four questions. The quality of the answers determines the quality of the appointment.

1. What does this organisation need in its next leader? This is a strategic question, not an HR question. The organisation's next stage of development should drive the leadership profile. The leader who built the organisation may not be the leader who scales it.
2. What has changed since we last recruited? The operating environment, the funding model, the community's needs, and the board's own composition may all have shifted. The next CEO profile should reflect where the organisation is going, not where it has been.
3. Internal or external? If there is a strong internal candidate, the board must decide how to handle them: a formal open process that includes internal candidates, a targeted internal promotion, or a full external search. Transparency with the internal candidate about the process protects the relationship regardless of the outcome.
4. Who runs the process? The board governs the appointment. Management does not hire the CEO. A nominations or search committee of three to four directors, with clear terms of reference, should run the process. For significant roles, an external search firm may assist.

The interim period

Every unplanned transition needs an interim CEO. This is not optional. An organisation without an identified leader, even temporarily, loses confidence fast.

• The interim may be an internal appointment (the deputy CEO, CFO, or a senior program director). This is usually faster and cheaper than an external interim.
• The interim's authority must be defined. They are not the CEO. They should not make major strategic or structural decisions. Their job is to keep the organisation running, maintain stakeholder relationships, and support the board during the search.
• Communicate the interim appointment clearly and promptly to staff, funders, and key stakeholders. Silence breeds speculation.

Common mistakes in CEO succession

• Rushing the permanent appointment. A six-month search with the right outcome is better than a six-week search with the wrong one.
• Writing the previous CEO's job description. The role should be designed around where the organisation is going, not what the previous CEO did.
• Insufficient reference checking. Formal referees are almost always positive. Speak to people who have worked with the candidate who are not on the reference list.
• Neglecting the handover. The outgoing CEO holds relationships, institutional knowledge, and context that the board cannot fully transfer on its own. Structure a formal handover, even if the relationship is strained.
• No induction for the incoming CEO. Apply the same rigour to inducting the new CEO that you would apply to inducting a new director (see B6). The CEO who arrives without a proper induction will take twice as long to be effective.

C10 Board Committees: When They Help and When They Don't

The decision to establish a committee is a governance decision, not an administrative one. Committees are useful when the board needs specialist expertise applied to a specific oversight function and the full board does not have time or depth to do that work in its regular meeting. They become harmful when they start making decisions rather than recommendations, or when they create a layer of governance that the full board no longer properly oversees.

The four committees most NFP boards eventually consider

Terms of reference: the governance document committees most often lack

Every committee must have written terms of reference, approved by the full board. Terms of reference that the committee itself has approved are not adequate. They must come from the authority that created the committee.

Terms of reference must specify:

• Purpose: What the committee exists to do and why
• Composition: Number of members, whether external members are permitted, who chairs it
• Quorum: Minimum attendance for valid decisions
• Meeting frequency: How often the committee meets and its minimum annual obligations
• Authority: Explicitly what the committee can decide and what it can only recommend to the full board
• Reporting obligations: How and when the committee reports to the full board, including minutes and recommendations
• Review: When the terms of reference will be reviewed

The NFP that does not need committees

A board of five to seven directors managing a small to medium NFP often does not need standing committees. The overhead of separate committee meetings, terms of reference, reporting structures, and quorum management is disproportionate to the governance value added.

Alternatives that work better at this scale:

• Designate one or two directors as leads for specific domains (finance lead, governance lead) to work closely with management between board meetings and report back to the full board
• Convene task groups for specific time-limited purposes, rather than standing committees
• Ensure the full board meeting agenda allocates adequate time to the oversight functions that committees would otherwise handle

Winding down a committee that has outlived its usefulness

Committees established for a specific purpose sometimes continue long after that purpose has been served. A standing committee that never meets, or that meets and produces nothing the full board acts on, is consuming governance energy without adding governance value.

Signs a committee should be wound down: attendance has become irregular; the full board no longer properly discusses what the committee produces; the committee's original purpose has been completed or superseded; the board is too small to staff it adequately.

To wind it down: a board resolution, an update to the relevant section of the constitution or governance policy if required, and a clear communication to committee members. It is a governance decision, not an administrative one, and it should be treated accordingly.

D1 Giving a Director Feedback

This is the chair's responsibility. It is also one of the least-used levers in NFP governance.

The structure

1. Request the conversation privately and in person or by phone — not email.
2. Name the specific behaviour: "I have noticed that you have missed the last three meetings."
3. Name the impact: "It puts pressure on our quorum and means the board is missing your perspective."
4. Invite the response: "Is there something going on that I should know about?"
5. Agree on the path forward — what changes, and by when.
6. Document the conversation briefly, for your records.

D2 The CEO Performance Conversation

The annual CEO performance review should not be the first time the CEO hears how the board thinks they are performing. Regular check-ins make the formal review a confirmation, not a surprise.

The structure for the annual review

1. Review the performance expectations agreed at the start of the year.
2. The CEO prepares a self-assessment against those expectations.
3. The chair meets with the CEO to discuss the self-assessment and the board's view.
4. Agreement on rating, areas of strength, and areas for development.
5. The CEO has the opportunity to give the board feedback — on support, clarity, and governance.
6. A written record of the review is produced and filed.

D3 Managing a Meeting That Is Going Off the Rails

Even well-chaired boards have meetings that lose their way. The chair's role is to recognise it and reset.

• Call it: "I want to bring us back to the question on the table."
• Summarise: "Let me summarise where I think we are." A summary resets the room.
• Park it: "This is an important issue and I want to give it proper time. Let's park it for now and return to it."
• Call for a break: Five minutes and a change of energy can reset a meeting that is stuck.
• Name the dynamic: "I notice we are going in circles. What do we need to resolve to move forward?"

D4 Raising a Governance Concern

Any director can raise a governance concern. The question is how.

If the concern is about a decision

Raise it in the meeting. Ask the question. If you are not satisfied with the response, record your dissent in the minutes. If the concern is serious enough, seek legal advice about your personal position.

If the concern is about the chair

Approach the deputy chair or the most senior independent director. Raise the concern specifically and in writing. Request that it be addressed.

If the concern is about the CEO

Approach the chair directly. If the concern is about the chair and CEO together, approach the deputy chair.

Whistleblower protections in Australia

Directors who raise governance concerns, and people who raise concerns about the conduct of directors or the organisation more broadly, may be protected under Australian whistleblower law. The Treasury Laws Amendment (Enhancing Whistleblower Protections) Act 2019 significantly expanded these protections.

Key protections that are relevant to NFP governance:

• A person who makes a disclosure about a concern relating to the organisation's conduct in good faith and on reasonable grounds is protected from civil, criminal, and administrative liability for making the disclosure.
• Victimisation of a person who makes a protected disclosure is unlawful. This includes dismissal, demotion, harassment, or any other detrimental action.
• The organisation must keep the identity of the person making the disclosure confidential unless they consent to disclosure or disclosure is otherwise required by law.

NFP boards that receive a concern should treat it as potentially protected from the outset. Do not attempt to identify who raised a concern before you have assessed whether doing so would constitute a breach of confidentiality obligations. Seek legal advice if the concern is serious or if there is any uncertainty about the appropriate response.

E1 Board Skills Matrix

Use this matrix to map current skills against the skills the organisation needs. Identify gaps and use them to drive board recruitment.

Rating guide: 3 = deep expertise  |  2 = working knowledge  |  1 = basic awareness  |  blank = no knowledge

Using the skills matrix for succession planning

The skills matrix is not just a snapshot of what the board has today. Used well, it is a planning tool for what the board will need.

When reviewing the matrix annually, ask two additional questions beyond current gaps:

• What skills will this organisation need in three to five years given its current strategy? A board supporting an organisation that is expanding its digital services will need technology literacy it may not currently have. A board navigating increased regulatory complexity will need stronger legal expertise.
• Which directors are approaching the end of their terms and will carry which skills out of the board when they leave? The succession plan should ensure those skills are replaced before departure, not recruited after it.

The skills matrix review and the succession planning conversation belong on the same agenda item. One informs the other. See B5 for the full succession planning framework.

E2 Director Self-Evaluation

Complete annually. Rate yourself 1 (rarely) to 5 (consistently).

The board review process: beyond self-evaluation

Director self-evaluation (this tool) is one component of a complete board review. It tells you how each individual director sees their own performance. It does not tell you how the board performs as a team, how the chair is perceived, or how governance processes are working overall.

A complete board review typically runs annually or every two years and covers four areas:

The findings from the review should produce specific commitments: what will change, by when, and who is responsible. A review that produces a report but no action is a process, not an improvement. The chair owns the implementation of the findings.

For significant reviews, or where the board needs an independent perspective, an external facilitator can run the process. This is particularly useful when there are dynamics within the board that make objective self-assessment difficult.

E3 Conflict of Interest Register

Maintain this register and update it at the start of every board meeting.

E4 CEO Performance Expectations Template

Complete at the start of each year. Signed by the chair and CEO.

E5 Board Meeting Health Check

Complete after each board meeting. Takes two minutes. Reviewed by the chair.

F1 What the Board Actually Owns in Risk

The board's relationship with risk is one of the most misunderstood in NFP governance. Some boards treat risk as a management function they hear about occasionally via a report. Others dive into the detail of individual risks that belong entirely to the executive. Neither is right.

The principle is the same one that runs through A2. The board governs risk. Management manages it. The board that understands this distinction will ask better questions, receive better information, and avoid both over-reliance on management and the trap of doing management's job for it.

The four types of risk every NFP board must understand

These categories are not exhaustive. Depending on the organisation, there may also be regulatory risk, safety risk, environmental risk, and technology risk (covered in F4). The point is not to have an exhaustive taxonomy. The point is to ensure the board can have a structured conversation about the types of risk the organisation faces.

What the board owns

• Setting the risk appetite. How much risk is the board willing to accept in pursuit of the mission? What categories of risk are non-negotiable? See F2 for how to have this conversation.
• Approving the risk management framework. The policy, the process, and the accountabilities. Management designs it; the board approves and oversees it.
• Receiving and reviewing risk reports. Questioning management on significant risks, trend changes, and the effectiveness of controls. Not accepting reassurance without evidence.
• Escalation thresholds. The board must ensure management knows when a risk must be brought to the board's immediate attention, outside the normal reporting cycle.

What management owns

• Building and maintaining the risk register
• Designing and operating the controls that mitigate identified risks
• Reporting to the board on risk position and emerging risks
• Escalating risks that exceed the board's appetite, or that are new and material

F2 Setting Your Risk Appetite

Risk appetite is the amount and type of risk the board is willing to accept in pursuit of the organisation's mission. Without a risk appetite, risk governance is guesswork. The board receives risk reports without a benchmark, management has no clear guidance on when to escalate, and the organisation's risk decisions become inconsistent over time.

Setting a risk appetite is not a technical exercise. It is a governance conversation. It should take about an hour at a board meeting and produce a one-page statement the board formally approves.

The risk appetite conversation

The chair should structure this as a values conversation, not a risk management exercise. The questions are:

1. What is this organisation willing to risk in pursuit of its mission? What risks are we willing to take to grow, to innovate, to serve more people?
2. What are we never willing to risk, regardless of any potential upside?
3. Where is the boundary between a risk the CEO can manage and a risk that requires board approval?

The answers will vary by category. An NFP working with children and young people may have zero appetite for safeguarding risk, low appetite for reputational risk, and a higher appetite for financial risk in pursuit of mission growth. That is a legitimate and coherent risk appetite.

Structuring the appetite statement

A workable risk appetite statement covers the major risk categories and rates the board's appetite for each as low, moderate, or high. The BCF Risk Appetite Statement template (in the resources section) provides the format. A simple version looks like this:

When to review the risk appetite

• Annually, as part of the strategic planning cycle. Risk appetite should align with current strategy.
• When strategy changes significantly. A new strategic direction may bring new risk categories or change the weighting of existing ones.
• After a significant risk event. A near-miss or an actual incident is the right moment to ask whether the appetite was set correctly and whether it needs adjustment.
• When the board composition changes significantly. New directors bring different risk perspectives. A significant change in board membership can warrant a fresh appetite conversation.

F3 The Board and Crisis Management

A crisis is any event that threatens the organisation's ability to operate, serve its community, or maintain public trust. NFP boards face crises more often than they expect: funding losses, safeguarding incidents, media coverage of misconduct, regulatory investigations, and data breaches are all genuine crisis scenarios for organisations in this sector.

The board's most important crisis work happens before any crisis arrives. The board that waits for a crisis to think about how it will respond has already made its first mistake.

The four types of crisis NFP boards face most often

Phase 1: Before a crisis arrives

The board approves and the CEO prepares. There are three things the board should have in place before a crisis occurs.

• A crisis management policy. Approved by the board, it defines what constitutes a crisis, who has authority to act, how the board is notified, and what the communication protocols are.
• An escalation protocol. Management must know exactly when and how to notify the board in a crisis. "As soon as practicable" is not specific enough. Define it: within two hours for a safety incident, within twenty-four hours for a reputational event.
• A communications framework. Who speaks publicly? Who speaks to the regulator? Who speaks to funders and major stakeholders? The default is the CEO operationally and the chair publicly. This should be agreed before the crisis, not decided in the middle of it.

Phase 2: During a crisis

The board's role during a crisis is to support the CEO's response, maintain governance, and communicate publicly when necessary. It is not to run the response.

The chair is the board's key person in a crisis. The chair keeps the board informed, keeps communication with the CEO clear, and prevents individual directors from acting independently.

During a crisis, the board should:

• Convene quickly, even informally, to be briefed by the CEO and the chair
• Agree on the board's position and communicate it through the chair alone
• Support the CEO to manage the operational response without directing it
• Make any governance decisions required: approving emergency expenditure, engaging legal counsel, authorising communications
• Document every decision and the reasoning behind it

Phase 3: After a crisis

When the immediate crisis has passed, the board's role is to ensure the organisation learns from it.

• A formal debrief. The CEO presents a review of what happened, what was done, and what would be done differently. The board asks hard questions.
• Changes to policy or process. If the crisis revealed a gap in the organisation's risk management, that gap needs to be closed. The board must confirm it has been.
• Support for the CEO and leadership team. Crises are exhausting. The board should acknowledge the effort of the people who managed the response and assess whether they need support.
• External review where warranted. For significant crises, particularly safety incidents or serious reputational events, an independent external review may be appropriate. The board commissions it; management supports it.

F4 Cyber and Technology Risk for Boards

Cyber risk has moved from an IT concern to a board-level fiduciary issue. NFPs are targeted because they hold personal data on vulnerable people, often operate with limited security budgets, and have a high public trust profile that makes a breach especially damaging to their mission.

Boards do not need to be technical to govern cyber risk effectively. They need to ask the right questions, understand what good looks like, and ensure management is taking the threat seriously.

Why cyber is a governance issue, not just an IT issue

• Legal obligations. The Privacy Act 1988 requires organisations that hold personal information to take reasonable steps to protect it. Under the Notifiable Data Breaches scheme, serious breaches must be reported to the Office of the Australian Information Commissioner and to affected individuals. This is a board-level legal obligation.
• Mission impact. A ransomware attack can shut down service delivery for days or weeks. For an NFP serving vulnerable people, that is not just a financial and reputational event. It is a mission failure.
• Financial exposure. Cyber incidents cost organisations in restoration costs, legal fees, regulatory penalties, and lost donor and funder confidence. Many NFPs underestimate the financial tail of a significant breach.
• Fiduciary duty. Directors have a duty to ensure major risks are identified and managed. Cyber is a major risk. A board that has not discussed cyber governance in the past twelve months is not meeting that duty.

What the board oversees and what management manages

Ten questions every board should ask about cyber

1. What personal data do we hold, and who can access it?
2. What is our single biggest cyber risk right now?
3. Do we have a cyber incident response plan, and when was it last tested?
4. Have we had a cyber incident or near-miss in the past two years?
5. Are we meeting our obligations under the Privacy Act and the Notifiable Data Breaches scheme?
6. Do we have cyber insurance? What does it cover and what does it exclude?
7. How are staff trained to recognise phishing attacks and social engineering?
8. Who in the organisation is responsible for cyber security, and what resources do they have?
9. Do our major vendors and technology suppliers meet our security requirements?
10. If we suffered a significant cyber attack tomorrow, what is the plan and who runs it?

Four scenarios where cyber becomes a governance issue

F5 Governing for Sustainability and ESG

ESG (Environmental, Social, and Governance) is not a framework for publicly listed companies that NFPs can safely ignore. It is a set of obligations that are increasingly embedded in funder expectations, government requirements, community trust, and the long-term viability of mission-driven organisations. The AICD's 2024 NFP Governance Principles added sustainability as a new standalone governance category for the first time, reflecting how significantly this has shifted.

The G in ESG is, in effect, what this entire framework addresses. This chapter focuses on the E and the S: what boards need to govern in relation to their organisation's environmental impact, social accountability, and long-term sustainability.

The environmental dimension

NFP boards often underestimate their environmental governance obligations. The common assumption is that environmental responsibility belongs to large corporations with significant physical operations. In reality, every organisation that consumes energy, holds assets, runs events, or procures goods and services has an environmental footprint, and an increasing number of funders, government programs, and community expectations require boards to account for it.

Climate risk, specifically, has moved from a future concern to a present governance reality. It presents in two forms:

• Physical risk: Facilities, operations, and service delivery affected by extreme weather events, rising temperatures, flooding, and bushfire. For NFPs that serve regional or remote communities, this risk is often immediate and significant.
• Transition risk: Changes in regulation, funding conditions, and community expectations that require the organisation to adapt its practices. A large government funder that requires net-zero commitments in grant conditions is a transition risk the board must plan for.

The social dimension

For NFPs, the social dimension of ESG overlaps directly with mission. An organisation that exists to improve the wellbeing of a community is, by definition, operating in the social domain. But governance of the S in ESG requires something beyond mission delivery: it requires the board to hold management accountable for the quality of the organisation's social impact, not just its volume.

• Staff and volunteer wellbeing. The board should receive regular data on staff satisfaction, turnover, psychological safety at work, and any systemic concerns raised through internal channels. An organisation that delivers social good to its clients while treating its staff poorly is not socially responsible.
• Lived experience inclusion. Governance that includes the voices and perspectives of people with lived experience of the issues the organisation addresses is stronger governance. This may mean directors with lived experience, or structured processes for beneficiary voice to reach the board.
• Social impact measurement. The board should have a view on whether the organisation is actually achieving its mission, not just delivering programs. Output (programs delivered) is not the same as outcome (lives improved).

Long-term sustainability: the dimension most NFP boards neglect

Financial sustainability is the most discussed form of sustainability in NFP governance, usually because the pressures are immediate. But long-term sustainability in the full sense requires the board to hold three questions simultaneously:

1. Can we sustain this financially? Not just this year, but over a five-year horizon. Is the funding model sound? Is there dangerous revenue concentration? Does the organisation have adequate reserves to absorb shocks?
2. Can we sustain this mission impact? Is the mission still relevant to the community's needs? Are the programs evolving with evidence about what works? Is there a risk of mission drift that erodes impact over time?
3. Are the environmental and social conditions that make our mission possible being sustained? For some NFPs, particularly those working in environmental conservation, community health, or social services, the conditions in which their beneficiaries live are themselves changing in ways that affect the organisation's work. Climate change, demographic shifts, and social inequality all create governance obligations for boards willing to look far enough ahead.

ESG disclosure obligations

Mandatory ESG disclosure requirements are still developing in Australia, but voluntary and funder-driven disclosure expectations are already significant for many NFPs. Government funding agreements, philanthropic foundation conditions, and community expectations are all moving toward requiring evidence of environmental and social responsibility alongside financial accountability.

The board should confirm annually: do any of our major funding agreements include ESG conditions? Are we meeting them? Are there emerging disclosure expectations in our sector that we need to prepare for? If the answer to any of these is unclear, management should be asked to report on it.

F6 Technology and AI Governance: The Board's Role

Technology has become a material governance risk for most NFPs. Organisations that deliver services through digital platforms, hold personal data on clients and donors, use cloud-based systems for operations, or employ any form of automated decision-making are exposed to technology governance risk whether or not they have thought about it in those terms.

The board's relationship to technology governance mirrors its relationship to financial governance. The board does not manage the technology. It provides oversight: ensuring the organisation has adequate policies, that risks are identified and managed within the board's risk appetite, and that the people most directly affected by the organisation's technology decisions have appropriate protections.

The board's technology governance obligations

At a minimum, the board should be able to confirm the following at any point in time:

• The organisation has a current technology risk policy, approved by the board, that covers data governance, system security, and vendor management.
• Major technology systems and technology vendors are subject to a documented due diligence and approval process before adoption.
• The organisation's cyber risk is managed within the board's risk appetite (see F1, F2, and F4).
• The organisation meets its legal obligations for the personal data it holds, including the Privacy Act 1988 and any sector-specific data obligations.
• There is a clear accountability structure for technology governance: who is responsible, who reports to the board, and what triggers escalation to board level.

Artificial intelligence: the governance challenge of the current era

AI is the most consequential technology governance challenge most organisations have ever faced. It is not a future issue. As of 2025, the majority of NFPs are already using AI, often extensively and often without adequate governance oversight. Generative AI tools, automated scheduling and triage systems, AI-assisted grant writing, and algorithmic donor management are all in active use across the sector.

AI governance is a board-level fiduciary responsibility for three reasons:

• AI makes decisions that affect people. When an NFP uses AI to triage client need, assess eligibility for services, or generate communications to beneficiaries, those decisions carry the organisation's authority. The board is accountable for how that authority is exercised.
• AI failures can be rapid and large-scale. A misconfigured AI system can affect thousands of interactions before the problem is identified. The board's risk governance role requires it to ensure management has the controls to detect and correct AI failures quickly.
• The regulatory environment is developing and the liability is real. Directors have duties to act with care and diligence. As AI becomes a material operational risk, failure to ensure adequate governance structures are in place is increasingly likely to constitute a breach of those duties.

Five questions the board should ask about AI governance

1. What AI systems or tools are currently in use across the organisation, and does the board have an accurate register of them?
2. Has the board approved an AI policy or AI acceptable use guidelines? Do staff know what is and is not permitted?
3. When AI systems affect decisions that impact clients or beneficiaries, is there human oversight and a review mechanism?
4. What is the board's risk appetite for AI use? Is there a category of AI use the organisation will not engage in regardless of efficiency benefits?
5. What would the board need to see to be satisfied that AI governance is adequate?

Going deeper: the AI Governance Confidence Framework

The questions and principles in this chapter provide a starting point for board-level AI governance oversight. For organisations that are ready to go further, a comprehensive specialist resource is available.

The AI Governance Confidence Framework (AGCF), published by Linke Leadership, is a structured, practical resource specifically designed for leaders and boards who need to govern AI responsibly. It is built around the Five-Level Confidence Model, which maps where an organisation sits in AI governance maturity, from AI Aware (Level 1) through to AI Leader (Level 5), and provides a clear, actionable path from wherever you are to where you need to be.

For boards encountering AI governance for the first time, the AGCF chapters most directly relevant to your role are:

The AGCF is available at linkeleadership.com/agcf. If your organisation is already using AI, it is the natural next step from this chapter.