Dr Alwin Tan, GAICD, MBBS, FRACS, EMBA (Melbourne Business School)
Senior Surgeon | Governance Leader | HealthTech Co-founder | Founder of Institute for Systems Integrity (ISI) | Harvard Medical School — AI in Healthcare | University of Oxford — Sustainable Enterprise | Bastas Academy for Healthcare Leadership - Triple Scholar

The Governance Question Every Board Should Be Able to Answer Without Asking Management Again.

The dashboard is green.

Customer satisfaction is up.

Staff engagement is improving.

Complaints are down.

Safety incidents are falling.

Turnover is stable.

Major risks are within appetite.

The transformation programme is on track.

Management is comfortable.

The board receives the report.

Directors ask questions.

Management answers them.

Everyone moves to the next agenda item.

But there is one question that may matter more than all the others:

WHAT IF THE PICTURE IS WRONG?

Not fraudulent.

Not manipulated.

Not deliberately misleading.

Just wrong.

Or incomplete enough to make the board wrong.

Because there is a profound difference between asking:

“Is management confident in this information?”

and asking:

“WHAT EVIDENCE WOULD ALLOW THE BOARD TO TEST THIS CLAIM WITHOUT SIMPLY ASKING MANAGEMENT AGAIN?”

That is not distrust.

That is governance.

BOARDS HAVE AN ASSURANCE PROBLEM

Boards necessarily depend upon management.

That is how organisations work.

Executives possess deeper operational knowledge.

They have greater access to organisational information.

They manage the people, systems and processes that produce performance.

Directors govern.

That distinction matters.

But it creates an unavoidable problem.

The board is expected to exercise independent judgement while depending heavily upon information produced by the organisation it is independently overseeing.

That tension cannot be eliminated.

It has to be governed.

The OECD's corporate governance principles recognise this directly: directors require accurate, relevant and timely information and should have access to key executives and control functions such as internal audit and risk management.

Independent assurance exists for a reason.

So does board challenge.

So does internal audit.

So does external audit.

So do whistleblower systems.

So does direct stakeholder engagement.

The problem is that boards can still become overly confident when multiple reports appear to confirm the same organisational story.

Because several reports are not necessarily several independent sources of evidence.

TEN REPORTS PRODUCED FROM THE SAME UNDERLYING ASSUMPTIONS DO NOT GIVE A BOARD TEN INDEPENDENT VIEWS OF REALITY.

They may give it the same view ten times.

CONSIDER A SIMPLE BOARD CLAIM

Management reports:

“Our safety culture is improving.”

What would make the board comfortable?

An employee engagement score?

Incident data?

A culture survey?

A management presentation?

A risk report?

All useful.

But none should automatically settle the question.

A director should ask:

What evidence supports this conclusion?

Then:

“WHAT EVIDENCE EXISTS THAT DID NOT COME FROM THE TEAM MAKING THE CLAIM?”

That changes the conversation.

Internal audit may see something.

Frontline employees may see something else.

Customers or patients may be experiencing something else.

Whistleblower data may reveal another pattern.

Turnover may contradict engagement.

Absenteeism may contradict wellbeing.

Near misses may contradict the safety dashboard.

External regulators may see something management does not.

And sometimes these sources will disagree.

Good.

THE DISAGREEMENT MAY BE MORE VALUABLE THAN ANOTHER GREEN KPI.

🚨 BOARDS SHOULD STOP TREATING CONSISTENCY AS AUTOMATIC PROOF.

There is comfort in alignment.

Management says things are improving.

The dashboard agrees.

The board paper agrees.

The committee report agrees.

The presentation agrees.

The CEO agrees.

But ask a different question:

Are these genuinely independent observations?

Or are they different expressions of the same organisational assessment?

That distinction matters.

A board should not measure confidence simply by counting how many documents reach the same conclusion.

It should understand how independently that conclusion has been tested.

THE BOARD REALITY CHECK™

We propose a simple governance discipline:

THE BOARD REALITY CHECK™

It begins with a material claim already before the board.

Not every number.

Not every agenda item.

Not every operational issue.

A claim important enough to influence governance judgement.

For example:

Culture is improving.

Patient safety is improving.

The transformation is on track.

Customer harm is declining.

The workforce is resilient.

The major risk is controlled.

AI is performing safely.

The organisation is ready for implementation.

Then the board applies six tests.

1. THE SOURCE TEST

What is this claim actually based on?

Not:

“Where is it written?”

But:

What evidence sits underneath it?

If customer satisfaction increased, what generated the result?

If culture improved, how was culture measured?

If safety improved, which measures support that conclusion?

If a major project is green, what conditions determine green?

If AI performance is acceptable, against which population, benchmark and exceptions?

A board does not need every underlying data point.

But it should be able to understand what a material assertion actually rests upon.

A CONCLUSION WITHOUT AN IDENTIFIABLE EVIDENCE BASE IS NOT ASSURANCE.

It is an assertion.

2. THE INDEPENDENCE TEST

Who else has examined the claim?

This is where independent assurance matters.

Internal audit.

Risk.

Compliance.

External audit.

Clinical audit.

Independent experts.

Regulators.

Customer or patient evidence.

Protected workforce channels.

The question is not whether management should be believed.

It is:

“WHAT EVIDENCE EXISTS THAT WAS NOT CREATED FOR THE PURPOSE OF SUPPORTING THIS CONCLUSION?”

That distinction can be extraordinarily revealing.

An organisation may genuinely believe its culture is excellent.

An anonymous workforce survey may disagree.

A business unit may believe customers are satisfied.

Complaints may tell another story.

Executives may believe a control is working.

Internal audit may discover workarounds.

Independent evidence does not have to defeat the management position to be useful.

It simply has to test it.

3. THE VARIANCE TEST

What disappears inside the average?

Boards love averages.

Average engagement.

Average customer satisfaction.

Average waiting time.

Average safety performance.

Average employee turnover.

Average risk rating.

But organisations do not operate at the average.

People experience departments.

Sites.

Teams.

Managers.

Shifts.

Products.

Hospitals.

Branches.

Regions.

Customers.

Consider:

For Example "Organisation-wide employee engagement: 79%."

Comfortable.

Now disaggregate it:

Head Office: 91%

Region A: 86%

Region B: 77%

Region C: 49%

Same organisation.

Same overall dashboard.

Completely different governance problem.

AN AVERAGE CAN BE MATHEMATICALLY ACCURATE AND GOVERNANCE-BLIND.

Boards should periodically ask:

Where is the variation?

Where are the outliers?

Which group experiences this organisation differently from everybody else?

What does the enterprise result conceal?

Sometimes the most important governance information lives in the tails.

4. THE CONTRADICTION TEST

What evidence says we might be wrong?

This may be the most important test of all.

Management believes culture is improving.

Fine.

What contradicts that conclusion?

Turnover?

Sick leave?

Grievances?

Exit interviews?

Speak-up behaviour?

Vacancies?

Overtime?

Customer complaints?

The absence of challenge in meetings?

Suppose strategy is working.

What evidence suggests it isn't?

Suppose the transformation is on track.

Where is adoption failing?

Suppose patient safety is improving.

What are the near misses telling us?

Suppose AI is performing exceptionally well.

Where does it fail?

A BOARD SHOULD NOT ONLY ASK MANAGEMENT TO DEFEND ITS CONCLUSION.

IT SHOULD ASK FOR THE BEST EVIDENCE AGAINST IT.

That is not adversarial governance.

It is disciplined judgement.

Confirmation is comfortable.

Disconfirmation is informative.

5. THE SILENCE TEST

What should we be hearing that we are not hearing?

This is one of the hardest governance questions.

Complaints are down.

Good.

But why?

Incident reporting has fallen.

Good.

But why?

Nobody has used the whistleblower channel for six months.

Good?

Maybe.

Or perhaps not.

Organisational silence research has demonstrated for decades that employees can withhold concerns when they believe speaking up is futile, unsafe or unwelcome.

Psychological safety research shows why the environment surrounding voice matters.

So absence of reporting is not automatically absence of problems.

SILENCE IS DATA.

But its meaning must be interpreted carefully.

Boards should periodically ask:

Where would we expect challenge?

Where would we expect complaints?

Where would we expect incidents?

Where would we expect bad news?

And:

“IF SOMETHING WERE GOING WRONG HERE, HOW WOULD WE EXPECT TO HEAR ABOUT IT?”

If the answer is unclear, the organisation may have a detection problem before it has a performance problem.

6. THE DIRECT-EXPOSURE TEST

When did the board last encounter the organisation without a PowerPoint between them?

Directors should not manage operations.

But neither should their entire understanding of an organisation come through board papers.

Customers.

Patients.

Employees.

Suppliers.

Sites.

Services.

Operational leaders.

Control functions.

Regulators.

Each can provide a different window.

AICD guidance recognises the value of boards accessing accurate and, where necessary, independent stakeholder perspectives and engaging directly with stakeholders where appropriate.

APRA has similarly used employee-level surveys to understand risk culture beyond the views of senior executives and boards.

There is a reason.

THE ORGANISATION EXPERIENCED FROM THE BOARDROOM MAY NOT BE THE ORGANISATION EXPERIENCED FROM THE FRONTLINE.

But direct exposure requires discipline.

A site visit can be staged.

An employee can have an individual grievance.

A customer story can be unrepresentative.

One disturbing anecdote should not overturn population-level evidence.

Likewise, population-level evidence should not automatically erase a disturbing anecdote.

The purpose is not to choose one over the other.

It is to ask:

Why are they different?

🚨 THE DIVERGENCE IS THE SIGNAL.

This may be the most important principle in the entire framework.

Management says culture is strong.

Employee evidence says otherwise.

Do not immediately decide who is right.

Ask why they differ.

The safety dashboard is green.

Near misses are increasing.

Investigate the gap.

Customer satisfaction is excellent.

Complaint narratives are becoming more serious.

Investigate the gap.

Turnover is stable.

Sick leave is climbing.

Investigate the gap.

The transformation dashboard is green.

Frontline adoption is poor.

Investigate the gap.

WHEN TWO CREDIBLE SOURCES DESCRIBE DIFFERENT ORGANISATIONS, THE BOARD HAS JUST LEARNED SOMETHING IMPORTANT.

Do not average the contradiction away.

Govern it.

AND THEN THERE IS THE GREEN KPI

Boards naturally interrogate red.

Red gets attention.

Red produces questions.

Red creates action plans.

But perhaps boards should occasionally select something completely different.

Something reassuring.

Something green.

Then ask:

“PROVE TO US THAT GREEN MEANS GOOD.”

Not because success is suspicious.

Because improvement can have multiple explanations.

Reported incidents fell.

Did harm fall?

Complaints fell.

Did experience improve?

Turnover fell.

Did engagement improve?

Escalations fell.

Did operations improve?

Whistleblower disclosures fell.

Did culture improve?

The answer may be yes.

Excellent.

But boards should periodically test reassurance with the same curiosity they apply to deterioration.

GOOD NEWS DESERVES GOVERNANCE TOO.

AI MAKES THE REALITY CHECK MORE IMPORTANT

Soon, enormous amounts of organisational evidence will never be read directly by directors.

AI will summarise it.

Thousands of customer comments.

Incident reports.

Audit findings.

Employee responses.

Risk indicators.

Clinical data.

Project reports.

Market intelligence.

And the board may receive:

“No material emerging concern identified.”

That could be enormously valuable.

But the director should still ask:

What evidence contradicts that conclusion?

What outliers were excluded?

What assumptions drove classification?

What populations perform differently?

Which weak signals were considered immaterial?

What would change the conclusion?

AI can help boards find patterns human beings would miss.

It can also produce extraordinary confidence through elegant summarisation.

A BEAUTIFUL SUMMARY IS NOT INDEPENDENT ASSURANCE.

The board must retain the ability to test the conclusion.

THIS IS NOT AN INVITATION TO BECOME MANAGEMENT

There is an obvious danger.

Directors can go too far.

They can become operational.

They can undermine executives.

They can overreact to anecdotes.

Employees can attempt to bypass management through individual directors.

Raw operational information can be misunderstood.

Board requests can create enormous administrative burden.

The solution is not unlimited board access to everything.

It is disciplined sampling.

Select material claims.

Test them periodically.

Use independent evidence.

Look for variance.

Seek contradiction.

Interpret silence.

Gain appropriate direct exposure.

Then return to governance.

THE BOARD'S JOB IS NOT TO DISCOVER EVERY FACT.

IT IS TO KNOW WHEN THE FACTS IT IS RELYING UPON DESERVE CONFIDENCE.

SIX QUESTIONS COULD CHANGE A BOARD MEETING

The next time a material claim appears in a board pack, directors could ask:

1. What evidence actually supports this?

2. What evidence exists independently of the people making the claim?

3. What does the aggregate result conceal?

4. What credible evidence contradicts our conclusion?

5. What should we be hearing that we are not hearing?

6. What do people experiencing this directly see?

That is the Board Reality Check™.

Not another committee.

Not another dashboard.

Not another hundred pages in the board pack.

A discipline of independent challenge.

BECAUSE THE MOST DANGEROUS BOARD PACK MAY BE THE ONE THAT ANSWERS EVERY QUESTION.

Boards should expect management to know the organisation.

Boards should trust capable executives.

Boards should respect governance boundaries.

But trust and verification are not opposites.

Good governance requires both.

The board should therefore be able to answer one deceptively simple question:

“HOW DO WE KNOW?”

And importantly—

the answer cannot always be:

“BECAUSE MANAGEMENT TOLD US.”

Because the purpose of independent governance is not to assume management is wrong.

It is to ensure the board has enough independent evidence to know when management is right.

DON'T ASK FOR ANOTHER DASHBOARD.

ASK WHAT WOULD TELL YOU IF THE DASHBOARD WAS WRONG.

That may be one of the most important governance questions a board can ask.

Harvard References

Australian Institute of Company Directors (AICD) (2021) Elevating Stakeholder Voices to the Board: A Guide to Effective Governance. Sydney: Australian Institute of Company Directors.

Australian Institute of Company Directors (AICD) (2026) Governing Culture in a Complex World: Five Principles for Board Oversight of Organisational Culture. Sydney: Australian Institute of Company Directors.

Australian Prudential Regulation Authority (APRA) (2016) Risk Culture. Sydney: APRA.

Australian Prudential Regulation Authority (APRA) (2018) Prudential Practice Guide CPG 220 Risk Management. Sydney: APRA.

Edmondson, A.C. (1999) ‘Psychological safety and learning behavior in work teams’, Administrative Science Quarterly, 44(2), pp. 350–383.

Fang, C., Kim, J.H.J. and Milliken, F.J. (2014) ‘When bad news is sugarcoated: Information distortion, organizational search and the behavioral theory of the firm’, Strategic Management Journal, 35(8), pp. 1186–1201.

Francis, R. (2013) Report of the Mid Staffordshire NHS Foundation Trust Public Inquiry. London: The Stationery Office.

Institute of Internal Auditors (IIA) (2020) The IIA's Three Lines Model: An Update of the Three Lines of Defense. Lake Mary, FL: Institute of Internal Auditors.

Morrison, E.W. and Milliken, F.J. (2000) ‘Organizational silence: A barrier to change and development in a pluralistic world’, Academy of Management Review, 25(4), pp. 706–725.

OECD (2023) G20/OECD Principles of Corporate Governance 2023. Paris: OECD Publishing.

Reason, J. (1997) Managing the Risks of Organizational Accidents. Aldershot: Ashgate.

Vaughan, D. (1996) The Challenger Launch Decision: Risky Technology, Culture, and Deviance at NASA. Chicago: University of Chicago Press.

Weick, K.E. and Sutcliffe, K.M. (2015) Managing the Unexpected: Sustained Performance in a Complex World. 3rd edn. Hoboken, NJ: Wiley.