Board & Governance Setup for B2B SaaS Scale-Up

Draft Audit Committee charter (NACD-aligned, private-SaaS-customized)

Adapt BDO's Illustrative Audit Committee Charter (https://www.bdo.com/insights/assurance/illustrative-audit-committee-charter), NACD's Audit Committee Charter sample (https://prod.nacdonline.org/all-governance/governance-resources/committees-and-roles/full-board-operations/documenting-governance/audit-committee-charter/), and Deloitte's sample for a private SaaS: drop SOX 404, keep external-auditor relationship, internal-control oversight, financial-statement review, compliance, whistleblower channel, annual self-eval. Series B+ gated. Cross-references M7 risk register (Audit Committee owns the quarterly risk review).

Set Audit Committee meeting cadence (>=4x/yr) + agenda

Lock cadence: 4 meetings/year (each tied to quarterly close), 60-min agenda template (financials review, internal-control update, external-auditor letter Q&A, compliance update, whistleblower channel review). Reference https://prod.nacdonline.org/all-governance/governance-resources/committees-and-roles/full-board-operations/documenting-governance/audit-committee-charter/ for the standing-agenda pattern. Cross-references M4 board-pack cadence so the Audit Committee output flows into the board meeting.

Identify + appoint Audit Committee chair (financial expert)

Identify and appoint Audit Committee chair - must be a financial expert (former CFO, controller, or audit-firm partner). Independent director. Per a16z's public-readiness expert persona (https://a16z.com/the-strategic-approach-to-building-a-board/), this slot grows in importance as the company approaches IPO. Cross-references M3 because the chair appointment may overlap with director recruiting.

Draft Compensation Committee Charter

Adapt the NACD-Pearl Meyer Compensation Committee Blueprint (https://pearlmeyer.com/press-releases/nacd-and-pearl-meyer-publish-compensation-committee-blueprint) for private SaaS: scope = exec compensation, equity grants, CEO performance review, equity pool refresh, 409A coordination, key-employee retention agreements. Drop public-co Say-On-Pay. Series B+ gated. Cross-references M7 - key-employee retention links to D&O context.

Set Comp Committee cadence (>=3x/yr) + topics

Cadence >=3 meetings/year: pre-bonus-cycle review, equity-grant review, CEO performance review (anchored to executive session). Reference NACD private company governance (https://www.nacdonline.org/all-governance/governance-resources/core-oversight-topics/private-company-governance/). Cross-references M5.S1 - the CEO review is handed off from executive session.

Establish equity-pool top-up & 409A refresh policy

Policy for option-pool top-ups, 409A refresh cadence (every 12 months minimum, every priced round), grant-approval thresholds (Comp Committee approves all C-suite grants; CEO has discretion below VP). Reference NVCA Indemnification Agreement and IRA (https://nvca.org/model-legal-documents/) for related authorities. Cross-references pricing-packaging because the M7 risk register tracks dilution discipline.

Draft Nom-Gov Committee Charter (NACD-aligned)

Adapt the NACD Nominating & Governance Committee Charter (https://www.nacdonline.org/about/board-of-directors/nominating-governance-committee-charter/) for private SaaS. Three+ independent members. Duties: annual board composition review, succession planning, director recruiting criteria, governance practices, board evaluation oversight, code of ethics oversight, conflicts management, observer-policy review. Reference NACD-Korn Ferry Nom-Gov Blueprint. Series C+ gated; Series B can defer if board <7 seats. Cross-references M3, M5, M6.

Set Nom-Gov cadence (>=2x/yr) + responsibilities

Per NACD guideline (https://www.nacdonline.org/about/board-of-directors/nominating-governance-committee-charter/), meets >=2x/year. T2D3 standard for actively recruiting boards: >=4x/year during recruiting phase, >=2x/year steady state. Topic rota: spring = composition review + recruiting plan; summer = governance review + ethics; fall = annual eval; winter = director succession + conflicts review. Cross-references M3, M5, M6.

Update bylaws to reflect new committee structure

Update corporate bylaws to add the three standing committees (Audit, Comp, Nom-Gov), define quorum rules, reference the LID role. Counsel-led; full board ratification. Reference https://nvca.org/model-legal-documents/ as a starting point for typical SaaS-stage bylaws. Cross-references M2.S2.1 through S2.3 - bylaws follow charter creation.

Refresh voting agreement to current cap table (NVCA Oct-25)

Refresh the voting agreement against the NVCA Model Voting Agreement Oct-2025 (https://nvca.org/document/nvca-model-voting-agreement-updated-oct-2025/) - note the default that designation rights do not transfer on assignment of shares. Align preferred-1/preferred-2/common/independent seat assignments to current cap table. Per Foley & Lardner's NVCA October 2025 update analysis (https://www.foley.com/insights/publications/2025/10/breaking-down-the-nvca-what-founders-and-vcs-need-to-know/). Feature-gated: refresh if customer.last_voting_agreement_year < 2025.

Activate sourcing channels (network + retained search)

Activate sourcing across CEO/investor network, peer-CEO referrals (per Wilson's preference for peer-CEO independents at https://avc.com/2014/12/the-perfect-board/), and one retained search firm if persona slot is hard-to-fill (industry expert in regulated vertical, public-readiness expert). Use the persona-slot brief from M1.S1.4 as the search mandate. Cross-references M1 because the gap memo and target roster diagram drive this work.

Build shortlist of 5-8 candidates per open slot

Triage referrals into shortlist of 5-8 per slot. Score against rough-cut: persona fit, time commitment, conflicts. Cross-reference for known conflicts (competitor boards, pending strategic relationships). Reference https://bothsidesofthetable.com/what-makes-a-great-independent-board-member-4f2837963e30 for Suster's rough-cut criteria. Cross-references M1 - the shortlist must match the persona heatmap.

Build T2D3 director interview rubric (6 dimensions)

T2D3 proprietary director interview rubric, 6 dimensions weighted: domain credibility (20%), network depth (15%), board chemistry (15%), time commitment (15%), references (20%), conflicts (15%). Reference Mark Suster's What Makes a Great Independent Board Member (https://bothsidesofthetable.com/what-makes-a-great-independent-board-member-4f2837963e30). The rubric is the consistent scoring artifact across all candidates. Each dimension carries a 30-question bank.

Run 2-round interview process per finalist

Run two-round interview per finalist: round 1 = CEO + Board Chair / LID (90 min, persona fit + chemistry); round 2 = 1:1 with each existing independent director + lead investor (30 min each). Score against rubric. Reference https://bothsidesofthetable.com/what-makes-a-great-independent-board-member-4f2837963e30. Cross-references M1 - finalists are scored against the persona heatmap.

Run reference-call protocol (>=2 prior CEOs + 1 co-director)

Build director comp package (Wilson model)

Build the comp package per Fred Wilson's framework (https://avc.com/2020/08/independent-director-compensation/): annual value $100K-equivalent in equity; 0.25% per year served at <$40M EV; $100K/EV at >$40M EV; 4-year vest with optional front-load. Offer-letter draft + 409A check. Cross-references pricing-packaging because director comp links to overall equity discipline.

Issue indemnification agreement + confirm D&O coverage

Execute the NVCA Model Indemnification Agreement (https://nvca.org/model-legal-documents/) with each new director and confirm D&O policy covers the new directors. Coordinate with M7 D&O work. Cross-references M7 - the Side B reimbursement mechanism in D&O depends on a valid indemnification right.

Hold board election + record in voting agreement

Formal election via voting agreement (or special board meeting). Update Cap Table seat assignments (M2.S2.4). Reference https://nvca.org/document/nvca-model-voting-agreement-updated-oct-2025/. Cross-references M2 because the voting agreement governs which seats are designated, common, or mutual-consent independent.

Build new-director onboarding pack

Build the onboarding pack: 3 prior board decks + minutes; KPI dashboard with definitions; bylaws + voting agreement + 3 committee charters; cap table; key customer / key competitor briefs; 18-month plan + persona-slot brief; product demo recording. Reference https://growth.eladgil.com/book/cofounders/the-role-of-the-ceo-managing-your-board-of-directors/ for Gil's onboarding pattern. Cross-references M2 (charters) and M4 (KPI dashboard, board pack).

Run new-director 1:1s with each C-suite exec

Schedule 30-45 min 1:1s with each C-suite exec for the new director within 30 days of seating. Reference Elad Gil's onboarding patterns (https://growth.eladgil.com/book/cofounders/the-role-of-the-ceo-managing-your-board-of-directors/). Cross-references ceo-transition (similar listening tour) - the structure is the same as the new-CEO listening tour.

Build a16z 16-metric baseline dashboard

Implement the a16z 16-metric framework as the baseline board KPI dashboard (https://a16z.com/16-startup-metrics/, https://a16z.com/16-more-startup-metrics/): bookings vs revenue, ARR/MRR, gross margin, TCV/ACV, LTV (12/24 mo), deferred revenue + billings, paid CAC, NDR, gross logo churn, active users, CMGR, burn multiple, customer concentration, NPS, cohort analysis, forecast vs actual. Stand up in Looker / Metabase / Standard Metrics. Cross-references the cross-playbook KR pull task that follows.

Layer cross-playbook KRs onto board dashboard

THIS IS THE CROSS-PLAYBOOK INTEGRATION TASK. Layer onto the dashboard the operating KRs from each upstream T2D3 playbook the customer has installed. Required pulls (>=5, full standard pulls from all 11): ARPA from pricing-packaging.kr1-1-arpa-uplift; NRR from pricing-packaging.kr1-2-nrr-target; gross margin from pricing-packaging.kr1-3-gross-margin; win rate from sales-methodology.kr1-1-win-rate-plus-8; forecast accuracy from sales-methodology.kr1-3-forecast-accuracy-pm-5; free->paid conversion from plg-transformation.kr-free-paid-conversion; CAC payback from plg-transformation.kr-blended-cac-payback; SQO/SDR from outbound-sdr-engine.kr-sqo-per-sdr-month; pipeline coverage from outbound-sdr-engine.kr-outbound-sourced-pipeline-coverage; activation lift from continuous-discovery.kr-2-1-activation-lift; CAC from duct-tape-marketing.kr1-4-cac-payback-down-20; pragmatic-framework maturity score; international ARR from country-expansion.kr-2-1; M&A synergy run-rate from ma-integration.kr-synergy-runrate-50pct (if active). The board pack thus becomes the consolidated outcome view of the whole T2D3 OS rollout. Reference Bessemer Cloud 100 Benchmarks (https://www.bvp.com/atlas/the-cloud-100-benchmarks-report) for thresholds.

Define red/amber/green thresholds per metric

For each of the ~25 metrics on the dashboard, set red / amber / green thresholds. Anchor on Bessemer Cloud 100 medians and top quartile. Example: NRR - green >=120% (top-quartile), amber 105-119%, red <105%. ARPA - green >=+25% YoY, amber 0-25%, red <=0%. Reference Bessemer Cloud 100 Benchmarks Report (https://www.bvp.com/atlas/the-cloud-100-benchmarks-report). Cross-references pricing-packaging, sales-methodology, plg-transformation - threshold benchmarks come from each.

Build monthly KPI email cadence (between-meetings)

Between board meetings, send a monthly KPI email - same dashboard view + 200-word CEO commentary. Sacks-pattern (https://sacks.substack.com/p/the-saas-board-meeting): keeps board warm without consuming meeting time. Cross-references M4.S2.1 CEO letter template - the monthly email reuses the same data view, narrower commentary.

Build CEO letter template (8 sections, Pain-Claim-Gain)

Build T2D3's 8-section CEO letter template: Headline, Pain (top 3 risks), Claim (top 3 quarterly bets), Gain (expected outcomes per bet w/ metrics), Asks of the board (1-3 specific), Top metrics this quarter (RAG dashboard pointer), Personnel (hires + transitions), Last meeting follow-ups. Replaces ceremonial cover letter. Sent 48 hr ahead. Pain-Claim-Gain framing per T2D3 IP. Reference Sacks's What's going well / what's not (https://sacks.substack.com/p/the-saas-board-meeting).

Build deep-dive template (1-2 strategic topics per meeting)

Build deep-dive template: 1-2 strategic topics per meeting, 5-8 slides each, structure: context, options, recommendation, asked-of-the-board. The Sacks pattern (https://sacks.substack.com/p/the-saas-board-meeting) - meeting time spent on big decisions, not numbers Q&A. Anchors KR2.2 (>=1 strategic decision per meeting).

Set 48-hour pre-read SLA + Chief-of-Staff ownership

Set 48-hr pre-read SLA (Sacks 24-48h per https://sacks.substack.com/p/the-saas-board-meeting; Gil 48-72h per https://growth.eladgil.com/book/cofounders/the-role-of-the-ceo-managing-your-board-of-directors/; T2D3 standard 48h minimum). Owner: Chief of Staff. Lock pre-read 48 hr out; ad-hoc late updates appended as separate doc. Tracked monthly; escalated if missed. Anchors KR1.3 (100% pre-read at 48 hr).

Lock standing meeting agenda (Sacks 2-hour template)

Lock the standing meeting agenda following David Sacks's SaaS Board Meeting template (https://sacks.substack.com/p/the-saas-board-meeting): CEO Update 30m, Sales Update 30m, Other Departmental 20m, Financials 10-20m, Team 10-20m, Admin/Closed 5-10m, Executive Session 15m -> total ~2 hr. Pre-empts long-winded reporting. Cross-references M5 - the executive session is the last 15-min block.

Set quarterly cadence (2-3 wks post-quarter-close)

Schedule 4 board meetings/year, 2-3 weeks post-quarter-close (per Sacks https://sacks.substack.com/p/the-saas-board-meeting: 'schedule shortly after the quarterly close, so the sales data is conclusive and fresh'). Lock dates 12 months out. Reference Umbrex Standard Board Meeting Cadence (https://umbrex.com/resources/private-equity-board-member-handbook/standard-board-meeting-cadence/). Cross-references M2 because committee cadences (Audit, Comp, Nom-Gov) flow into board meetings.

Schedule pre-meeting 1:1s with each director

Build decision log standard (1+ strategic decision per meeting)

Standardize the decision log: every meeting captures >=1 strategic decision in minutes (decision, owner, deadline, follow-up tracker). KR2.2 measurement spine. Anti-pattern guard against 'great discussion, no decisions.' Reference https://sacks.substack.com/p/the-saas-board-meeting for the Sacks 'every meeting closes with a list of decisions' pattern. Cross-references M5 - executive-session decisions are captured separately.

Set minutes standard (Chief of Staff drafts in 48 hr)

Minutes standard: Chief of Staff drafts within 48 hr, lead-independent-director reviews, circulated to full board within 5 business days. Captures: attendance, votes, executive session held Y/N, committee reports, decisions, action items. Drop verbatim discussion (per executive-session legal guidance). Reference Jones Day on running effective executive sessions (https://www.jonesday.com/-/media/files/publications/2006/04/running-effective-executive-sessions-idirectors-b/files/kopesrodmanpdf2q06/fileattachment/kopesrodmanpdf2q06.pdf). Cross-references sell-side-ma-prep - minutes feed diligence.

Ad-hoc decision protocol (between-meeting unanimous-written-consent)

Protocol for between-meeting decisions that can't wait: mid-quarter check-in (1-hour video), unanimous written consent for binary actions (option-pool top-up, exec hire approval). Reference NVCA Voting Agreement Oct-2025 (https://nvca.org/document/nvca-model-voting-agreement-updated-oct-2025/) for required-consent thresholds. Cross-references M2 because the voting agreement governs which actions can be taken by written consent vs require a meeting.

Build board-asks tracker (intros, debate, decisions)

Tracker for the 'Asks of the board' section of the CEO letter (intros to target customers, debate on strategic option, decision on exec offer). Captures: who is asked, what was asked, status (open / engaged / done / declined), close date. Visible to board. Reference https://growth.eladgil.com/book/cofounders/the-role-of-the-ceo-managing-your-board-of-directors/ on Asks-discipline.

Establish executive-session-as-standard ritual (last 15 min)

Make executive session a standing agenda item - the last 15 minutes of every board meeting. CEO leaves the room but not the building. Cited explicitly in proprietary IP per the design brief. Reference Bank Director - 9 Ways to Do Executive Sessions Right (https://www.bankdirector.com/article/9-ways-to-do-executive-sessions-right/) and AHA Trustee Services (https://trustees.aha.org/best-practices-executive-sessions-without-ceos). Document only 'executive session held; no formal actions.' Anchors KR2.3.

LID debrief protocol (<=24h written/verbal)

Lead-independent-director debrief protocol: written or verbal within 24 hours of executive session. Single-voice channel; doesn't reveal individual director comments; covers themes + action items. Reference NACD Executive Sessions FAQ at https://www.nacdonline.org/insights/publications.cfm?ItemNumber=41388. Cross-references M1.S3 LID charter.

Hand off CEO performance review to executive session

Move CEO performance review out of full-board agenda and into executive session. Annual deep review owned by Comp Committee + LID. Reference https://www.bankdirector.com/article/9-ways-to-do-executive-sessions-right/ for the ritual. Cross-references M2.S2.2 (Comp Committee charter) and M6 (annual eval).

Establish observer cap (<=2) + silent-observer default

Hard cap of 2 observers; silent-observer default unless specifically waived by Nom-Gov. References: Mark Suster on observers (https://bothsidesofthetable.com/should-you-allow-board-observers-on-your-startup-board-cbc4754a0700) - 'almost nothing at a board ever goes to an actual vote, and the way you have power on a board is through the power of talk.' Inc - Why You Should Avoid Adding Board Observers (https://www.inc.com/mark-suster/startup-board-observer-member-silent.html). Harvard Corp Gov Forum - Board Observer Considerations and Limitations (https://corpgov.law.harvard.edu/2025/07/02/the-board-observer-considerations-and-limitations/) on FTC/DOJ scrutiny and competitively sensitive information. Feature-gated by customer.has_observers == true.

Build observer agreement template (NDA + COI carve-out)

Build observer agreement template based on Harvard Corp Gov Forum guidance (https://corpgov.law.harvard.edu/2025/07/02/the-board-observer-considerations-and-limitations/): explicit confidentiality covenant surviving termination, conflict-of-interest exclusion (observer steps out of competitor M&A discussions, term-sheet negotiations involving the observer's firm), trade-secret carve-out, attorney-client privilege carve-out, insider-trading compliance, annual review. Reference Authority Inc on D&O coverage gaps for observers (https://www.authority.inc/manual/best-do-insurance-for-pre-ipo-saas-companies-backed-by-tier-1-vcs). Cross-references M7 D&O context.

Conflict-of-interest protocol (pre-meeting disclosure + recusal)

Conflict-of-interest disclosure + recusal protocol. Pre-meeting questionnaire (any new conflicts in the quarter? competitor board joined? customer relationship?). Recusal clause in bylaws. Owner: Nom-Gov. Reference NACD Nom-Gov Charter (https://www.nacdonline.org/about/board-of-directors/nominating-governance-committee-charter/). Cross-references M2.S2.3 (Nom-Gov ownership).

Related-party transaction policy (Audit Committee approval)

Policy: any related-party transaction (director-affiliated vendor, founder-side-deal, investor-portfolio-cross-sell) requires Audit Committee disclosure + approval. Reference BDO Audit Committee Charter on related-party oversight (https://www.bdo.com/insights/assurance/illustrative-audit-committee-charter). Cross-references M2.S2.1 (Audit Committee charter).

Build T2D3 annual board self-eval instrument

Build the T2D3 annual board self-eval instrument adapted from NACD Sample Board & Committee Self-Evaluation Form (https://www.nacdonline.org/all-governance/governance-resources/governance-research/sample/sample-board--board-committee-self-evaluation-form/), BoardEffect's self-eval template (https://www.boardeffect.com/blog/self-evaluation-template-board-directors/), and BoardSource's guidance (https://boardsource.org/resources/successful-board-self-assessment/). 4 sections: (a) full-board effectiveness; (b) committee effectiveness (Audit / Comp / Nom-Gov); (c) individual director self-rating; (d) CEO-board relationship. ~25 questions, mix of Likert + open. Cross-references M2.S2.3 (Nom-Gov owns eval).

Run first annual eval cycle

Run the first annual cycle: all directors complete instrument anonymously, lead-independent-director synthesizes themes, results presented at next board meeting executive session, action items handed to Nom-Gov. Reference Diligent's best practices (https://www.diligent.com/resources/blog/best-practices-for-board-of-directors-self-assessment) on anonymous synthesis. Cross-references M5 - results land in executive session.

Capture per-director 90-day improvement commitments

Capture per-director 90-day improvement commitments (specific, measurable). Tracked at next exec session. Lifts board NPS. Reference https://www.nacdonline.org/all-governance/governance-resources/governance-research/sample/sample-board--board-committee-self-evaluation-form/ for the commitment-capture pattern.

Set director continuing-education budget

Allocate a per-director continuing-education budget (NACD courses, governance conferences, AI literacy curriculum). Reference NACD Governance Guidelines (https://www.nacdonline.org/about/board-of-directors/governance-guidelines/). Cross-references M2.S2.2 (Comp Committee approves the budget).

Annual onboarding-pack refresh + new-policy briefings

Annually refresh the new-director onboarding pack (M3.S3.4). Add: new committee charters, annual eval results, refreshed KPI dashboard, new-policy briefings (e.g., new product pivot, M&A integration in flight). Reference https://growth.eladgil.com/book/cofounders/the-role-of-the-ceo-managing-your-board-of-directors/ for the refresh cadence. Cross-references M3.S4.1 (the original pack).

Annual board offsite (strategy + chemistry)

Annual 1.5-day board offsite: half day strategy deep-dive (M&A, adjacent-market entry, founder transition), half day chemistry / dinner. T2D3 standard ~1x per year, scheduled adjacent to annual eval cycle. Builds the board-NPS lift (KR2.1). Reference https://growth.eladgil.com/book/cofounders/the-role-of-the-ceo-managing-your-board-of-directors/ on offsite design. Cross-references ceo-transition (similar offsite cadence).

Set director-rotation plan (term limits + succession)

Director-rotation plan: term limits (e.g., 3-year terms with renewal option, max 9 years for independents), succession-planning matrix (which seats roll over when, who's the bench). Owner: Nom-Gov. Reference NACD Nom-Gov Charter (https://www.nacdonline.org/about/board-of-directors/nominating-governance-committee-charter/) on succession planning. Cross-references M3 (recruiting bench).

Annual charter refresh (Audit / Comp / Nom-Gov)

Annual refresh of the three committee charters in light of eval results, regulatory changes, and stage shifts. Owner: Nom-Gov. Reference https://www.nacdonline.org/about/board-of-directors/nominating-governance-committee-charter/ for the annual review pattern. Cross-references M2 (charters).

Build D&O scope rubric (5 questions Woodruff/Gallagher)

Build T2D3 D&O scope rubric using the Woodruff Sawyer / Gallagher 5 Key Questions (https://www.ajg.com/merger-partners/woodruff-sawyer-is-now-gallagher/) and Coyle Group D&O Limits Guide (https://thecoylegroup.com/insurance-by-coverage/directors-and-officers-liability-do/how-much-do-insurance-is-enough/) framework: revenue + headcount, ACV concentration, regulatory exposure, cap-table size + investor mix, prior-litigation history. Map to recommended limit band: Series A $1-3M; Series B $5-10M; Series C $10-25M; pre-IPO/late-stage $25M+. Cross-references M3 (each director's coverage flows from this rubric).

Run broker tender / get 3 quotes

Tender to 3 D&O brokers (Vouch, Embroker, Founder Shield are the SaaS-fluent brokers). Get 3 quotes for the target limit band + retention. Reference Baldwin's 2024 D&O / Cyber Benchmarking Report (https://baldwin.com/2024-directors-and-officers-insurance-benchmarketing-report/) for market context. Premium expectation: 0.5-1.5% of limit for healthy private SaaS.

Bind refreshed policy + Side A/B/C structure

Select policy + bind. Confirm Side A (independent director protection if company can't indemnify), Side B (company reimbursement), Side C (entity coverage). Per GB&A on D&O Limit Setting (https://www.gbainsurance.com/DO-Limit-Setting-224), prefer dedicated Side A excess at Series C+. Cross-references M3 (each director gets a coverage confirmation letter).

Align indemnification agreement to D&O policy

Align the NVCA Model Indemnification Agreement (https://nvca.org/model-legal-documents/) with each director against the bound D&O policy. Side B reimbursement requires the indemnification right; if the indemnification agreement is narrower than D&O Side B, gap remains. Cross-references M3 (indemnification was issued at director seating).

Build top-15 enterprise risk register

Build a top-15 enterprise risk register: cyber, key-person, customer concentration, regulatory, IP, vendor, M&A integration, key-employee retention, AI / model COGS, foreign-currency exposure, etc. Each risk: likelihood x impact, mitigation, owner, status. Reviewed quarterly. Reference https://www.bdo.com/insights/assurance/illustrative-audit-committee-charter on risk oversight. Cross-references M2.S2.1 (Audit Committee owns the quarterly review).

Wire quarterly risk review into Audit Committee

Wire the quarterly risk review into the Audit Committee agenda. Include cyber-incident summary, key-customer status, key-employee status. Reference BDO Audit Committee Charter on risk oversight (https://www.bdo.com/insights/assurance/illustrative-audit-committee-charter). Cross-references M2.S2.1 (Audit cadence).

Build crisis-comms plan (data breach, executive misconduct, key-customer loss)

Crisis-comms plan covering 3 archetypes: data breach (technical + customer + regulatory), executive misconduct (HR + legal + PR), key-customer loss (CRO + CEO + investor comms). Each archetype: trigger, escalation tree, comms templates, board-notification SLA (<=24 hr for material events). Reference https://corpgov.law.harvard.edu/2025/07/02/the-board-observer-considerations-and-limitations/ on board notification expectations. Cross-references ma-integration and ceo-transition (similar crisis archetypes).

Establish whistleblower channel with Audit Committee oversight

Whistleblower channel with anonymous-reporting platform (e.g., EthicsPoint, Lighthouse, Whispli). Audit Committee receives summary; cases escalate to LID. Reference BDO Audit Committee Charter on whistleblower oversight (https://www.bdo.com/insights/assurance/illustrative-audit-committee-charter). Cross-references M2.S2.1 (Audit Committee oversight).