What is the Board Independence control?
Strike Graph's default control language is: “The Board of Directors come from diverse backgrounds and operate independently from management."
This language should be customized to reflect the specific process that your organization has defined. For example, if your board operates in a different manner or if you notice key information missing from this description, then you should update the control language to reflect that. It's important that your stated control description accurately reflects how your organization implements this control.
Why is this control important?
The purpose of this control is to satisfy SOC 2 - CC 1.2 which states: The board of directors demonstrates independence from management and exercises oversight of the development and performance of internal control.
Who’s involved with this control?
Typical control owner: The board of directors (or founders, partners, owners).
Typical parties involved: Executive leaders and board members.
How often should I perform this control?
Typical frequency: Continuously
How do I demonstrate this control?
For organizations that have a board of directors:
A list of all board members and their backgrounds (resume, CV, LinkedIn profile)
A web page listing the organization’s board members, with a brief bio
Board minutes that show the performance of internal control. This may look like a dashboard of readiness for a compliance audit, an internal or external audit report on the effectiveness of the control environment, or even a control remediation status dashboard (such as your Strike Graph dashboard).
For organizations that do not have a board of directors, or that include members of the board that are not independent of management:
Consider the group of individuals that have ultimate governance over the organization. This could be a partnership group, owners, founders, and a mix of company leaders and investors.
*Customize this control to reflect what is actually in place. For example:
The organization is governed by a group consisting of founders and key investors. This group meets quarterly to discuss business operations, staffing, and funding.
The founding partners/owners provide organizational oversight in place of a board of directors. The partner/owner group meets quarterly to assess company performance against objectives.