The problem
Boards have areas they should review on a cycle, but the programme lives in a spreadsheet or a clerk's memory. Reviews slip, the same governors carry most of the work, and weak results do not always reach the board.
What I built
A three-year map of the board's assurance reviews, term by term. Each term shows how many reviews land and its highest-risk theme. Each review shows its cadence, its basis, the lead governor, a due date and its state: Planned, Lead assigned, Evidence requested, In progress, Ready to review or Closed.
A full review runs the matching Audit Hub check and sends it to the person who holds the knowledge. Between full reviews, a lighter action check asks whether circumstances have changed and whether last time's actions are complete. A review held outside the portal can still be recorded, with the reviewer, the date and where the evidence is held.
Design decisions
Nothing reaches the board without a person choosing to send it. Routine secure reviews close with the lead governor; weak results, overdue high-risk work and evidence concerns can be escalated to the board with a recorded reason. Reviews that follow SGAF's recommended frequency say so, and never claim that the law requires that frequency.
What you can see
The three-year map, the term view and a count of open reviews per lead, so the board can spread the work fairly.
The result
A review programme that runs on dates and owners rather than memory, connected to the checks, the visits and the Risk Register.