Thirty-eight slides and no questions
The finance report runs to 38 slides. The CFO walks the board through revenue, margin and cash in twenty minutes, the chair asks whether there are any questions, and there are none. The meeting moves on to the capital campaign.
Three things were not on the slides. The payroll bank account had not been reconciled since August. A new facilities contract had gone to a firm owned by a director's spouse. And the payables team had started pasting vendor invoices into a public chatbot to code them. None of it was hidden. Nobody asked. (This board is an illustrative composite, not a real organization.)
Directors do not need to be accountants to oversee finance. They need a short set of questions that ask for evidence rather than reassurance, asked in the same order every quarter, so that a change in an answer stands out.
Ask for evidence, not comfort
The questions below share three traits. Each has a factual answer: a number, a date or a name. Each can be answered from records a finance team with working controls already keeps. And each, asked every quarter, builds a trend the board can read.
Send the list two weeks before the meeting and ask for a one-page written answer to each, with attachments where they exist. A CFO with working controls can pull most of these answers from existing reports. If answering takes weeks of new work, that is itself an answer.
The twelve questions
| No. | Ask | A good answer sounds like | A worrying answer sounds like |
|---|---|---|---|
| 1 | When did the books close, and what was posted after the close? | "We closed on business day eight. Two entries came later, both under $5,000, both reviewed by me." | "We are still finalizing a few items," six weeks after the quarter ended. |
| 2 | Which balance sheet accounts were not reconciled and reviewed within 30 days of month-end? | "Every bank account was done by day ten. Two accrual accounts ran late, and here is why." | "Cash is fine. We watch the bank balance every day." |
| 3 | How many manual journal entries were posted, and did anyone approve their own? | "Forty-two above $10,000. None were self-approved; the system blocks it and we checked the report." | "The controller handles all of that." |
| 4 | Can anyone release a payment alone, and up to what amount? | "No. Two people release anything above $10,000 in the bank portal, and positive pay covers every account that issues checks." | "Only I can release payments, so it is safe." |
| 5 | How many vendor bank-detail changes did we process, and how was each verified? | "Nine. Each was confirmed by calling a number already on file. The log is attached." | "Payables updates them when vendors email." |
| 6 | What came in through the speak-up channel, and what is still open? | "Four reports in three categories. One is open at 40 days. We test-called the line in May." | "Nothing came in, which shows our culture is healthy." |
| 7 | What is on the related-party log, and what was added this quarter? | "Three standing items and a lease renewal, approved by the two directors with no interest, with a market rent comparison." | "We don't have any related parties," when the founder owns the building. |
| 8 | Which AI tools touch our financial data or transactions, and who approved each? | "Three, listed with an owner, the data each may use and the human review step. The payables agent cannot approve what it codes." | "None officially. People may use chatbots on their own." |
| 9 | Who has administrator rights in the ledger, the bank and payroll, and when was that reviewed? | "Two people in each system, reviewed in September. Leavers lose access on their last day." | "Our IT provider takes care of access." |
| 10 | How many weeks of cash do we have, and how much covenant headroom? | "Fourteen weeks on the rolling forecast. The tightest covenant has 18 percent headroom, lowest in the first quarter." | "The bank is happy with us." |
| 11 | Which findings from the auditor or our own reviews are still open, and which are overdue? | "Six open, two overdue, each with an owner and a revised date." | "We are working through the management letter." |
| 12 | What worries you that is not in this pack? | Something specific, such as a system migration in March that the revenue reconciliation is not ready for. | "Nothing comes to mind." |
The figures in the good answers are examples. What matters is the shape: specific, dated, and backed by a record the board could ask to see.
Four answers deserve a closer look
Hotline activity
The ACFE's 2026 occupational fraud study finds that tips are the most common way fraud comes to light, and that the channels most often used for those tips were web forms (46 percent), email (34 percent) and phone (23 percent). It also associates anti-fraud controls with lower losses and faster detection. A channel nobody uses may be unknown or distrusted rather than unneeded. Ask for counts by category, the age of open cases, how cases were closed, any retaliation complaints, and the date someone last tested the channel. If you are building or rebuilding one, our guide to whistleblower hotline setup for smaller companies covers the design choices.
The related-party log
The log should exist as a document, not as the CFO's memory. Each entry needs the relationship, the transaction, the amount, who approved it and how the terms were tested against the market. Our article on related-party transactions sets out a policy and an annual workflow.
AI use
COSO's February 2026 guidance on internal control over generative AI builds its roadmap around governance and an inventory of AI use cases, and it names shadow AI as a risk. A board does not need to judge the models. It needs to know that the list exists, that each tool has an owner, and that no AI agent can both prepare and approve the same transaction.
Cash and the close
The Association for Financial Professionals reported in April 2026 that 76 percent of US organizations experienced attempted or actual payments fraud in 2025, and that checks were the payment method most often targeted. Questions 2, 4 and 5 test the controls that address it most directly. A slow or messy close is where errors and theft wait to be found, which is why question 1 comes first.
Different boards, different pressure points
Nonprofit boards
- Federal awards. A nonprofit that spends $1,000,000 or more in federal awards in a fiscal year needs a single or program-specific audit for that year under 2 CFR 200.501. Ask the CFO for the projection, not just the year-to-date figure. The single audit threshold checker gives a first read.
- Form 990 governance questions. Part VI asks whether the organization has a written conflict of interest policy, whether officers, directors and key employees must disclose interests annually, and how compliance is monitored and enforced. It also asks whether a complete copy of the final return went to every voting board member before filing. A board that receives the related-party log each quarter can answer those questions with evidence.
Private-company boards
- Lender certificates. Ask who signs the covenant compliance certificate, what was checked before signing and where the calculation is kept.
- Owner transactions. In founder-led and family companies, related parties are often the owners themselves. Question 7 matters most where the people approving a transaction also benefit from it.
Put the answers in the minutes
Minutes that say "the board discussed the financial report" record nothing. Minutes that note the answers to each question, the attachments received and the follow-ups assigned show oversight that actually happened. At least once a year, give the CFO time with the board without the chief executive present, and give the external auditor time without management. Questions people would not ask in front of their boss tend to come up then.
Where to start
Use the twelve questions at your next meeting, unchanged, and keep the answers. After two quarters, the gaps will show. If you want an outside view of the board pack, the delegation-of-authority matrix and the related-party process, that is the scope of a board and governance review.