Commitments carry forward until closed
The section readers return to is the commitments table. Each commitment is written so that a reader can tell whether it happened. "By 30 June, every vendor bank change is confirmed by a call to a number already on file" qualifies. "Strengthen payment controls" does not. The next report lists the same commitment again with a status. It can be met, still in progress with a new date, or withdrawn with a reason. It cannot quietly disappear.
Controls sections name real limits
Management describes the controls that matter most and is specific about them: payments over $10,000 need two approvers in the bank portal, manual journal entries are reviewed by the controller within five business days, user access is reviewed every quarter. Where a control is new or a gap remains, the report says so and gives the date it will be fixed.
We test these statements before publication. If the stated rule is two approvers but the bank portal shows one user releasing payments alone, either the statement changes or the control does. If the controls themselves have never been examined, a Controls Health Check is a sensible first step before you write about them.
Every figure has a source
Every number in the report appears in the evidence file with its source: the hotline log export, the user-access listing, the board attendance record. Figures that rest on judgment, such as which reports were substantiated, carry a short note on how the judgment was made. Where a figure would mislead on its own, such as zero speak-up reports from a channel launched in November, the report gives the context rather than presenting the number as good news.
It answers the recurring questions once
A board uses the report to see a year of governance in one place. A foundation reads it alongside a grant application. A lender or bank partner files it with its periodic review. A buyer finds it in the data room and starts from a documented position rather than a blank questionnaire.
If you want the same information kept current between reports, the Integrity Center publishes it on your own site and updates it by subscription. For the case for disclosing at all when no law requires it, see voluntary financial transparency for private companies.
