Write a board report on information security management addressing the following questions.

Intro

1. Remind the Board of the scope of the corporate compliance program.
2. What is the purpose of the compliance programs?
3. What results does corporate compliance aim to address?

Summary of Findings

1. What assessments and/or analyses (risk assessment, program assessment, gap analysis, etc.) did the compliance committee conduct?
2. For each assessment or analysis, explain why it was conducted.
3. What vulnerabilities, threats, and/or improvement opportunities are major concerns?
4. What regulatory requirement(s) are of most concern?
5. What is the consequence(s) of not addressing the identified risks?

Summary of Recent Changes

1. Describe changes and decisions that were made across the elements of a compliance program.
   1. Hint: refer to OIGs Measuring Effectiveness document.
2. Which policies or procedures were updated?
3. Were audits or monitoring practices added or revised based on the summary of findings?
4. What is the frequency in which the new or revised practices will occur?
5. Which departments or champions will be involved with these adjustments?

Target Updates

1. Describe quantifiable outcomes the program changes intend to achieve.
2. What non-compliance indicators are the recent changes intended to decrease? By how much and by when?
3. What compliance-related indicators are the recent changes intended to increase? By how much and by when?