The Year-End Letter: What the Board Should Put in Writing

Boards talk about cyber all year: the updates, the metrics, the incident review in March, the budget question in October. Almost none of it is written down as the board's own view. When January arrives, the record shows what management reported, not what the board concluded.

A short year-end letter fixes that. One page from the chair to the owner or the leadership team: what the board saw this year, what it appreciates, what it expects next year, and which questions are still open. It takes an hour to write and it changes how the next year starts.

Key takeaways

• Minutes record what was said; a letter records what the board concluded.

• One page is enough: thanks, observations, expectations, open questions.

• Write it as the board's view, plainly, without management-speak.

• The letter is not an evaluation ambush. Nothing in it should be news.

• Deliver it before the holidays so January starts from the same page.

Step 1: Start with genuine recognition

Name what actually happened this year: the incident that was handled well, the training completion that finally moved, the budget that was spent on the right thing. Be specific. Vague praise reads like a form letter and lands like one.

This is not flattery. It is the board confirming it was paying attention, which is what makes the rest of the letter credible.

Step 2: State the board's observations in plain words

Two or three things the board noticed, stated as observations rather than verdicts. The metrics that moved and the one that did not. The topic that kept slipping off the agenda. The question that never got a clear answer.

Keep each observation to a sentence or two. If a point needs three paragraphs, it needs a meeting, not a letter.

Step 3: Set next year's expectations now

The strongest part of the letter is the short list of what the board expects to see next year: the quarterly metric that matters, the decision that must come back to the board, the open item that cannot roll into another December.

We wrote about setting next year's cyber expectations for management earlier this month. The letter is where those expectations become the board's written position rather than a conversation someone half-remembers.

Step 4: Close with the open questions

End with the questions the board still has, the ones that did not get answered this year. Naming them in writing means they start January as agenda items instead of lingering as unease.

Keep it to two or three. A long list of open questions says the board has not been forcing decisions; a short one says it knows exactly where it wants to go deeper.

Frequently asked questions

Who signs the letter?

The chair, on behalf of the board. It carries more weight as a personal letter from the chair than as a resolution.

Does this replace the minutes?

No. Minutes record the meetings. The letter records the board's conclusions and expectations at year-end, which minutes rarely capture in one place.

What if the year went badly?

The letter matters even more then. Recognition of what was handled well, honest observations, and clear expectations are exactly how a board steers without blaming.

A practical next step

Draft the one-pager this week while the year is still fresh, and have the chair send it before the holidays. If the board has never put its cyber view in writing and wants help shaping the first one, book a Decision-Clarity Call.