The role of data, analytics and AI in helping boards see issues sooner
Boards spend considerable time looking backwards. Financial results, incidents, breaches, audit findings and other outcomes tell directors what has already happened. Those measures are indispensable, but governance becomes more useful when boards also receive credible early-warning signals about what may happen next.
That is the practical value of combining leading and lagging indicators. Done well, they help a board connect strategy, risk, culture, controls and performance; identify deterioration earlier; and test whether management action is working. Done badly, they create another crowded dashboard, false precision and potentially false confidence.
What do “lead” and “lag” actually mean?
A lagging indicator records an outcome after the relevant activity, event or period. Examples include a realised financial loss, a reportable regulatory breach, a serious safety incident, an unplanned outage, a substantiated misconduct finding or a missed strategic target.
A leading indicator is a condition, behaviour, process measure or other signal expected to precede, influence or warn of a future outcome. Examples might include deteriorating risk-appetite measures, overdue control testing, unresolved high-risk actions, persistent late board papers, a rise in critical vacancies, declining employee sentiment, ageing technology or increasing complaint themes. The use of lead and lag indicators to trace activities and outcomes is also reflected in AICD impact-measurement guidance.
There is, however, an important qualification. “Lead” and “lag” are not permanent labels attached to a metric. Classification depends on the outcome, causal hypothesis and time horizon being considered. Staff turnover can be a lagging outcome of poor culture, but also a leading signal of future capability, customer-service or control problems. A customer complaint is a lagging indicator of an individual customer experience, yet a pattern of complaints may lead a systemic conduct issue. A near miss has already occurred, but can warn of a more serious safety event.
This also means that “leading” should not be treated as synonymous with “predictive”. A plausible early-warning signal is a hypothesis until experience, analysis or external evidence demonstrates that it has a meaningful relationship with the outcome the organisation is trying to manage.
Why should boards care?
Good governance depends on informed oversight. Section 180 of the Corporations Act 2001 (Cth) requires directors and other officers to exercise care and diligence; the business judgment rule also refers to directors informing themselves about the subject matter of a judgment to the extent they reasonably believe appropriate. The Act does not prescribe governance dashboards or require a particular set of lead and lag indicators. Nevertheless, the quality, timeliness and relevance of board information are plainly important to effective oversight.
ASIC's Corporate Governance Taskforce reached a similar practical conclusion in its work on non-financial risk. It found that material risk information could be buried in dense board packs, that risk metrics did not always provide a representative view of exposure, and that boards needed to take greater ownership of the information they receive. This is a useful reminder that more information is not necessarily better information.
For APRA-regulated entities, the link is even more explicit. Under the current operational risk framework, risk appetite is supported by indicators, limits and tolerance levels, with monitoring, reporting and escalation. That framework is sector-specific, but the underlying governance discipline is widely transferable: decide what matters, define the boundary between acceptable and unacceptable performance, monitor movement toward that boundary and act when it is approached or crossed.
A practical governance indicator set
The following examples are illustrative, not prescriptive. They build upon practical indicators commonly encountered in company secretarial and governance practice. The right indicators depend on the organisation's strategy, risk profile, industry, size, structure, maturity, regulatory obligations and available data.
Area
Possible leading indicators / early-warning signals
Possible lagging indicators / realised outcomes
Strategy and financial resilience
Strategic milestones slipping; forecast accuracy deteriorating; sales/customer pipeline weakening; emerging concentration risk; repeated deferral of strategic discussion
Missed strategic or budget targets; earnings downgrade; liquidity or capital stress; covenant breach; material impairment
Risk, compliance and legal
Risk appetite trending towards tolerance; overdue high-risk control tests or remediation; policy/control gaps; slow escalation; recurring approval exceptions; legal or compliance-function independence concerns
Reportable breaches; regulatory investigation or enforcement; fines/penalties; material litigation loss; repeated control failure
People, culture and conduct
Declining employee sentiment; unwanted turnover in critical roles; absenteeism trends; speak-up reluctance; incentive/value misalignment; unresolved conduct themes
Substantiated misconduct; loss of critical talent; industrial disputes; material grievances; customer or employee remediation
Work health and safety
Hazard exposure; overdue corrective actions; quality of safety conversations; near-miss themes; control verification and assurance gaps
Injuries/illnesses; workers' compensation claims; serious incidents; fatalities; regulatory action
Board and committee effectiveness
Late or excessively long papers; weak agenda discipline; repeated deferrals; limited test and challenge; ageing board actions; unmanaged conflicts; succession gaps
Repeated adverse evaluation themes; failed or delayed decisions; board/management relationship breakdown; governance failures requiring remediation
Internal audit and controls
Gaps in high-risk assurance coverage; internal audit capacity constraints; control-testing exceptions; overdue high-rated actions
Repeat high-rated findings; realised fraud/loss events; persistent control failure; external assurance qualifications
Technology, cyber, data and resilience
Age/health of critical assets; privileged-access exceptions; patching or vulnerability backlog; failed recovery tests; data-quality exceptions; untested dependencies
Cyber incidents; data breaches; outages; data loss; disruption outside tolerance; material service failure
Customers and stakeholders
Complaint themes; service-level deterioration; churn or dissatisfaction trends; vulnerable-customer indicators; unresolved stakeholder commitments
Remediation costs; customer loss; adverse ombudsman/regulatory outcomes; material reputation damage
Third parties and supply chain
Critical-provider concentration; deteriorating service levels; overdue assurance; financial stress at key suppliers; unresolved contract/control issues
Supplier failure; critical-service interruption; contractual breach; customer harm or financial loss
Corporate records, policies and delegations
Overdue policy reviews; unclear delegations; poor document retrievability; approval/execution exceptions; late internal lodgement workflows
Regulatory late fees; missing records; unauthorised transactions; compromised disputes or assurance; formal compliance breaches
The WHS example illustrates why a portfolio of indicators matters. Safe Work Australia cautions against relying on a single measure such as injury rates and recommends combining quantitative and qualitative data to build a more holistic picture.
Several other cautions are important. A raw count often misleads. More whistleblower reports can reflect either more misconduct or greater confidence in speaking up. More internal audit findings can reflect weak controls, but also broader or more effective audit coverage. Training completion measures participation, not whether behaviour changed. Share price and D&O premiums are influenced by many external factors and are therefore weak standalone governance measures. Board tenure can warrant scrutiny, but a fixed number of years should not automatically be treated as proof of lost independence or effectiveness. Contemporary AICD culture guidance similarly emphasises indicators and red flags rather than a single mechanical measure.
Building a board dashboard that is actually useful
A board-level scorecard should start with objectives and material risks, not with whatever data happens to be available. For each significant objective or risk, the board can ask:
What outcome would tell us that we succeeded or failed? What conditions or behaviours tend to occur before that outcome? What threshold should trigger attention? What action follows?
A useful indicator card might show the objective or risk, metric definition, whether the measure is leading, lagging or both, the data source and owner, target or tolerance, current value, trend, relevant segmentation, data-quality confidence, management commentary, required action and escalation status. Pairing leading and lagging measures around the same objective is particularly valuable because the lagging result can test whether the supposed leading indicator is genuinely informative.
Trend matters more than a single point. So does severity. Ten minor exceptions may be less important than one critical control failure. Averages can obscure vulnerable cohorts, business units or geographies. A green status can hide deterioration just below a threshold. Qualitative observations – such as reluctance to challenge, management suppression of bad news or repeated workarounds – may also be important even where they are difficult to convert into a number.
ASIC's observations about dense board packs and inadequate prioritisation reinforce the case for a deliberately selective dashboard, while AICD guidance similarly advocates measuring what matters and embedding measurement into decision-making.
The board should therefore resist “metric theatre”: dashboards that look scientific but are not connected to decisions. Indicators should have an owner, an agreed response and periodic review. If a measure changes and nothing happens, its governance value is questionable.
How accurate are leading indicators?
This is where caution is warranted. There is no universally validated set of corporate governance leading indicators and no credible basis for assigning a fixed predictive accuracy to the examples in this article.
Evidence from occupational health and safety – one of the more developed fields for lead/lag measurement – is instructive. A recent scoping review identified 48 studies evaluating leading indicators. Most reported positive relationships with lagging safety outcomes, but the overall evidence was considered weak because the studies were observational, heterogeneous and generally unable to establish causation.
That does not make leading indicators unhelpful; it means boards should avoid overstating what they prove.
In practice, organisations should back-test their indicators. Did movement in the supposed lead measure actually precede the outcome? Was the relationship consistent? Did an intervention change the result? Are there false positives or false negatives? Has the business model or environment changed?
Indicators that repeatedly fail these tests should be redesigned or retired.
Big data: useful servant, poor master
“Big data” is commonly characterised by five attributes: Volume, Velocity, Variety, Veracity and Value. The first three describe scale and complexity; the last two are especially important in governance. Large volumes of rapidly generated data are of little use if they are inaccurate, biased, poorly understood or unrelated to a decision.
Corporate data is created across finance systems, risk and compliance tools, HR platforms, customer systems, operational technology, cybersecurity systems, audit and assurance processes, third-party platforms and external sources. Good data governance requires ownership, common definitions, appropriate access, validation, lineage, security, retention and disposal, together with controls over how information is transformed into board reporting.
APRA's data-risk guidance is useful beyond the prudential sector. It identifies data-quality dimensions including accuracy, completeness, consistency, timeliness, availability and fitness-for-use, and expressly discusses targeted data-quality metrics, exception reporting and escalation.
There is evidence that capability remains uneven. Governance Institute of Australia and Macquarie University DataX research based on 345 CEOs/C-suite executives, non-executive directors and senior governance/risk professionals found that almost 60 per cent said the board did not understand the organisation's current data-governance challenges; 57 per cent rated their organisation's management and protection of important data merely “average”.
The message is important: analytical capability without data governance can magnify rather than reduce risk.
Big data is not a prerequisite for good governance. A smaller organisation may obtain more value from a modest, well-controlled dataset than a large organisation obtains from millions of poorly governed data points. The principle of proportionality matters.
Analytics and AI can extend what is possible by identifying patterns, anomalies, correlations and emerging trends across large datasets. They can help directors move from periodic reporting towards more dynamic early warning. But they also introduce model risk, bias, explainability, security and privacy concerns. AICD's contemporary discussion of big data similarly emphasises data provenance, bias, limitations, privacy and ethics.
Where personal information is involved, more data is not automatically better. OAIC's current APP 3 guidance emphasises data minimisation and collection that is reasonably necessary, while APP 11 requires reasonable security measures and, subject to exceptions, destruction or de-identification when personal information is no longer needed.
Human judgment therefore remains necessary to test what the analysis means and whether action is warranted.
Industry, size and complexity change the answer
A listed financial institution, hospital, resources company, technology start-up, charity and local government body should not have the same governance dashboard. Their material risks, regulatory obligations, stakeholder expectations, data maturity and resources differ.
APRA's current operational-risk framework expressly recognises proportionality and expects stronger practices for significant financial institutions commensurate with their size and complexity.
The same practical principle works elsewhere. A small entity might track ten carefully chosen indicators manually. A large, complex group might use hundreds operationally, while escalating only a small number of material, exception-based measures to the board.
The board's role is not to become the operating dashboard for the organisation. It is to ensure that the information architecture allows material signals to travel upward quickly, accurately and with enough context to support judgment.
A better question for boards
The central question is not:
“Do we have a governance dashboard?”
It is:
“Would our reporting help us see a material problem early enough to do something about it – and would we know what to do?”
Lag indicators remain essential. They provide accountability, confirm outcomes and allow the organisation to test whether its assumptions were right. Leading indicators add the possibility of earlier intervention. The strongest governance reporting deliberately connects the two.
Boards do not need more data for its own sake. They need a disciplined set of signals that are relevant, reliable, appropriately forward-looking and tied to action.
The goal is not perfect prediction. It is earlier recognition, better questions and better-informed decisions.
Governance in Action Pty Ltd can assist clients with identifying, formulating and using relevant lead and lag indicators, combined with red flags and early warning signs.
David Cantrick-Brooks FGIA FCG, Principal & Director of Governance in Action Pty Ltd, would be pleased to assist with enquiries. Please feel free to reach out via LinkedIn or via gia.net.au.
AI-assisted tools and techniques were used here to support the research, drafting and editing of this publication. Responsibility for the final content rests with David Cantrick-Brooks.
Whilst accounting and legal terms and references may be contained in this publication, it does not constitute or purport to be or represent accounting or legal advice of any kind – whatsoever. Readers should seek their own professional advice.
