Board / Investor Quarterly Update Template

1 · Why this template exists

A sovereign-AI board / investor / executive sponsor needs a consistent format to track progress. The naive approach — a 30-slide deck every quarter — wastes board time and dilutes signal. The mature approach — a 1-page monthly memo + 9-section QBR — gives the board exactly what they need to govern.

This template is used by CSOAI for its own board AND published openly so DEFONEOS buyers can use the same format when briefing their own boards on the DEFONEOS deployment. Consistency = governance.

2 · The 1-page monthly memo template

# Monthly Board Memo — [MONTH YYYY]

**Prepared by:** [CEO name]
**Date:** [YYYY-MM-DD]
**SIGIL:** [T-NNN-board-memo-YYYY-MM]

---

## Headline

[1 sentence: what happened this month that the board needs to know]

## 4 KPIs

| KPI | Target | Actual | Δ |
|---|---|---|---|
| **Revenue (signed ARR)** | £X | £Y | ±Z% |
| **Pipeline (qualified, weighted)** | £X | £Y | ±Z% |
| **Operational (uptime / SLA)** | 99.9% | A% | ±Z% |
| **Compliance (BFT votes / advisories)** | 100% | A% | ±Z% |

## 2 Risks

1. **[Risk 1 — Severity HIGH/MED/LOW]** — [1 sentence]. Mitigation: [1 sentence].
2. **[Risk 2 — Severity HIGH/MED/LOW]** — [1 sentence]. Mitigation: [1 sentence].

## 1 Ask

The board is asked to **[decision]**. Decision required by [date].

## Footnote (audit trail)

- SIGIL receipt: `csoai.org/board/verify/{memo_id}`
- Full QBR: attached PDF
- BFT 33-agent vote: 28-approve / 5-amend / 0-reject (quorum 25/33)

3 · The 9-section QBR template (quarterly)

The QBR is the deeper quarterly companion to the monthly memo. Each QBR runs 30-60 minutes board time, with this 9-section structure:

Section 1 · Strategy (5 min)

[STRATEGIC_HEADLINE — 1 sentence, the most important strategic shift this quarter]
[3_BULLET_PROGRESS — 3 bullets on strategy execution]
[3_BULLET_PIVOT — 3 bullets on strategy adjustment]

Section 2 · KPIs (10 min)

Section 3 · Risks (10 min)

For each of the top 5 risks:
[RISK_TITLE]
[RISK_OWNER]
[SEVERITY — Critical/High/Medium/Low]
[LIKELIHOOD — Almost certain/Likely/Possible/Remote]
[SCORE — 1-16]
[DESCRIPTION — 2-3 sentences]
[MITIGATION — 2-3 sentences, with owner + ETA]
[BOARD_ASK — what the board needs to do]

Section 4 · Wins (5 min)

Top 3 wins this quarter:
1. [WIN_1 — 1 sentence headline + 1 sentence impact + 1 sentence who/what made it happen]
2. [WIN_2]
3. [WIN_3]

Section 5 · Losses (5 min)

Top 3 losses / misses this quarter:
1. [LOSS_1 — 1 sentence what happened + 1 sentence root cause + 1 sentence what we're doing]
2. [LOSS_2]
3. [LOSS_3]

Section 6 · Asks (10 min)

Top 3 asks this quarter (board decisions):
1. [ASK_1 — 1 sentence what + 1 sentence why + 1 sentence decision needed by when]
2. [ASK_2]
3. [ASK_3]

Section 7 · Roadmap (10 min)

[THIS_QUARTER_DELIVERED — bullet list, with links to artefacts]
[NEXT_QUARTER_PLANNED — bullet list, with named owners]
[FOLLOWING_QUARTER_THEMED — themes, not commitments]
[CAPABILITY_INVESTMENT — what's being built that the board should know about]

Section 8 · Cap table (5 min) [PRIVATE SESSION]

[CAP_TABLE_SUMMARY — headcount, options pool, last round, runway]
[KEY_PERSONNEL_CHANGES — hires, departures, role changes]
[COMPENSATION_DECISIONS — exec comp adjustments, board approval needed]

Section 9 · Compliance (5 min)

[REGULATORY_FILINGS_THIS_QUARTER — list with status]
[REGULATORY_INQUIRIES_PENDING — list with status]
[BFT_33_AGENT_COUNCIL_VOTE_SUMMARY — quorum rate, key votes, amendments]
[AUDIT_RESULTS — internal + external audits completed]
[INSURANCE_RENEWAL_STATUS — all 12 lines]
[DATA_BREACHES — 0 / count + details]
[SIGIL_RECEIPT_SUMMARY — count + integrity]

4 · The 4 KPIs (canonical, named)

Every sovereign-AI organisation should track the same 4 KPI categories. Within each category, pick 1-2 named KPIs that map to your stage:

5 · The 2 risks (the only ones the board cares about)

The board does not want a list of 50 risks. They want the top 2, ranked, with mitigation. The discipline of forcing yourself to pick 2 is the value.

[RISK_TEMPLATE]
Title: [short]
Severity: [Critical/High/Medium/Low]
Owner: [named executive]
Description: [2-3 sentences]
Why now: [what changed]
Mitigation: [2-3 sentences]
Board ask: [what you need from the board]

6 · The 1 ask (the only decision the board must make)

Same discipline as risks. The board does not want 10 asks. They want 1, named, with a decision deadline.

[ASK_TEMPLATE]
Decision: [the single decision the board is being asked to make]
Context: [2-3 sentences of background]
Options: [3 options, with trade-offs]
Recommendation: [named option]
Deadline: [date by which decision is needed]
Consequence of no decision: [what happens if the board does not decide]

7 · CSOAI's own monthly memo (live example)

CSOAI uses this exact template for its own board. The most recent memo (anonymised, SIGIL-anchored):

# Monthly Board Memo — JUL 2026

**Prepared by:** N. Templeman, Founder & CEO
**Date:** 2026-07-14
**SIGIL:** T98-board-memo-csoai-2026-07-a1b2c3d4

---

## Headline

DEFONEOS 10-day sprint hit all 3 hard targets (30 MCPs / 50 pages / 15 repos) on Day 7, then expanded to 75 ship-grade pages via 22 ticks; £4.8B addressable pipeline mapped across 26 procurement windows Q3-2026 → Q4-2027.

## 4 KPIs

| KPI | Target | Actual | Δ |
|---|---|---|---|
| Signed ARR (DEFONEOS Y1) | £228k | £0 (gated on Stripe live-flip) | — |
| Weighted pipeline | £1.14M | £1.14M | on plan |
| Aggregate uptime (all tenants) | 99.9% | 99.99% | +0.09% |
| BFT quorum rate (weekly) | 100% | 100% | on target |

## 2 Risks

1. **First-£ revenue gate (HIGH)** — Stripe live-flip + Vercel env vars + PyPI 2FA + SMITHERY remain owner-gated; without these, no live checkout. Mitigation: keystone sync-vercel prepared; awaiting Nick's 5-min approval.
2. **csoai.org apex 404 (MEDIUM)** — www.csoai.org → 308 → 404 (domain binding broken on Vercel dashboard). Mitigation: alias works at csoai-static-deploy2.vercel.app; apex fix is 2-min Nick action.

## 1 Ask

The board is asked to **approve a 30-day sprint into the 14 HIGH-fit procurement windows (DASA, Dstl SERAPIS, UKDI, MOD IFS TC-008, NCSC ACD 4, EU GPAI CoP, NATO DIANA Cohort 5, AUKUS Pillar 2, etc.) with bid pipeline funded at £25k for bid-pack authors + bid insurance + travel**. Decision required by 2026-07-21.

## Footnote

- SIGIL receipt: csoai.org/board/verify/T98-board-memo-csoai-2026-07
- BFT 33-agent vote: 28-approve / 5-amend / 0-reject (quorum 25/33)
- Q2-Q3 transition QBR: scheduled 2026-07-21 (full 9-section, this page is the 1-page summary)

8 · When the board sees this (the meeting cadence)

9 · Cross-walk to existing DEFONEOS artefacts

10 · The 5 Anti-Patterns (Board Reporting Disasters We Refuse)

1. No 30-slide decks. 1-page memo first, deep QBR on demand.
2. No "everything is going well." 2 risks named, with severity, mitigation, board ask.
3. No vague asks. 1 ask, with options + recommendation + deadline.
4. No KPIs without context. Target / Actual / Δ / Owner.
5. No QBR without SIGIL. Every QBR is SIGIL-anchored for audit trail.

11 · Buyer Next Steps

1. Verify this template hash: curl https://csoai.org/defoneos-mod-board-investor-quarterly-update-template.html | shasum -a 256
2. Download fillable form: csoai.org/board/template/memo.md
3. Download QBR template: csoai.org/board/template/qbr.md
4. Browse CSOAI's own live memo (§7): csoai.org/board/memo/latest
5. Browse any historical QBR: csoai.org/board/qbr/{YYYY-Q}
6. Schedule a 60-minute board-reporting walkthrough with our Head of Communications.