Board Reporting: Why "I Sent the PDF" Is Not Access Control
Boards receive some of the most sensitive documents in any company. "I sent the PDF" is not access control — it is the absence of it. Here is what board document distribution should look like.
"I sent the board pack to all the directors." This is the answer you get when you ask how board materials were distributed. It sounds reassuring. It is the opposite of access control.
What "I sent the PDF" actually means
When a company secretary emails a board pack as a PDF attachment, here is what has actually happened:
- A copy of the board pack is now on every director's personal device — laptop, phone, tablet. - The PDF is in every director's email inbox, potentially on a mail server they do not control. - The PDF can be forwarded to anyone — an assistant, a colleague, a family member. - There is no way to revoke access. The file is a PDF. It exists wherever it was sent. - There is no way to know who actually read it, which sections they read, or whether they read it at all. - There is no audit trail. Email metadata tells you the message was delivered. It does not tell you the document was opened. - If a director's laptop is stolen, lost, or sold, the board pack goes with it.
This is not access control. This is distribution without control. For documents that contain financial results, strategic plans, M&A discussions, and regulatory disclosures, the gap between "I sent it" and "I controlled access" is the gap between governance and exposure.
What board document distribution should look like
### Upload, do not attach
Board materials should be uploaded to a secure platform, not attached to emails. Directors receive a link, not a file. The document is viewed in a secure in-browser viewer — never downloaded to a personal device.
### Verify identity
Before a director can view the board pack, they verify their identity with an OTP sent to their email. This ensures the person viewing the document is the director — not an assistant who has access to their inbox, not a family member using their laptop.
### Block downloads by default
Board packs should be read, not copied. Download and print controls should be enabled by default. If a director needs a copy for a specific reason (travel, offline access), that should be an explicit, logged exception — not the default behavior.
### Watermark with recipient identity
Every page should be watermarked with the viewing director's email and IP address. If a page is screenshotted and leaked, the watermark identifies the source. This is deterrence and accountability in one.
### Set expiry
Board packs have a natural lifecycle. They are relevant before and during the meeting, not indefinitely. Set links to expire after the meeting — access ends automatically, with no manual follow-up and no copies left behind.
### Track engagement
You should know which directors opened the board pack, which pages they viewed, and how long they spent. This is not surveillance — it is governance. If three of seven directors did not open the pack before the meeting, that is information the chair needs. If one director spent 40 minutes on the risk section, that is information that should shape the discussion.
### Keep an audit trail
Every access — successful and failed — should be logged with timestamp, IP, device, and OTP verification status. If there is ever a question about who saw the board pack and when (in an investigation, a regulatory inquiry, or a governance review), the audit trail is the answer.
### Revoke when the meeting ends
When the board meeting concludes, revoke access. Directors who need ongoing access to specific materials can be given separate, time-bound links. But the default should be: access ends when the meeting ends.
The governance argument
Board packs are not just sensitive documents. They are governance documents. How they are distributed, who has access, and whether directors actually engage with them are governance questions, not IT questions.
"I sent the PDF" answers none of them. A [board reporting workflow](/use-cases/board-reporting) with identity verification, download controls, watermarking, engagement tracking, and audit trails does.
If your board materials are still being emailed as attachments, the question is not whether to change — it is when. And the answer should be before the next pack goes out.