Boardroom confidence surges in final quarter despite tepid 2026 expectations 

After three quarters at a five-year low, director confidence jumped 23 percent in December—yet the outlook for 2026 remains muted. One director's advice: 'Defend and survive.'

America's corporate directors ended 2025 on an unexpectedly optimistic note.

After languishing at a five-year low for three consecutive quarters, the Director Confidence Index—a quarterly poll conducted by Corporate Board Member and Diligent Institute among U.S. public company board members on their sentiment for business—surged 23 percent in December, climbing from 4.9 out of 10 to 6.0 and finally breaking into "Good" territory. 

A better understanding of how tariffs are impacting businesses and the economy, lower interest rates and increased CapEx spending are the most common factors directors shared to explain this rebound. 

“[There’s] an expectation that companies will be able to work through any tariff impacts without significantly raising prices,” explained one director participating in the poll.

It's a remarkable turnaround for a year that tested boardroom resolve. 

Yet even with the late rally, 2025's average confidence level landed at just 5 out of 10—well below 2024's 6.2 average and significantly short of the 6.9 that directors had predicted this time last year.

The 105 directors surveyed December 6-11 overwhelmingly point to one issue that slowed down business this year: tariffs. 

Three quarters cited it as a top contributor to lower-than-expected business conditions, well ahead of any other factor, noting that standard playbooks don’t work when the environment keeps changing.

“No matter how much you try to prepare for the unexpected, you can never truly assess all outcomes,” said one director on the board of a publicly traded tech company. “We did not see the substantial impact the ever-changing tariff environment (much of which was likely unconstitutional) would have on our customers CapEx spending plans.”

“I have never experienced what we are seeing in our industry in my 30+ years,” said one director at a Nasdaq-traded life sciences company. “Pharma/biotech has always been recession-proof and has not been impacted by which party was in power at the time.”

Despite December's surge, directors aren't banking on momentum carrying into the new year. Their forecast for business conditions by this time in 2026 sits at 6.0—essentially flat from today's level.

This is an interesting delta when compared to CEO sentiment. When polled by sister publication Chief Executive the first week of December, 

CEOs said they forecast conditions will improve by

 in 2026, to land at 6.4 out of 10 next December.

Overall, 44 percent of CEOs are optimistic that conditions will improve, vs. 32 percent of board members.

Among those directors who are optimistic, we observe a strong AI focus in their responses, far outpacing macro fears that are atop the list of concerns among directors who expect conditions to deteriorate in 2026. As for those neutral directors, the uncertainty they expect to continue in the year ahead rivals inflation as a key theme.

To navigate 2026 successfully, directors are prioritizing adaptability, deeper engagement and faster learning, recognizing that compounding risks demand boards connect dots more quickly than ever. "Work hard and smart, keep expenses tight, and survive until a rebound comes around," advised one director.

“Defend and survive,” concluded another.

The Director Confidence Index five years later

To mark our fifth year of running the Director Confidence Index, we asked respondents this quarter to reflect on how their roles had shifted since we first fielded this survey at the end of 2020. Directors say they are spending far more time on risk in a “more complex and faster‑moving” environment—cybersecurity, AI, geopolitical shocks, supply‑chain integrity and policy volatility are now routine board agenda items, not edge cases. 

Many describe a shift from “managing the present” to “understanding and planning for the future,” with scenario planning and strategic resilience now core to the role. Several also point to rising scrutiny from activists and a broader investor base, which has widened the mandate from overseeing financial performance to stewarding culture, human capital and corporate character.

Directors repeatedly flag the steep learning curve this entails. In their open‑ended comments, they emphasize the need to be more tech‑savvy on AI and cyber, more fluent in geopolitics and regulation, and more intentional about ongoing education just to remain effective in the boardroom. Committees are “very busy,” topics are broader, and some directors note a clear move away from informal business development toward disciplined governance, succession planning and risk oversight. 

While a minority insist the formal role has not changed, the weight of the written responses is unmistakable: being a director today is more time‑intensive, strategically demanding and consequential than it was in 2020, and possibly than it has ever been. 

Director Confidence Index: December 2025

Provision 29 of the UK Corporate Governance Code asks boards to do something that used to sit in the background. It asks you to make a clear statement on whether your material controls were effective at the balance sheet date, and to explain how you monitored and reviewed the control framework across the year. Whether you’re preparing for your first declaration or refining your approach after the first cycle, this guide breaks down what the rule means in practice and how to keep disclosures clear, credible and useful for investors.

 as an evolution rather than a major change, the reality for most in-scope organisations is that Provision 29 requires considerable work across several domains.

Boards should monitor the company’s risk management and internal control framework, complete an annual review of effectiveness, then report four things in the annual report:

Many in-scope companies are now strengthening year-round monitoring with 

, so the board’s year-end opinion is grounded in 

 across financial, operational, reporting and compliance controls.

 Provision 29 introduces a board declaration but does not require external auditor attestation, and the scope goes beyond financial reporting to include operational, reporting and compliance controls.

In boardrooms I work with, historic reporting focused on describing monitoring activity. Provision 29 raises the bar. You are now making an outcome statement with evidence that can stand up to investor scrutiny. Leading practice is to avoid boilerplate statements, explain how the board reached its view, and connect control outcomes to strategy and risk appetite.

Modern board tech can also help avoid boilerplate: 

AI tools summarise large packs into decision-ready insights

 and surface risky language so directors focus on the evidence that matters.

What does “boilerplate” look like — and how do you avoid it?

Boilerplate statements are generic and vague, failing to show how the board reached its conclusion. This undermines investor confidence and falls short of Provision 29’s intent.

“The board has reviewed the system of internal controls and considers it effective.”

“Processes are in place to monitor risk and compliance.”

Use specific, outcome-focused language that shows the basis for your opinion:

“The board reviewed quarterly assurance reports, internal audit findings and management attestations covering 18 material controls linked to principal risks. Based on this evidence, the board concluded that controls were effective at the balance sheet date, except for two areas where remediation is in progress.”

The board decides what is material, proportionate to your risks, strategy and stakeholders. A practical test I see work well: include controls that, if they fail, could reasonably affect price-sensitive reporting, principal risks or legal and regulatory obligations. Keep the set focused yet complete and agree your evidence standard up front.

Tip: Benchmark your risk/control scope against peer disclosures and industry risks to calibrate “material”— AI-powered libraries can speed this early scoping.

set scope and evidence expectations, oversee monitoring and approve the declaration

 confirms design and operation of controls and owns remediation

 provides independent assurance with risk-based testing across material controls

 risk and compliance monitors frameworks and facilitates attestations

Independent guidance emphasises the contribution of internal audit and the need to integrate assurance across first, second and third lines so coverage is complete without duplication. Linking the assurance map to 

 reduces duplication and makes exception trends visible to the audit committee in 

A phased approach for the 2026 reporting cycle

Here is the approach I recommend, whether you are preparing for your first declaration or improving your second. Think of the year in four repeating phases:

Here’s a practical way to structure the year so your declaration is evidence-backed and stress-free:

 Confirm the definition of material controls, agree evidence standards, and map assurance lines.

 Perform targeted testing on material controls, prioritise principal risks, and start remediation.

 Run a dry-run declaration with the audit committee, refine wording and evidence pack.

 Finalise disclosure, close remediation, and align investor messaging.


Document criteria, link each control to risks and reporting duties, confirm ownership and cadence.


Be specific on sufficiency: testing coverage, attestation frequency, exception thresholds and issue closure criteria.


Build an assurance map that brings first-line attestations, second-line monitoring and internal audit together.


Prioritise price-sensitive reporting and principal risks. Run targeted testing, fix issues quickly, track retesting.


Socialise draft wording and the evidence pack with the audit committee, then refine controls and disclosure.


Explain how monitoring was performed, state the declaration plainly, and describe ineffective controls with actions and status. Avoid boilerplate.

 to assess where you are and set goals for year-on-year improvement. Aim to move from a consistent, integrated approach to an optimised state where control results inform board agendas, strategy and decision-making.



See this maturity curve to benchmark where you stand and set goals for improvement:

Provision 29 asks for a declaration that is clear and defensible. 

Diligent connects risk, compliance and audit assurance with board reporting

 so your disclosure is backed by consistent evidence across the year.

 linked to principal risks, reporting obligations and ownership

 with workflow, reminders and exception handling

second- and third-line assurance into a single assurance map

 with due dates, status and retesting records

 that shows the status of material controls, exceptions and actions

surface anomalies and connect findings directly to audits 

so evidence quality improves without noise

Keep entity records accurate and ownership clear across all legal 

 opt-in controls, no default data training, and clear labelling of AI-generated content

If I had to boil Provision 29 down to one habit, it would be this: agree scope and evidence early, then keep assurance integrated and visible right through the year. It makes the year-end declaration simpler, and the conversation at the board table more grounded.

Boards often ask the same practical questions about Provision 29. Here are the answers to the top ten I hear.


Calibrating “material controls” and agreeing an evidence standard that is proportionate, defensible and repeatable across the year. Pair first-line attestations with analytics and full-population tests in high-impact areas to avoid noise.

Is external auditor attestation required?


No. Provision 29 introduces a board declaration and does not require external auditor attestation; scope extends beyond financial reporting to operational, reporting and compliance controls.

How do we decide what’s “material”?


Start from principal risks, price-sensitive reporting and regulatory duties, then benchmark risk/control themes against your sector to avoid gaps. AI-powered risk libraries can accelerate this early scoping.

What does a good evidence standard look like?


Define coverage (which controls, how often), exception thresholds, and closure criteria. For automated controls, use continuous monitoring; for manual controls, use attestations plus targeted tests. Keep an audit trail with dates, owners, results and retest status.


Use AI where it reduces manual work and increases coverage (e.g., summarising board packs, testing full datasets, anomaly detection). Diligent AI is opt-in, does not train on your data by default, and clearly labels AI-generated content to preserve oversight.

Will this create “boilerplate” disclosures?


The opposite—analytics and board AI make it easier to tie conclusions to specific evidence (what was tested, exception rates, remediation). Summaries help directors challenge and refine wording.

Run one continuous test in a high-impact process (e.g., P2P duplicates, access anomalies) to evidence full-population coverage.
- Do a dry-run declaration with AI-generated prep questions and a minutes draft to test clarity and gaps.
- Clean control ownership across entities so responsibilities are unambiguous.

How does this fit with our existing systems?


Connect analytics to your common data sources (ERP, HR, Concur, Salesforce) and feed results into your assurance map and audit dashboards—no need to rip and replace.


Be plain and specific:
“Based on quarterly assurance reports, internal audit testing and management attestations covering X material controls linked to principal risks, the board concluded that controls were effective at the balance sheet date, except for [areas] where remediation is in progress.” Then disclose actions and status.

How do we keep directors focused on the right issues?


Provide board-ready summaries, risky-language alerts, and exception trends by risk to guide the discussion—then capture actions and owners in minutes.

Provision 29: A practical guide to board declarations on internal controls 

Legal and compliance chiefs are rating the level of risk in the current business environment at 7.9 out of 10, where 1 is Negligible and 10 is Significant. This marks a 16 percent increase from Q1 levels, though the figure has remained relatively flat since Q3—suggesting the risk escalation may be stabilizing.

While the new year often brings a renewed sense of optimism and a resetting of the slate, legal and compliance leaders are ending 2025 with persistent concerns about the risk landscape: The overall sentiment among the general counsel, audit, legal and compliance leaders participating in the Q4 Business Risk Index, conducted by Diligent Institute and Corporate Board Member, points to compounding pressures across economic, regulatory and political realms creating a precarious environment for business.

“These elements are directly related,” said one respondent. “As one risk escalates, the others do, too.”

“In 2025, risk levels didn’t just spike, they settled into an ‘alwayson’ baseline,” says Dottie Schindlinger, Executive Director of the Diligent Institute. “In a world where significantly high risk levels are constant, the GC’s agenda may become increasingly defined by AI and broader tech exposure. 

, predicting heightened regulatory tracking, audits and policy reviews in 2026.”

The most striking finding from the survey is the dominance of technology-related concerns. Sixty percent of respondents cited technology as a risk today, well ahead of any other issue, including the economy (33 percent) and tariffs (23 percent). Legal, compliance and audit leaders view increasingly sophisticated cyber-attacks as a primary threat vector.

“Cyber threats and supply chain instability continue to create pressure, particularly for tech and services companies that depend on stable, secure environments,” said Taras Lytovchenko, chief legal and compliance officer at Trinitex.

“From an IT business perspective, the regulatory uncertainty is the biggest factor, especially around data protection, AI governance and cross-border compliance,” added another respondent. “On top of that, cyber threats and supply-chain instability continue to create pressure.”

“Technology risk is now the connective tissue across the entire risk register,” says Kira Ciccarelli, Senior Manager of Research at the Diligent Institute. “We know that 

boards too are experimenting with new tech like AI tools

 to enhance oversight, yet relatively few organizations are leveraging AI powered dashboards for risk monitoring. Closing that execution gap will separate leaders from laggards.”

While those polled expect most risks to lessen as businesses get more clarity around issues such as trade, regulations and the economy, AI-related risks are the notable exception. The majority continue to cite it as a top risk for their organization in 2026, well ahead of the economy (23 percent) and regulations (19 percent). 

When asked which key risk indicators (KRIs) they were monitoring closely into the new year, market conditions ranked first, with 33 percent of votes, followed by cyber alerts (27 percent).

Budget constraints despite rising threats

A concerning disconnect emerged in the survey: despite increasing risks and reported vulnerabilities in cross-function coordination, a full third of respondents said their organizations were reducing or keeping risk management operational budgets flat in 2026.

“Cost cutting focus is increasing our risk across the globe,” said one respondent sounding the alarm.

Others flagged a potential lack of awareness to growing intrinsic risks: “My concerns are potentially developing risk mitigation gaps due to role/employee changes and perceived cultural shifts leading to accepting more risk when it is not prudent. Employee morale is also low and can lead to apathy and lack of concentration needed to perform risk mitigation at a high level.”

For organizations that are expected to receive budget increases, the most common investments are in regulatory tracking and monitoring technology (26 percent) or data privacy and cyber defenses (23 percent).

When asked what they would improve if given a chance, cross-function coordination took the top spot, with 44 percent of the votes. 

“We are large company and have many opportunities to be even better than we are now,” said one respondent. “My thought is to create less-siloed systems and activities that would allow high-level views to see trends and allow for more in-depth review for continuous improvement.”

“I would prioritize stronger, faster visibility into external regulatory changes, especially shifts in trade policy, tariffs and cross-border rules that affect IT outsourcing,” said another. “We need a smoother way to detect these changes early, assess their impact and adjust our delivery model before clients feel the pressure.”

“Cross functional coordination is key for operating in a world where top risks are interdependent and self amplifying; where geopolitical, regulatory and technology currents shift together,” says Ciccarelli. “And yet, governance, risk and compliance integration remains a major execution gap.”

 found that only 4 percent of governance professionals say their GRC and financial systems are fully integrated, which can keep risk data trapped in silos. “In an ideal future state, GRC systems should flow in a single stream so that one trigger, whether a cyber alert, a tariff change or an AI policy shift, automatically informs the others,” notes Schindlinger.

Diligent

Blog

Director Confidence Index: December 2025

Provision 29: A practical guide to board declarations on internal controls

Your Data Matters