Frequently Asked Questions

Many of the questions we’re typically asked are covered here – click on a theme to look at Questions & Answers:

Cost and subscription arrangements
Topics covered
Flexibility
Reports and charts
Responding to questionnaires
Getting started and keeping it going
Security and confidentiality

IT specifications

Cost and subscription arrangements

How much does Thinking Board cost?

Thinking Board is sold on a modular basis. The list prices for an annual subscription are available on request. We can negotiate discounts depending on the number of users and for multi-year agreements.

For full details call us on +44 (0)20 7220 6580 or contact us on info@thinkingboard.co.uk

How many users are included in the subscription agreement?

For each module the subscription allows:

use of Thinking Board by between 20 and 40 users depending on the structure of the modules included in the agreement – they have the ability to respond to questionnaires and, depending on the access granted by the company, access to Reports, Knowledge and Benchmarking
two named “company administrators” who have access to the full functionality of Thinking Board ie including Question Banks and Set Up.

Additional users and administrators can be added for an additional fee.

How long does the subscription last – and what happens if I don’t renew?

The subscription is active for 12 months.

Can I use a subscription for more than one company in our Group?

Yes – in two ways. Either:

If you want all companies to respond to the same questionnaire, they can be set up as “Response Groups” in the same way as, for example, the Board or a committee – OR

If you want individual companies (or business units) to be able to use Thinking Board for their own purposes (eg changing the questionnaire or having access to the Question Banks, this can be arranged for an additional subscription fee (to be negotiated). It is also possible, for a fee, to arrange for you to have your own sub-domain eg https://xyzcompany.thinkingboard.co.uk.

Would different business units/companies be able to access the results for other companies in the group?

No. Each unit/company would have its own company login and administrators.

Are there any additional set up costs?

There are no charges for setting up or training. There are no hardware, server or database requirements or costs. There may be additional charges when we customise the service for you but this depends on what you want and the nature of your subscription.

Also, there is an additional charge if we provide additional advisory services (eg helping you tailor the questionnaires or interpret the results) where this support exceeds the standard support set out in the subscription agreement.

Topics covered

Does Thinking Board cover all parts of the board structure - not just the Board itself?

Yes – and not just the board structure. We currently have modules available covering:

For the Board – Strategic Governance and Risk Governance; individual director assessment
For the Committees – Audit & Reporting Governance; Remuneration Governance and Succession Governance
Internal Audit effectiveness – for audit committees and management
External Audit effectiveness – for audit committees and management.

More modules will be available over the coming months.

Flexibility

Can I customise the questionnaires?

Yes – fully and in several ways:

Any questionnaire that’s drawn from the Question Banks can be edited fully: questions can be deleted or added; the questionnaire name, question group headings or the wording of the questions themselves can be changed; the scoring system (both range and associated wording) can be altered within a range of 1 to 7 and contain any words you want, simply becoming “yes” or “no” if that’s what you need . You can use numbers for the key – or just words.
A questionnaire can be set up from scratch where it involves a structure with questions, scoring and text boxes.
Some of the questionnaires from the Question Banks incorporate a more sophisticated structure whereby issues can be flagged or a “diagnostic” undertaken to focus on certain question themes.

If I customise a questionnaire, can any other company see what I have done?

No. Your questionnaires are saved into your own “company” and are not visible or accessible to any other user.

Can I combine questionnaires?

Yes – as long as the questionnaires have the same structure.

As you can imagine, if they don’t have the same structure they have different page templates/layouts which cannot be accommodated – so combination as such is not possible. However, there’s a way around this by grouping questionnaires under an overall heading so that the respondent sees differently structured questionnaires simply as sub-sections.

Can I have multiple date periods?

Yes. You specify the month/quarter/year – so you can use it monthly if you want to. Results for each period are presented in “View Reports” – you select which to view.

Reports and charts

Can I customise the reports and charts?

Yes. You can select which charts to make available in “Reports”. You can specify which colours relate to which scoring parameters. And you can edit the “question group” names/titles.

The reports and charts can all be exported into Word so that the subscriber can cut and paste into their own reports and edit text reports.

The charts are created in software which provides multiple types of charts but we have found that those we provide meet most purposes: the data is quite simple and does not lend itself to more complex presentation. However, if a subscriber wishes to propose a chart we will consider the options within the packages we use.

Can reports be printed?

Yes – either as screen prints/shots or by exporting into Word.

Can you see individual responses?

For now the Administrator can do this either by printing out each individual’s completed questionnaire or by producing a data report. So responses are anonymous unless the Administrator chooses to override this.

In the Version 1.1 (available Autumn 2009) we expect you to be able to drill down from the chart to see who has responded in a particular way – if you switch on this functionality.

Who can see the Reports?

The Reports can only be viewed by the Users who are given access to the View Reports function by the Administrator – and they can then see only the Reports that have been made available specifically to each individual.

Responding to questionnaires

Which questionnaires does a respondent see?

A respondent only sees the questionnaires that he needs to complete – this is dictated by the Administrator.

Can I track who has responded?

Yes – the Administrator can see which respondents have submitted their responses, organised by questionnaire.

When I am completing a questionnaire, can I see how far I have got?

Yes – on each questionnaire page there is a “progress bar” and the Respond to Questions page shows how many questions are to be answered and how many you have already answered. If you try to submit the competed questionnaire, if not all questions have been answered the system asks you to confirm that you wish to submit your response.

Can I go back in to edit my responses?

Yes – you can re-enter your questionnaire and edit the response, then re-submit until the point at which the Administrator closes the questionnaire by “publishing” the related Report (usually initially making it available only to him/herself).

Can I do part of it then go back later to finish it?

Yes.

Can I see my responses after completion?

Yes. Until the Administrator closes the response period you can see it through logging in and entering the questionnaire. Once the response period is closed, you can ask the Administrator to send you a copy.

Can I print out the questionnaire if I don’t want to complete it on line?

Yes – the questionnaire can be exported to Word.

Can I upload the questionnaire to complete it in a “standalone” website version?

No. This is complex in terms of technology. We will consider introducing this functionality if there is demand.

Getting started and keeping it going

How far am I in control of who gets what?

Fully. You control which individuals receive which questionnaires at any point in time – and which questions are included in the questionnaires. You determine who receives which reports and when.

Can I set up and maintain the system without viewing the data?

Yes. You only see individual responses if you take a specific action to look at their questionnaire responses. You only see the aggregated reports if you choose to view them. The questionnaires, reports and access can be set up and maintained without viewing the data.

How do I get access?

You simply logon to https://ial.thinkingboard.co.uk or, if self-hosting, possibly your own intranet page eg www.widgetco.com/thinkingboard).

How long does it take to be up and running?

You will be set up as soon as we receive payment. Our agreement commits to setting you up within one business day but in practice it will be much quicker. It takes us only a matter of minutes to set you up.

If you are self-hosting, it would generally take 2- 3 working days to get you set up depending on your requirements.

What level of expertise is required?

Thinking Board is very easy and intuitive to use. No training is needed. We will provide you with an easy-to-follow manual but you won’t need to use it for long and there are “help” pages throughout.

What kind of support is available?

We currently provide a “help desk” (by phone or email) on business days between 09.30 and 17.30. This will be extended in due course. The “help desk” will aim to respond within 2 hours.

The “help desk” can provide guidance during the set up period if required.

What about updates?

Thinking Board will be continually developing – the content will change as we incorporate new thinking on governance effectiveness. The functionality of Version 1.0 is set out in the Subscription Agreement. We expect Version 1.1 to be available by October 2009.

Updates to existing modules will be provided for no additional fee during the annual subscription period. New modules will be charged at the applicable rate to be announced when the module becomes available. As Thinking Board develops, new features are available immediately. As the service is web-based, updates are uploaded and become available automatically.

What level of maintenance is needed?

None – the system is web-based. The only (minor) exception is if you are hosting the site – in this case we will need to set up a system for providing you with updates periodically. At our end, the system is Microsoft SQL-server based and is easy to maintain and reliable.

We’re a small company – is it suitable for us?

As the system is web-based with no maintenance requirements, it is equally suitable for small and large companies alike. Similarly, the content applies in the same way to any company with governance structures.

Security and confidentiality

How do you control access?

We are extremely conscious of the need to protect the confidentiality and security of client data. So one key feature is the way in which you have full control over the passwords and login names.

Once we have provided you with the Company Administrator login(s) to get set up, you are required by the Subscription Agreement to change these passwords in line with your company password policy.

All User logins and passwords (User registration) are in turn set by the Company Administrator in line with the company password policy.

To login, a user must enter (1) a Company login name (a minimum of 8 characters including 2 numerical digits) – this will be specified by you; (2) a User login name; and (3) a User-specific password. The use of (1) eliminates the risk of an illegitimate user guessing a login name or password. (2) and (3) are set up by you. Incorrect entry of any of the three elements results in access being denied.

In the event of a password being forgotten by the User, the “forgotten your password?” link simply asks the user to contact the Company Administrator as the “back end” of the system does not have access to the passwords you have set up.

As a result of you setting the User logins and passwords, we do not know your logins or passwords. These are recorded in the database only as a series of #####. We cannot, therefore, access the “front end”.

How are our data kept secure?

We apply strict access controls in the “back end”. Data (and the website itself) is maintained on a secure dedicated server. The website is accessible over the internet using a secure SSL/TSL connection with standard MS SQL security for the data (questions and answers stored). Our website is SSL certified: https://thinkingboard.co.uk and uses a 128 bit encryption line.

Access to the “back end” is limited to authorised users at Independent Audit Limited (IAL) and our support company who operate under confidentiality requirements and security as set out in our contract with them. Standard and rigorous password access controls apply.

It is not possible for subscriber companies to access other company data as the system is based on company-specific logins and passwords.

Are my data backed-up?

The site is backed-up remotely on a secure server in a separate location (a remote back-up is more secure than backing up to tape or disk). Military-grade encryption technology and a strong password are applied. The password acts as the key with which your data is scrambled to ensure that nobody can read your data without it – the password is known only to Independent Audit Limited and stored securely. The encrypted data is stored in a secure data centre with security pass access with servers contained in locked racks.

Files that are deleted are stored in the back-up system for 28 days.

When a subscription ends, access to Thinking Board is suspended and data files are deleted. A user may request a copy of their Excel data sheets on ending their subscription as long as the request is made before the end of their subscription period.

Can we host it ourselves?

Yes. We don’t think you should be worried about security but if you are still concerned, you can overcome any remaining worries by hosting Thinking Board on your own server. You would have your own sub-domain and we would upload updates periodically. There is a small additional charge for the set-up and service in this case.

How are cookies handled?

In relation to cookies, we do not track the profile of any of our subscribers/users and do not analyse subscriber online preferences.

What do we do with your data?

As required by the Data Protection Act, we will not use your data for any purpose other than that agreed with you in the Subscription Agreement. It will be kept fully confidential and will not be used for any purpose other than supporting the production of reports for the subscriber. In due course, as benchmarking is introduced, company data may be used in aggregate and anonymous format but this will only take place with the prior, specific and written agreement of the subscriber and will be specific to agreed questions or questionnaires.

IT specifications

Where are the data stored?

Data are entered into and stored in a Microsoft SQL database.

What hardware and applications are used?

Thinking Board is Microsoft SQL-based. It is maintained on a dedicated DELL web server with a Windows operating system with an IIS default application system.

The graphics are produced using licensed software: FusionCharts and PowerCharts.

What is the physical location of the hardware?

The “back end” is stored on a dedicated server provided by WebFusion in a secure facility in Leeds which controls access through electronic cards, allows essential access only and is fireproof (www.webfusion.co.uk/dedicatedservers/features.php). The server includes hardware RAID to enhance data protection.

The back-up is on a remote server provided by ITBuilder (www.itbuilder.co.uk) and located in a secure facility. The encrypted data is stored in ITBuilder’s secure data centre with security pass access with servers contained in locked racks. The Ahsay Offsite Backup system uses a secure 128-bit SSL communication system/channel with all stored files encrypted using 128-bit Twofish with the defined encrypting key known only to IAL personnel. Access is also limited through restricted IP addresses.

Information is not stored on PCs. The developed use PCs for development only and no data is kept on PCs or Independent Audit Limited servers.

What is the data retention policy?

Data files are deleted from the server at the end of a subscription period and from the back-up server after 28 days. A user may request a copy of their data sheets (Excel) on ending their subscription provided the request is made at the time of ending their subscription.

What are the business continuity procedures?

Thinking Board is web-based and hosted on a dedicated server (www.webfusion.co.uk). In the event of failure of the dedicated server, data are automatically transferred to another disc. Furthermore a back-up is taken daily and maintained on a separate server in a separate physical location and managed by a separate provider (www.itbuilder.co.uk).

The two key controls in place are: the regular back-up process on a separate server; two nominated employees have authorised access to the server.

In the event of interruption of business at IAL or Third Party developer premises, programming or support will be provided by accessing the Thinking Board site maintained on the WebFusion server or the ITBuilder back-up.

What is the testing schedule?

Testing is not required as the site is maintained on a dedicated server which is not located at our premises.

In terms of functionality, testing is performed daily as the system is accessed constantly by IAL employees who are involved in providing client support, developing content and maintaining the site.

Does Thinking Board support multiple Operating System platforms?

No - Windows only.

What are the client browser requirements?

Java Script; visual add-ins; save cookies; Flash player

What are the database requirements?

Microsoft SQL 2005 (Express edition)

What additional server software is required?

Support of asp.net version 2

What are the hardware specifications?

There are no specific requirements.

Is there LDAP/single sign-on capability?

It is possible to set up single sign-on access using LDAP or an active directory. This could be set up within two to three days.

What is the level of encryption?

We operate full encryption of the database using standard Microsoft SQL encryption.