Governance The Hidden Risk of Role-Based Board Email Addresses

Role-based email addresses issued by the organisation are common on boards: chair@, ceo@, secretary@, treasurer@, admin@ etc. When someone leaves a role, nobody has to update the website or tell outside parties the new address, and the old correspondence stays with the organisation instead of leaving with the person who held the role.

However, there is a key risk with these types of email addresses: handing over the mailbox also hands over everything in it, including material the new office-holder may have no right to see. One of our team, Sam, found that out as a deputy chair.

A sudden change of chair

Sam’s work gave her a standing conflict of interest connected to one of the organisation’s contracted providers, and the board had resolved that anything between that provider and the board would be handled by the chair. The organisation in question ran Google Workspace and did not have a board portal at the time. It had a full account for chair@, another for ceo@, and so on for the other roles.

The chair was then seriously injured in a crash and could not continue in the role. Sam, as deputy chair, had to take over at once, and with contracts pending on another matter needed access to the chair@ account straight away to receive critical correspondence. The password was reset immediately, as it should be. The account held all the correspondence between the provider and the board, along with the related information and files in its Google Drive. Sam, the director the board had deliberately kept away from that material, could now open every email and file on the matter, even though the board had declared and managed the conflict properly and nobody had acted in bad faith.

Whoever gets the account gets everything in it

Boards manage a conflict by recording it in the register and minuting who will handle the matter instead. Those records name the people involved. A role-based account like chair@ takes no notice of either and passes, with its full history, to whoever holds the role next. Resetting the password stops the previous chair logging in; it does nothing about the correspondence already in the mailbox or the files in its Drive. Those could be cleaned out before the handover, but in an emergency there is no time for it, and the urgent business will not wait.

Conflicts are not the only material at stake. The mailbox may hold personnel matters, complaints, legal advice and personal information about third parties, and each new office-holder inherits all of it, however old it is and whoever it concerns. Organisations covered by Australia’s Privacy Act or the NZ Privacy Act 2020 must take reasonable steps to protect the personal information they hold (APP 11 and IPP 5 respectively). Handing every new chair years of other people’s correspondence is not a reasonable step to protect it.

Directors also have a duty not to misuse information they obtain in the role: section 183 of the Corporations Act 2001, section 145 of the NZ Companies Act 1993 for company information, and ACNC Governance Standard 5 for registered charities. A director who inherits a mailbox full of material they are conflicted on starts in an awkward position even if they do nothing wrong.

The ceo@ account

The chief executive’s account carries the same risk, and the material in it is often more personal. Over a CEO’s tenure, ceo@ collects their correspondence with the chair about their own contract, remuneration and performance reviews, and, when they go, about the terms of their departure. It also holds staff matters: complaints, investigations and disciplinary correspondence about people who still work for the organisation.

A vacancy makes it worse. If ceo@ passes to an acting CEO to keep correspondence moving, and applications or recruiter emails for the permanent role arrive at the same address, an acting CEO who applies for the job can read the other candidates’ applications. Whoever is appointed then inherits a mailbox holding their predecessor’s exit negotiations and, possibly, correspondence about their own appointment and salary.

Does a board portal solve it?

Only if each director’s portal account is their own. Many boards set up portal logins on the same role addresses, so the chair signs in as chair@ and the chief executive as ceo@. When one of those accounts changes hands, the new office-holder sees whatever the previous one could see, including papers and discussions they may be conflicted on, and any private notes or annotations the previous holder left. With individual accounts, the board can also keep a conflicted director out of specific meeting items: in Our Cat Herder the chair makes an agenda item confidential and excludes that director, so the item’s papers and minutes stay hidden from them while they take part in the rest of the meeting.

What your board should do

1. Point role addresses at people. In Google Workspace, set up chair@ as an alias on the current chair’s own account (for example, jim.chair@), or as a Google Group that delivers to it, instead of a separate account that is handed from chair to chair. In Microsoft 365, a distribution list does the same job. When someone leaves a role, you move the address to their successor, and the old correspondence stays with the person who received it. Anything the successor needs from that history can be shared securely through the board portal, where the board decides who sees each item, so critical information still reaches them without handing over the whole mailbox. If you use a Google Group, check whether it keeps a conversation archive, because new members can read it; turn the archive off or restrict who can view it.
2. Keep conflicted matters away from the role address. When the board resolves that one person handles a matter, give that matter its own address or route it through the company secretary, and note the arrangement in the conflicts register next to the declaration.
3. Settle the emergency handover in advance. Agree who takes over each role address if the office-holder cannot continue, and have the company secretary check that person’s declared conflicts against what the mailbox holds before access changes.
4. Register portal accounts to people. Set up each director’s portal account on their own address, such as jim.chair@, and close it when they leave the role. Any access limits the board sets for a conflicted director, such as exclusion from a confidential agenda item, then stay with that director.
5. If it happens anyway, declare it. The incoming office-holder should tell the board or the company secretary what they could see. Minute it, update the conflicts register, and keep the director out of decisions on that matter.

If your role addresses are already shared accounts

Many boards already have a chair@ or treasurer@ account with years of history in it. Converting it is far easier before a sudden change of office-holder than after one.

1. Export the mailbox and the account’s files. Your Google Workspace or Microsoft 365 administrator can export the full contents, including Google Drive or OneDrive. Some of it will be records the organisation has to keep, so archive it rather than delete it.
2. Store the export where the company secretary, and nobody else by default, can reach it. If a later office-holder needs something from it, the company secretary retrieves that item, checking it against the conflicts register first.
3. Switch the address over. In Google Workspace an address cannot be an alias while it belongs to an account, so rename the old account (for example, to chair-archive@) or remove it once the export is safe, then add chair@ as an alias on the current chair’s own account. Outside parties keep writing to the same address and notice no change. Move any portal logins registered on role addresses to the office-holders’ own addresses at the same time.

A policy clause you can adopt

A short clause in the board’s governance policies makes the arrangement stick when office-holders change. Adapt this one to your constitution and conflicts policy:

Board email and portal accounts

1. Each director and officer conducts board business from an individual account issued by the organisation in their own name.
2. Role addresses (such as chair@ and ceo@) are aliases or groups that deliver to the current office-holder’s individual account. They are not separate accounts and are not passed from one office-holder to the next.
3. Board portal accounts are registered to individual addresses.
4. Where the board resolves that a matter will be handled by a particular office-holder because of another director’s conflict of interest, correspondence on that matter is routed to [a dedicated address / the company secretary], and the arrangement is recorded in the conflicts register.
5. When an office-holder changes, including without notice, the company secretary moves the role address to the incoming office-holder and confirms that the incoming office-holder is given no access to material covered by their declared conflicts.
6. A director who sees material covered by their declared conflict tells the chair or the company secretary, and the board minutes it.

Where the board’s records belong

A role address works like a front door: it tells people where to knock. It is a poor place to keep the board’s records. Papers, minutes, decisions and conflict declarations belong in a system where every director logs in as themselves and the board controls who sees what, so that a sudden change of chair passes on the role and leaves the conflict arrangements where the board put them.