Walkthrough: Creating a custom report for our board that doesn't look generated.

Hey everyone! 👋 I’ve been living in the Tugboat Logic platform for the better part of a year now, managing our SOC 2 and ISO 27001 compliance programs. One recurring request from our board was for a “snapshot” report—something that felt less like a computer-generated checklist and more like a strategic business document. The out-of-the-box reports are fantastic for auditors, but they can come off a bit… clinical for leadership.

So, I dove into creating a custom report, and I wanted to share my journey, the pitfalls I hit, and the final configuration that worked. This isn't just about clicking "generate"; it's about bending Tugboat to tell a specific story.

**The Goal:** A clean, 5-6 page PDF for the board’s quarterly review, focusing on:
* High-level posture (not every single control)
* Trends over the last quarter (new risks, improvements)
* Visualizations that are simple and impactful
* A narrative on our top risks and mitigation plans.

**The Big Pitfall & Solution:**

The biggest challenge was that by default, reports pull *all* evidence for a control. For a control like "Quarterly Vulnerability Scans," you might have 12 pieces of evidence over a year. My first draft was 40 pages long! 😅

The key was using **Evidence Summaries** and the **`timeframe` filter** in the report configuration. I created a custom "Board Summary" report template and, crucially, set it to pull only evidence from the last quarter. Even better, I used the "Summarize Evidence" option for longer-running controls to get a paragraph description instead of a raw list of files.

Here's a snippet of the JSON structure I used in the template editor for a critical control section. This is where you move from the UI to the advanced editor for real control:

```json
{
"sectionTitle": "Security Posture Highlights",
"controls": {
"filter": {
"tags": ["board-highlight"],
"status": "implemented"
},
"display": {
"evidence": "summarized",
"timeframe": "last_quarter",
"show_test_results": false
}
}
}
```

I then used tags within Tugboat (`board-highlight`, `key-risk`) to manually curate which controls appeared. This gave me complete narrative control.

**My Workflow for a Quarterly Report:**

1. **Tag Controls:** At the start of the quarter, I review and tag controls relevant to board priorities.
2. **Update Evidence:** As always, evidence is gathered in real-time in Tugboat.
3. **Generate Draft:** I run the custom report template, which now only takes evidence from the defined quarter and summarizes it.
4. **Add Executive Summary:** I write a one-page intro in Word/Google Docs, then merge the Tugboat-generated PDF with it. (I haven't automated this part yet, but the Tugboat output is now so clean it takes 5 minutes).
5. **Review & Send.**

**Final Tips:**
* **Leverage "Exclude Sections":** I turned off the automatic "Evidence File List" appendix. It's unnecessary for this audience.
* **Custom Cover Page:** Don't forget you can add a company logo and a custom title right in the Tugboat template settings.
* **Test the Filters:** Run the report on a single control first to ensure your `timeframe` and `summarized` evidence settings are working as intended.

The result? Our last board meeting had the most engaged discussion on risk we’ve ever had. The report looked like something we produced, not something we generated. It built a lot of confidence.

Has anyone else tried to tailor reports for different stakeholders? I’d love to hear how you’re structuring things, especially for non-technical audiences.

—B