Question: What is your experience with applying IT policy to the Board of Directors? 

Please mention the country and industry you have experience in, since the advice you're sharing may or may not be the same across all industries.

**[Edit]**

It isn't uncommon for a single Board Member to be involved in more than one board/company. If this is the case, it's entirely possible that that individual may have conflicting IT policies in place if they were both applied to the same machine. How does this ultimately impact the way they do business?

Answer: 
If you're lucky enough to operate in a jurisdiction where [**directors would be personally liable**](http://www.soxlaw.com/s802.htm) for knowingly violating the protections in place, you can just wave that piece of law at them until they realise they had better comply with the policy.
A board member should never deviate from the companies policy where the policy applies to them. The policy should be clear on what applies to whom and what the consequences for violation are. Policies can have contradictory elements where "allowed vs not-allowed" depends on ones position and responsibilities. The board should be prepared to justify the policy to whomever they answer to. Shareholders, Regulatory Agencies, etc.

Where policy is concerned the one position you don't want to find yourself in is where you knowingly allow/aid users in circumventing the policy. If you have to have exceptions document them. Better yet make them part of the policy. If the board isn't comfortable documenting an exception and still insists on being the exception go polish your resume.

A board member shouldn't be any different from any other employee with regards to following the rules. But it is up to the board, barring any legal restriction, to decide if a different set of rules should apply to them.

It is the board member's responsibility to understand what is required of them. If they are placed in position of conflict they should reach out to both entities and try to reach a compromise. From a technical point of view the easiest solution would be complete segregation of resources, ie two separate machines. Obviously this isn't the most usable solution. I would try to shoot for giving them remote access to an internal machine that as limited access to just what they need to do their job. I am not a big fan of giving them email access where they can work with documents from their personal machine. No matter what you do be sure it is documented and you are doing what your policy states you are doing.