The manner in which the ISO presents risks and threats to the board is one of the most consequential disciplines in board engagement. Done well, it builds confidence in the security function’s leadership, enables informed governance decisions, and reinforces the ISO’s standing as a trusted adviser. Done poorly, it creates anxiety without resolution, consumes limited board time unproductively, and can trigger board micromanagement of operational matters that fall squarely within management’s remit.
The governing principle is straightforward: the board expects the ISO to arrive not merely with an identification of risk or a description of threat but with a considered, evidence-based response to both. The ISO’s role is to inform, advise, and recommend; the board’s role is to govern, oversee, and decide. Maintaining that distinction with discipline is the foundation of effective risk and threat communication at board level.
Presenting Risks #
Before the Presentation #
Before bringing any significant risk to the board, the ISO should ensure the following are in place:
- A clear, actionable response plan with defined ownership, timeline, and resource requirements, ensuring that the board is being asked to govern a managed situation rather than confront an unresolved problem
- An honest assessment of the risk’s potential impact expressed in business and financial terms, connecting the technical reality to the commercial consequences the board is responsible for governing
- A contextualisation of the risk relative to the organisation’s stated risk appetite and tolerance levels, making explicit whether the risk falls within, at the boundary of, or beyond what the board has indicated it is prepared to accept
- Where multiple response options exist, a structured summary of the alternatives and their respective trade-offs, enabling the board to exercise genuine strategic choice rather than simply ratifying a single management recommendation
During the Presentation #
When presenting the risk, the ISO should:
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
