Module 125 minutes
What the Board Owns
Duties, accountability and disclosure
The question: What exactly are we accountable for, and what must we disclose?
You keep: Board duty map
Specialist programmeThe Board Lab: Cyber and AI Risk
Directors do not need to be technical. They need to ask the right questions, read the answers and decide.
- 6 modules
- About 2 hours 55 minutes
- 6 artefacts you keep
- 30-day plan
Who it is for
Written for the people around the board table
Directors, chairs of audit and risk committees, CEOs, CFOs, general counsel and company secretaries, and the CISOs and CROs who report to them.
The problem
Boards receive long technical reports, green dashboards and reassurance. Then an incident arrives, and the decisions in the first day are made by people who have never practised them.
You leave having made the decisions once, in a room where mistakes are free.
Outcomes
By the end, you can answer
- What exactly are we accountable for, and what must we disclose?
- Which events would hurt us most, and how much?
- Where are we using AI, where is it using us, and who decides?
- How do we know what management tells us is true?
- When it happens, what does the board decide, and in what order?
- What will this board do differently from next quarter?
Outline
Six modules. Each ends with something you keep.
Every module answers one question. The artefact is completed before you move on.
Module 230 minutes
Read the Risk in Business Terms
From threat reports to scenarios with a price
The question: Which events would hurt us most, and how much?
You keep: Top five risk scenarios
Module 330 minutes
AI on the Board Agenda
Where AI creates value, exposure and new fraud
The question: Where are we using AI, where is it using us, and who decides?
You keep: AI use and exposure page
Module 425 minutes
Challenge Management Well
Questions that get evidence, not reassurance
The question: How do we know what management tells us is true?
You keep: Board question set
Module 540 minutes
The Crisis Lab
Six hours, four decisions, one board
The question: When it happens, what does the board decide, and in what order?
You keep: Crisis decision log
Module 625 minutes
The Board Oversight Plan
Appetite, dashboard, cadence and skills
The question: What will this board do differently from next quarter?
You keep: Board oversight plan
CapstoneThen a 30-day plan
Your 30 day plan
- Week 1. Agree the duty map and who owns cyber and AI risk at board and management level.
- Week 2. Replace the current dashboard with the top five scenarios and the leading indicators.
- Week 3. Approve the cyber and AI risk appetite statements and the question set.
- Week 4. Schedule the next crisis exercise and the board skills review.
What you produce
Six artefacts, one binder.
- Module 1Board duty map
- Module 2Top five risk scenarios
- Module 3AI use and exposure page
- Module 4Board question set
- Module 5Crisis decision log
- Module 6Board oversight plan