The one-page IT risk view: a director’s briefing that earns its place in the board pack
Photo: UK boardroom directors reviewing one-page risk report around table, via s3.amazonaws.com
Boards do not lack information about IT risk. They often lack the right information at the right altitude. The pack arrives with heat maps, patch rates and incident counts, yet directors leave the meeting without a clear view of what they have decided. A better briefing is shorter, more financial and explicitly decision-led.
Start with the decisions, not the systems
The board’s role is to set risk appetite, assure itself that controls are proportionate and make a small number of explicit trade-offs. It is not to manage the estate. Every item in the briefing should therefore answer one question: what does the board need to decide, note or challenge?
A useful discipline is to limit the page to three or four risks. More than that and the board will discuss the least important one. For each risk, include six fields: the risk in business language, the exposure, the direction of travel, confidence in the evidence, the decision required, and the owner with a date.
The six fields that earn their place
The risk statement should describe an outcome, not a cause. ‘Ransomware could stop order processing for four days’ is a board statement. ‘Phishing attempts increased by 30%’ is an operational metric. The exposure should be financial where possible, with regulatory and operational consequences alongside it. Direction of travel matters more than a static rating: is the risk improving, stable or worsening? Confidence should be stated plainly — for example, ‘based on a tabletop exercise in September 2026’ or ‘supplier assurance not yet received’.
The decision column is the one directors value most. It might be ‘approve additional recovery capability’, ‘accept the residual risk until renewal’, ‘require an exit plan before contract extension’ or ‘defer pending further assurance’. The owner should be a named executive, not ‘IT’.
What to leave out
Leave out vulnerability counts, patch compliance percentages, the full risk register, project status colours, technical architecture diagrams and incident timelines unless the incident is material. These have a place in an assurance or operations committee. Including them invites the board into detailed management, which is not its role.
If a director asks for technical detail, offer a separate briefing. The board page should remain a decision aid. A useful test is whether a new director could read the page in five minutes and understand what is at stake.
Framing cyber, resilience and supplier risk
Cyber risk is best expressed as a business interruption and data protection question. A successful attack may affect revenue, customer service, regulatory notification and reputation. Under UK GDPR, a personal data breach may require notification to the ICO within 72 hours where the threshold is met. Directors do not need the technical route of the attack; they need to know whether the organisation could detect, contain and recover.
Resilience is about tolerances. If the board has set a maximum tolerable disruption of eight hours for a customer-facing service, the briefing should state the current recovery time and the gap. For regulated firms, operational resilience expectations from the FCA and PRA make this a board-level question rather than an IT metric.
Supplier risk is a dependency question. Which services could not be replaced quickly? Which contracts lack exit plans, audit rights or tested service credits? Which renewals fall in the next twelve months? For public sector suppliers, Cyber Essentials may be a condition of contract; for all organisations, subcontractor chains deserve scrutiny.
Running the thirty minutes
Five minutes should set the purpose. Ten minutes should cover the three risks, with the presenter stopping at the decision column rather than narrating the journey. Ten minutes should be reserved for decisions. Five minutes should confirm actions, owners and dates.
The chair should ask three questions: what would cause us to change course, what evidence would raise our confidence, and who owns the decision. The CFO should be briefed beforehand so that financial framing is consistent. The CIO or CISO should not be asked to defend every control; they should be asked to present the trade-offs.
Common failure modes
The first is appendix creep. Once a technical appendix is accepted, the board will gravitate towards it. The second is a risk register presented as a board paper: it is a management tool, not a governance document. The third is no decision ask, which turns the item into a briefing rather than governance. The fourth is an owner called ‘IT’. The fifth is stale evidence; a risk page dated six months ago undermines confidence.
The test of the page
The test is not whether the page is comprehensive. It is whether it changes a decision, sharpens a challenge or confirms that risk is within appetite. If it does none of those things, it is a report rather than a briefing. Directors should leave knowing what they have accepted, what they have required and what they will see next time.
A one-page view will not eliminate uncertainty. It will make the uncertainty governable. For UK boards in 2026, that is a more useful outcome than another polished appendix.
