Cyber risk in the boardroom: reporting, challenge and crisis readiness

What does good cyber risk reporting to the board actually look like - and how does a board know whether it is getting the information it really needs?

This session brings together cyber governance and board perspectives to look at what makes reporting useful in practice. We explore what boards should expect to see, how NEDs can challenge effectively without needing to become cyber experts, and how risk appetite, impact tolerances, assurance and scenario testing can help turn cyber risk reporting into better risk governance decisions.

We will also challenge some of our own assumptions. In financial services, we often see ourselves as being relatively advanced in cyber risk governance. But are we? Are we sufficiently open to different ways of thinking about cyber risk beyond our own sector?

And when cyber risk becomes a real event, how well does all of this stand up? Has the reporting and preparation given the board the understanding it needs to respond effectively - and what can be learnt afterwards?

Please join us in this session organised by the Risk Management Lifelong Learning Committee in collaboration with the NED MIG, to share your views and questions too.

Speakers

Kalpana Shah FIA C.Act (chair)

Kalpana brings 30 years of business experience in the insurance and investment industry. She was longstanding Group Chief Actuary and Partner at Hiscox until 2016. She is now one of a handful of female chairs in the insurance industry, a non-executive director of several organisations and a member of the capacity transfer panel for Lloyd’s of London. 

Patrick Dunne

Patrick is the Chair of board consultancy Boardelta, working with charities The EY Foundation and ESSA- Education Sub Saharan Africa, Chair of the Oversight Board for the Chartered Management Consultant, and a trustee of the Chartered Management Institute. Author of the award winning 'Boards' and member of the Higgs review.

Susanne Alfs

Susanne is an economist and technology strategist who helps boards and executives govern cyber risk with confidence. Drawing on 25 years across IT strategy, enterprise architecture, digital transformation, and cybersecurity, including CIO leadership, she translates technical complexity into practical oversight.