Publishing turns live programme data into a governed record. The objective is not to make the current position look complete; it is to let a decision-maker understand the material exposure, evidence limits, movement and decision required at a specific point in time.
Use this workflow with the IO Reporting™ Board Risk Update Skeleton.
Industry basis and IO position
NIST CSF 2.0 places cybersecurity risk within enterprise governance, while ISO 31000 and established board practice expect information that supports decisions within appetite and accountability. IO adds evidence lineage, explicit unassessable coverage and immutable publication versions. It does not define the board's legal duties or replace required regulatory reporting.
1. Set the reporting contract
Before generating anything, record:
| Field | Entry |
|---|---|
| Intended audience and committee | |
| Reporting period and cut-off | |
| Decision required or “for information” | |
| Risk-model and appetite versions | |
| Maturity-model version, if used | |
| Materiality rule | |
| Owner of the report | |
| Approver |
Do not change the cut-off after seeing the results. Late evidence belongs in an amendment or the next issue.
2. Freeze the evidence set
Create a reproducible snapshot of the eligible risks, verifications, source health, unassessable population, model versions and prior-period comparison. Record the generated-at time and source cut-off separately.
A snapshot is not a screenshot. It is the frozen derivation that allows the published figures to be reconstructed later.
3. Run the integrity checks
- Counts reconcile to the frozen eligible population.
- Within, in breach and cannot be assessed are mutually exclusive and complete.
- Coverage uses the same denominator as the position statement.
- Every changed residual names the verification that moved it.
- Threshold and model changes are separated from operational changes.
- Seeded, synthetic, asserted and observed values are labelled.
- Regressions, stale evidence, unowned risks and overdue breaches are not filtered out.
- Prior commitments retain their original due dates and status.
4. Apply the “board consequence” test
Every page should answer one of these:
- What decision is required?
- What exposure is outside appetite?
- What cannot yet be assessed, and what would make it assessable?
- What changed, and what evidence moved it?
- What commitment is overdue or at risk?
Operational activity without one of those consequences belongs in an appendix or practitioner report.
5. Review the language
| Avoid | Use instead |
|---|---|
| “The programme improved” | “Measured residual decreased for 6 risks following 3 verified interventions” |
| “No issues identified” | “No qualifying events were observed across the stated sources and window” |
| “Compliant” | Name the assessed requirement, assessor and scope, or do not use the term |
| “The intervention caused” | “The measure moved following the intervention” |
| “All systems connected” | State source coverage and record completeness |
6. Approve the exact issue
Approval attaches to the frozen content, derivation and model versions. Record approver, approval time and any disclosed limitations. Distribution status is a separate record; approved does not mean received.
7. Publish immutably
The published issue is read-only. New evidence creates a new issue. A factual error is corrected through a linked amendment that states what changed, why, who approved it and whether any prior decision should be revisited.
8. Close the loop
Record decisions, dissent, commitments, owners and due dates from the meeting. Bring unresolved commitments forward unchanged. The board update is part of the operating system only if its decisions return to execution and verification.
Publication gate
- Decision or information status is explicit.
- The three appetite states and coverage are shown together.
- Material evidence limitations are on the main page, not only the appendix.
- At least one responsible person can reconstruct each headline.
- The exact issue is approved and frozen.
- Distribution and follow-through are recorded.