Risk Governance, Culture and Cyber Risk: Board Accountability in Practice
This domain tests how risk is governed, how culture shapes behaviour, and how cyber risk is treated as an enterprise issue rather than a technical one. Expect questions on committee structures, the three lines model, appetite architecture, cultural indicators, and the board's role in cyber and data protection.
Governance architecture
The board owns risk oversight and sets appetite; a board risk committee (usually chaired by a non-executive) scrutinises the risk profile and deep-dives; the audit committee oversees financial reporting and internal audit; a chief risk officer coordinates the framework. Under the IIA's Three Lines Model, the first line is operational management, which owns and manages risk; the second line is risk and compliance functions, providing expertise, oversight and challenge; the third line is internal audit, independent of management and reporting to the audit committee. Risk architecture also includes the risk policy, register, reporting cycle, delegated limits and escalation triggers.
Culture
Risk culture is how risk is actually discussed and acted on, evidenced by tone at the top, whether bad news travels upward, near-miss reporting rates, whistleblowing arrangements, how incentives reward risk-taking, and whether challenge is welcomed or punished. A risk-averse culture misses opportunity; an aggressive one accumulates unrewarded risk.
Cyber risk
Cyber risk sits at the intersection of operational, strategic and reputational risk. Frame it with the CIA triad (confidentiality, integrity, availability) and common vectors: phishing, ransomware, supply-chain compromise, insider misuse and unpatched systems. Frameworks include the NIST Cybersecurity Framework (identify, protect, detect, respond, recover) and ISO/IEC 27001 for an information security management system. Under GDPR and the UK Data Protection Act 2018, breaches likely to result in risk to individuals must be notified to the regulator within 72 hours, with fines up to €20m or 4% of global turnover.
Worked example
A private hospital group suffers ransomware. Reasoning: the first line (clinical and IT management) contains and recovers; the second line advises on regulatory notification and assesses control gaps; the third line later audits response capability. The board's questions are business continuity (can we treat patients?), the 72-hour notification decision, communications, and supplier assurance. Offline backups and rehearsed tabletop exercises limit downtime; cyber insurance covers response costs but not regulatory fines or lost reputation. Recommendations: ISO/IEC 27001 alignment, mandatory MFA, a tested incident response plan, and a board-level cyber KRI.
Traps that cost marks
- Placing internal audit in the first or second line, or saying the risk function owns risk.
- Treating cyber as purely an IT problem, or ignoring third-party and supply-chain exposure.
- Assuming insurance covers fines and reputational loss.
- Describing culture through slogans and posters rather than behaviours, incentives and escalation data.
- Forgetting the 72-hour notification clock and board accountability for data protection.