The Audit Committee's Cyber Year: A Four-Meeting Cadence That Covers the Bases

Many audit committees meet cyber once a year: forty-five minutes, a slide deck, a motion to note the report. Then eleven months of silence while the risk picture moves.

The problem is not attention span. It is architecture. Cyber earns a place in every quarterly meeting, with each quarter carrying a distinct job, so the year as a whole covers risk, incidents, testing and forward planning without any single meeting trying to do everything.

Here is a four-meeting cadence that covers the bases without crowding the agenda.

Key takeaways

• Give each quarterly meeting one clear cyber job instead of one annual mega-briefing.

• Q1 sets the year: risk picture, program plan, and what success looks like.

• Mid-year meetings handle incidents, exceptions and the results of testing.

• Q4 closes the loop: what changed, what was spent, what next year needs.

• Short written updates between meetings keep the committee warm without adding meetings.

Step 1: Q1: Set the risk picture and the year's plan

Open the year with the current risk register, the top exposures, and the security program's plan for the year. The committee should leave knowing the three risks that matter most and what the program intends to do about them.

This is also the meeting to agree what good looks like: the two or three outcomes the committee will judge the year by. Write them down; they become Q4's scorecard.

Step 2: Q2: Review incidents, exceptions and early warning

Mid-year, look at what actually happened: incidents and near misses, what they cost, and what changed because of them. Review the open risk exceptions - which are aging, which need renewal decisions, which quietly became permanent.

The question that keeps this meeting honest: what did we learn this half, and what did we do about it?

Step 3: Q3: See the evidence from testing

Third quarter is for proof: the results of the year's tabletop exercises, recovery tests, penetration tests and any independent assessment. Not the activity - the findings and what closed.

A useful anchor is a single table showing tests run, findings raised, findings closed, and findings aging. This fictional example is an illustration, not a real report.

Test type	Run	Findings	Closed	Aging >90 days
Tabletop exercise	2	6	5	1
Recovery test	1	3	2	1
External penetration test	1	11	9	2

Step 4: Q4: Close the loop and set up next year

Close the year against Q1's scorecard: which outcomes were met, which slipped, and why. Look at spend against plan, not as accounting but as evidence of priorities - money moved toward the stated risks, or it did not.

End with the forward view: what next year's plan changes, and what the committee should expect to see in each quarter. The cadence then repeats with a known shape.

Step 5: Between meetings: one page, not one meeting

A short written update between quarters - incidents, material exceptions, and anything the chair should hear first from management - keeps the committee warm without adding sessions. One page, on a schedule, with a named owner.

NIST's framework treats governance as ongoing oversight with defined communication, not an annual ceremony. The cadence is that principle applied to a calendar.

The related discussion of the questions every audit committee should ask is worth your time alongside this one.

Frequently asked questions

Does every quarter need a formal presentation?

No. Two of the four can be structured discussions around a short pre-read. The discipline that matters is that each meeting has a defined job and leaves with decisions, not that each produces a deck.

What about urgent incidents between meetings?

The charter should define the trigger for out-of-cycle notification - typically a material incident or a disclosure decision. The cadence handles the routine; the trigger handles the rest.

Who owns the calendar?

The audit chair and corporate secretary own the agenda; the CISO or security lead supplies the content. If no one is clearly accountable for cyber appearing each quarter, it will quietly slip a year.

A Defensible Next Step

Take last year's audit committee agendas and mark every time cyber appeared and what it accomplished. If the answer is one annual briefing, sketch the four-meeting cadence for next year now. Book a Decision-Clarity Call if you want a worked calendar.