When Two Board Committees Think the Other Owns the Risk

The audit committee hears that a vendor control issue belongs with the technology committee. The technology committee sees a commercial dependency and expects the risk committee to handle it. All three have reasonable reasons. None has scheduled the decision.

The problem is not that nobody cares about the risk. It is that each committee owns a different view of it, while the handoff between those views has no owner. Reporting reaches several rooms without producing a clear conclusion.

Board committee cyber risk oversight needs more than a broad allocation of subjects. It needs a way to route an actual decision, confirm that another body has accepted it and keep the issue visible until the right response is recorded. That is different from sending everyone the same presentation.

TLDR

• Shared interest in a risk is not the same as accepted responsibility for its oversight.

• Map decisions and referrals, not just topics such as cyber, AI or third parties.

• Name a lead oversight body without pretending to remove the full board's responsibilities.

• A handoff is complete when the receiving body accepts it and the originating body can see the outcome.

• Management remains responsible for operating controls and managing risk within its authority.

Follow the unresolved decision

Start with the question waiting for an answer. Is management seeking funding, a change to risk tolerance, review of a control failure or oversight of a remediation delay? One issue can generate several decisions with different routes.

A vendor outage may require management to restore service, an assurance review of recovery controls, and a board discussion of strategic concentration. Treating all of that as one item called vendor risk hides the work. Separate the decisions before deciding which committee should lead each one.

The IIA's Three Lines Model distinguishes governing-body oversight, management action and independent assurance. Use that boundary while mapping committee work. A clearer board map should not turn directors into the incident response team or make internal audit responsible for fixing the control it later reviews.

Give the referral an acceptance point

A referral should say what is being transferred, why the receiving body is appropriate and when a response is needed. Identify the person responsible for confirming it has reached an agenda or another agreed route.

Copying a committee chair does not necessarily establish acceptance. Nor does a note that an issue was discussed elsewhere. Keep the originating committee's item open until the receiving body acknowledges the referral and the next checkpoint is clear.

This is an operating recommendation, not a claim that every organization needs the same committee structure. Charters, reserved matters and applicable duties still control. Counsel and the corporate secretary should help align the process with those arrangements.

A fictional committee handoff map

In this fictional example, a company has audit and technology committees. Its approved governance arrangements reserve a major strategic dependency decision to the full board. These labels are illustrative, not a universal allocation of duties.

Decision or question	Lead oversight route	Handoff and return evidence
Has management corrected the failed recovery control?	Audit committee, supported by independent assurance.	Named executive provides correction evidence; reviewer reports retest result.
Can management deliver the proposed technical alternative?	Technology committee under its charter.	Committee records its assessment and refers strategic tradeoffs to the board.
Is the remaining concentration consistent with strategy and tolerance?	Full board under the assumed reserved matters.	Decision records the exposure, conditions and management follow-up.
What happens before the next scheduled meeting?	Existing chair and escalation arrangements.	Corporate secretary confirms the authorized route and records the outcome.

Each row also needs a management owner, a date and the record where the answer will appear. Oversight can be shared without leaving the decision owner ambiguous.

Reconcile the answer back into one record

The receiving committee may ask for more evidence, refer a matter back or conclude that the full board must decide. All are possible outcomes. None should disappear into a separate set of minutes that the originating committee never sees.

Maintain one issue reference with links to the relevant decisions. The record should distinguish the management response, each committee's oversight work and any decision reserved to the board. A common issue reference is more useful than a forced single committee label.

Parker Poe's discussion of cybersecurity in committee charters emphasizes clear allocation within the board and between the board and management. The handoff record makes that allocation testable: can someone follow the issue from first referral to final response without relying on memory?

Test the boundary with a tabletop

Choose an issue that spans mandates: a failed vendor control, an AI product change or a remediation delay affecting a planned launch. Ask each committee chair what they would expect to receive, decide or refer.

Then test the awkward interval between meetings. Who can bring the issue forward? Which route applies if the normal chair is unavailable? What information must accompany the escalation? Do not invent an emergency approval power during the exercise. Find the actual authority and correct any gap through the organization's normal governance process.

Finally, review two real referrals from the previous quarter. If nobody can show acceptance, a return date or the resulting decision, fix the handoff rather than requesting another dashboard.

Sources

The IIA, Three Lines Model, governing-body, management and assurance roles. Parker Poe, Addressing Cybersecurity in Board Committee Charters (2015), clear allocation and charter alignment. The handoff method and scenario are practical recommendations, not prescribed legal duties.

Frequently asked questions

Should one committee own all cyber risk oversight?

There is no universal structure. The right arrangement depends on the organization, its charters and applicable duties. What matters here is that each decision has an understood route and that shared work does not create a gap.

Does naming a lead committee remove full-board accountability?

No. A lead coordinates the work within the organization's arrangements. It does not erase responsibilities retained by the full board or assigned elsewhere by law, charter or policy.

How is this different from a committee responsibility matrix?

A subject matrix says who follows cyber, technology or risk. A handoff map follows a specific unresolved question, records acceptance by the receiving body and shows how the answer returns. Both can be useful.

Who should maintain the handoff record?

The organization should assign that task explicitly, often through the corporate secretary or another governance support role. Management owners remain accountable for their actions, and committee chairs remain responsible for their committee process under the applicable arrangements.

Closing

Ask about the last cyber issue that moved between committees. Who accepted it, when did the answer return and where is the decision recorded? If that path is hard to trace, the next improvement is a working handoff, not a wider distribution list.