What Belongs on the Board's Version of the Technology Risk Register

Management's technology risk register can run to hundreds of rows. It is thorough, necessary and nearly useless in a boardroom. Directors cannot weigh a hundred items, so they skim, and the risks that matter get the same attention as the ones that do not.

The board needs its own version: a short list of the technology risks that could change the company's direction, with a clear view of whether each is getting better or worse and what decision, if any, is being asked of the board.

Ten rows is a good target. Fewer is fine. More is a sign the list has not been edited.

TLDR

• The board's register is a short edit of management's, not a copy.

• Aim for about ten risks, each with a trend and an owner.

• Show appetite status so directors see where the company is outside its comfort.

• Every row should say what decision, if any, the board is being asked to make.

• Update it every quarter and let rows leave when they stop mattering.

Why management's register does not work for a board

A management register is built for tracking. It is sorted by system or team, scored by a method few directors know, and updated constantly. That is right for operations.

A board needs something different: an editorial view. NIST's guidance on integrating cybersecurity with enterprise risk management, IR 8286, makes a similar point. It says directors and senior leaders need a clear understanding of cybersecurity risk posture, and it describes how risk registers can feed enterprise-level governance oversight.

A board-level register template

Each row needs five things. The rows below are illustrative.

Risk (illustrative)	Trend	Appetite status	Owner	Decision requested
Loss of the order system for more than a day	Worsening	Outside appetite	CTO	Approve funding for staged replacement
Dependence on one cloud provider for all revenue	Stable	Within appetite	CIO	None this quarter
Key-person risk in the data team	Improving	Within appetite	Head of Data	None; update next quarter
Customer data exposed through a vendor	Worsening	Outside appetite	CISO	Endorse tighter vendor requirements

Trend tells directors the direction. Appetite status tells them whether the risk is acceptable under the board's own stated tolerance. The decision column keeps the register from becoming a reading exercise.

How to choose the ten

Start with management's register and ask three questions of each risk. Could it change the company's strategy or financial position? Is it getting worse? Does the board need to decide something about it?

A yes to any of those earns a seat. Everything else stays in management's register, where it is still tracked and reviewed.

Keep it moving

A register that never changes becomes wallpaper. Retire rows that no longer matter and add new ones as the business changes. A short note on why each change happened keeps the record honest.

For the wider structure of board oversight, see a clear framework for board cyber risk oversight.

Frequently asked questions

How many risks should a board register hold?

About ten. The number matters less than the editing. Every row should earn its place by affecting strategy, getting worse, or needing a board decision.

What is appetite status?

A simple label showing whether a risk sits inside or outside the level the board has said it is willing to accept. It turns a score into a judgment.

Who prepares the board's register?

Management, usually the CTO or CIO with the CISO and risk team, edited from the full register and reviewed by the CEO before it reaches directors.

How often should it be updated?

Every quarter, with an interim update if a major event changes a trend or breaks appetite.

A Defensible Next Step

Ask management to produce the board's ten from the full register before the next meeting, using the five columns above. The first version will be rough. It will still be more useful than the hundred-row version. Book a Decision-Clarity Call if you would like help with the edit.