Introduction
Boards are now expected to oversee cyber, technology, regulatory, third-party, operational, and strategic risk together. Few want every meeting to become a technical status review.
The pressure is real. In PwC's 2026 survey of 561 directors, 82% rated the information linking AI outcomes and risks to business performance as fair, poor, or not provided.
Unclear committee mandates make that worse:
- Oversight gets duplicated across committees
- Escalation slows when issues surface
- Reports vary from meeting to meeting
- Nobody knows who can approve a risk decision
This guide covers how to define the committee, choose members, write the charter, and make the work inspectable.
Key Takeaways
- The committee oversees and challenges; management runs controls and the compliance program.
- A charter must set scope, authority, membership, cadence, reporting, and escalation thresholds.
- Members should match your actual risk profile, not just hold technical titles.
- Good oversight yields decisions, named owners, stable trends, and timely escalation.
What Is a Board Risk & Compliance Committee?
A board risk and compliance committee is a board-established body that helps the full board confirm significant risks and compliance obligations are identified, governed, monitored, and addressed within approved boundaries.
Oversight Versus Execution
Under the IIA's Three Lines Model, the governing body holds accountability and oversight, management owns action and risk treatment, and internal audit provides independent assurance. The committee challenges assumptions, reviews risk appetite and major exposures, monitors remediation, and escalates material concerns. Management owns day-to-day controls and treatment plans.
That line also separates it from a management compliance committee, which coordinates operational owners. The board committee stays independent of those owners and reports to the full board.
Is a Separate Committee Required?
Usually not. Requirements depend on company type, industry, listing status, and regulator:
- NYSE: the audit committee discusses risk-assessment and risk-management policies. There is no general separate-risk-committee requirement.
- Nasdaq: requires an audit committee and charter, with no general risk-committee mandate.
- SEC registrants: must disclose how the board oversees risk, including cyber oversight. That is disclosure, not a committee mandate.
- Large bank holding companies: Regulation YY requires an independent risk committee at $50 billion in assets and above, subject to its applicability provisions.
Spencer Stuart's 2026 Board Index found only 13% of S&P 500 boards have a risk committee. A combined audit-and-risk committee can work when risk is modest and members have capacity. Separate audit, risk, technology, or security committees give clearer accountability when exposures are heavy, such as in banking, healthcare, or large-scale data operations.
Why It Matters in High-Change Periods
A formal committee earns its keep when change hits hard:
- Cyber incident or regulatory shift
- New executive leadership or M&A
- Cloud adoption, AI deployment, or market expansion
In 2024 the SEC settled with four companies, including Unisys and Avaya, over misleading cyber disclosures. Clear escalation and disclosure controls matter most in those moments.
The practical payoff is fewer surprises, faster escalation, cleaner communication, stable metrics, and executable priorities, without slowing the business. That is the outcome Tyson Martin helps boards and risk committees build toward.
Who Should Be on the Committee?
Choose people with the independence, judgment, and experience to oversee your real risk profile. The most technical titles are not the test.
Board-Side Composition
- An appropriate chair, with independent directors where applicable
- Financial or risk expertise on the roster
- A defined process for appointment, rotation, conflicts, and annual skills assessment
NYSE and Nasdaq audit committees require at least three members and one financially sophisticated member. Regulation YY requires risk-management experience.
Keep the decision-making group small enough for candid discussion. Invite others for specific agenda items, and document the final roster in the charter.
Management Attendees and the Three Lines
Management supplies information; it doesn't replace board oversight. Typical attendees:
- CEO or COO, CFO, and general counsel
- Chief risk or compliance officer
- CISO, CIO, and privacy leader
- HR leader and business or operations executives
Keep the lines distinct:
- First-line business owners own risk
- Second-line risk and compliance functions set standards and monitor
- Internal audit attends as independent assurance, with a primary reporting line to the board and private access without management present
Internal audit should not act as management.
Advisers and Experts
The committee should be able to engage outside counsel, cyber or privacy specialists, and independent investigators without management approval. Both the F5 and Mastercard risk committee charters grant adviser authority and funding. Manage conflicts by screening advisers for independence and for ties to management or vendors.
An external adviser should not become shadow management, so set boundaries early.
A Skills-Gap Exercise
- List your five to ten highest risks.
- Map each to committee members' actual expertise.
- Mark gaps.
- Close each with director education, management attendance, or external advice.
71% of directors in PwC's 2026 survey named AI skills as a leading board-strengthening need. Not every board needs a cyber expert, but cyber competence should exist across the board, with deep expertise from a director, adviser, or committee support.
What Responsibilities Should the Committee Own?
The board must understand significant risk, test whether management's response is credible, and make sure material issues reach the right decision-makers.
Appetite, Compliance, and Culture
- Risk appetite and tolerance: review whether strategy, technology investments, third-party dependencies, and growth plans fit approved boundaries. Useful thresholds include maximum downtime, maximum data-loss window, and maximum fraud loss per period.
- Compliance oversight: cover regulatory obligations, policies, code of conduct, training, whistleblowing, investigations, privacy, anti-bribery, sanctions, and health and safety, as relevant to your sector.
- Culture and conduct: assess speak-up channels, retaliation protections, independent investigations, incentives, and recurring control failures. ECI's 2023 study found 53% of U.S. employees who reported misconduct experienced retaliation, so test whether policies change behavior.
Technology, Cyber, and Third-Party Risk
Stay at board level. Focus on:
- Business impact and material exposure
- Control effectiveness and recovery readiness
- Supplier concentration
Skip low-level technical activity.
Require a top-10 critical-vendor list and a plan for any one being down 72 hours. Verizon's 2026 DBIR found 48% of breaches involved third parties.
Monitoring and Remediation
Require reporting on significant incidents, audit findings, control failures, overdue actions, root causes, and risk acceptances. Then ask whether fixes worked.
Authority and the Responsibility Matrix
The committee can request information, interview personnel, commission reviews, access internal audit and compliance results, and escalate directly to the full board. That authority is for oversight, not day-to-day operations.
Build a matrix per risk category: technology, third-party, compliance and legal, and operational and trust. For each category, show the role of the committee, full board, management, internal audit, and the named risk owner. That owner may sit in product, operations, finance, or legal rather than security.
How to Build the Charter and Operating Model
The charter is the governing document, not an agenda. A new director or executive should be able to read it and understand purpose, decision rights, accountability, and escalation.
Core Charter Provisions
| Provision | What to document |
|---|---|
| Purpose and scope | What the committee oversees, what stays with the full board or other committees |
| Membership and independence | Appointment, qualifications, chair duties, conflicts, attendance, applicable independence rules |
| Authority and access | Records, personnel, internal audit, advisers, independent counsel, funding |
| Meetings and quorum | Cadence, special sessions, quorum, executive sessions, pre-reads, minutes, action tracking |
| Reporting and escalation | What goes to the full board, format, immediate-escalation triggers, documented risk acceptances |
Practice varies. Mastercard's charter requires at least three independent directors, four meetings a year, and a majority quorum. F5 keeps legal and regulatory risk with audit. Neither is a universal template, and Regulation YY requires quarterly meetings only for covered banks.
Build the Rhythm Around Decisions
A recurring agenda covers the items the committee must track and decide:
- Risk posture changes and top exposures
- Appetite exceptions and incidents
- Regulatory developments and remediation
- Emerging risks and required decisions
Each significant item should state:
- Business impact and current exposure
- Trend and control or treatment status
- Accountable owner and target outcome
- Decision or support requested
Distribute pre-reads 48 hours ahead, one page each when possible.
Review the charter annually. Reopen it after a material incident, acquisition, leadership change, regulatory shift, or business-model change.
Charter language should be tailored with qualified legal and governance advisers. This article is not legal advice.
How to Keep Oversight Actionable and Board-Ready
Turn reporting into a stable dashboard: what changed since the last briefing, why it matters, whether risk is within appetite, and what management does next.
Indicators and Thresholds
Use 8 to 12 consistent metrics mapped to appetite thresholds. Examples include:
- Time to detect and contain incidents
- Crown-jewel backup-restore pass rate
- Critical-vendor assurance and open high-risk gaps
- Critical-system patch time
- Overdue high-priority remediation and open risk acceptances
Show a three-month trend for each. The IBM 2026 breach study puts average identification and containment at 247 days combined, a useful context point rather than a target.
Escalation That Works
Define the path before you need it:
- Who is notified
- How fast the issue reaches the committee or full board
- What the first update contains
- How decisions are recorded
Under the SEC's 2023 rule, an 8-K is due four business days after a materiality determination, so the path to that determination must be clear.
A tiered acceptance model helps:
- Management accepts low risk within policy
- Medium needs time-limited executive approval
- High escalates quickly to the CEO and committee chair
Action Tracking
Give every action:
- A named owner and due date
- Dependencies and completion evidence
- Effectiveness validation
- Explicit closure or risk acceptance
Exceptions expire in 60 or 90 days with a compensating control.
Where an Advisor Fits
Tyson Martin works with boards and committees on clarifying decision rights, improving executive-to-board reporting, and setting a 90-day plan with owners and measurable outcomes during transition, modernization, or incident recovery. He can also step in as interim CISO. He advises and validates; he does not run security operations.
Frequently Asked Questions
What are the responsibilities of a risk and compliance committee of the board?
It oversees risk appetite, compliance program effectiveness, material incidents, regulatory obligations, remediation, reporting, and escalation to the full board. Management remains responsible for execution.
Who should be on the risk and compliance committee of the board?
Membership should reflect the organization's risk profile. Independent directors form the core, with risk, compliance, legal, finance, technology, cyber, and operations leaders attending as needed.
What are the five components of enterprise risk management (ERM)?
The COSO 2017 framework names Governance and Culture; Strategy and Objective-Setting; Performance; Review and Revision; and Information, Communication, and Reporting. Other frameworks use different terminology.
What should a risk and compliance committee charter include?
Purpose, scope, composition, authority, meetings, quorum, reporting, escalation, advisor access, relationships with other committees, and review requirements.
How often should a risk and compliance committee meet?
Match cadence to your risk profile. Regulation YY requires quarterly meetings for covered banks, and the Mastercard and F5 charters set four a year. Add special sessions for material incidents or major changes, and check your own regulator's expectations.
