Ask an IT leader for a one-page board technology risk summary and one of two documents usually comes back. The first is a grid of colored squares — mostly green, a few amber, nothing red, because red invites questions. The second is a project status report with the deadlines quietly removed. Neither is a risk summary. A board that accepts either has learned nothing it can act on, and has produced a paper trail suggesting it was briefed.
That second consequence deserves a moment. A weak risk page is not neutral. It converts an unexamined exposure into a documented, apparently reviewed one.
Green, amber and red describe a mood, not a measurement
The heat map survives because it is cheap to produce and impossible to falsify. No one can prove that endpoint protection is amber rather than yellow-green. The format compresses judgment into color and then discards the judgment.
The deeper problem is subject matter. A heat map reports on controls — firewalls, patching cadence, awareness training, tooling coverage. Controls belong to the operator. A director cannot usefully approve or reject a patching cadence. What a board can do, and what only a board can do, is decide which exposures the company will carry and which it will pay to reduce. That decision never appears on a heat map, which is why the format reassures and changes nothing. This is an argument from structure rather than a research finding, and it is easy to test in your own boardroom: read last quarter's page and count the decisions it asked for.
Underneath sits an accountability shift. Cyber insurers ask pointed attestation questions at renewal. Enterprise customers push third-party risk questionnaires down to their smaller suppliers. Directors sign more documents about technology than they did five years ago. Offered as analysis rather than fact: signing without a defensible record of what you were told is the exposure that never makes the list.
Rewrite the page in the currency a board actually owns
A useful one-pager is a ledger of accepted risk. Each line names an exposure in business terms, states what it would cost the company if it happened, states what reducing it would cost, and records the decision. Four columns, not four colors.
- Exposure — described in one sentence a CFO would repeat correctly to a lender.
- Consequence — operational, financial, contractual or regulatory, stated plainly and without a dollar figure nobody can source.
- Cost to reduce — a real number from a real quote, or the word "unpriced" if no one has done the work.
- Decision and owner — funded, deferred to a date, or accepted, with the name of the person who accepted it.
The structural change is that last column. Every line ends in one of three words: funded, deferred, or accepted. Deferred means the board agreed to revisit it on a named date. Accepted means the board chose to live with the exposure and knows it. Both are legitimate outcomes. A line with no outcome is not, and that is what amber usually means in practice.
Keep the page short enough that a board can adjudicate every line in one sitting — fewer than ten, as a working discipline rather than a rule. Choosing which exposures earn a place is most of the value, because it forces the IT function to rank. Ranking is where the thinking happens.
Two lines that did not exist on the 2020 template
Most board risk pages in circulation are lightly edited versions of something written before hybrid work became permanent, before identity became the practical attack surface, and before generative AI entered the workflow without a purchase order.
The first new line is identity. The compromise pattern that matters most to a mid-market company does not require defeating a firewall; it requires obtaining a valid credential or a live session and using it the way the employee would. Stolen session tokens, consent-phishing against cloud apps, and business email compromise all route around the perimeter rather than through it. The board question is therefore not whether multi-factor authentication is deployed. It is whether privileged accounts, service accounts and machine identities are inventoried at all, and what happens when a finance user's session is taken over mid-transaction. Framed that way, cybersecurity stops being a tooling conversation and becomes a question about who can authorize a payment, and how that authorization is verified when a familiar voice on the phone may not belong to a person.
The second is AI exposure, which has two halves that boards routinely merge. One half is data leakage through sanctioned tools: an assistant inherits a user's permissions and surfaces files that were technically accessible but practically buried. That is a Microsoft 365 permissions problem wearing an AI costume. The other half is shadow AI — staff pasting contracts, client records or source code into consumer tools nobody approved. Remedies differ. Permissions hygiene fixes the first. Policy, monitoring and a sanctioned alternative address the second. A single line labeled "AI risk" tells a board nothing about which one the company has.
The one number the page cannot omit
If a single figure earns its place, it is this: how long the business can operate while its primary systems are unavailable, and how long restoration would actually take. Not the backup vendor's name. Not the phrase "we back up nightly." Hours, agreed with the people who would live through them.
The gap between tolerable downtime and demonstrated recovery time is where the damage lives, and most organizations have never measured it. Plan, too, on the assumption that a ransomware event includes data theft and not only encryption — in which case a clean restore ends the outage but not the incident, because extortion continues against the copy already taken. Treat that as a planning posture rather than a cited finding, and adopt it because the cost of being wrong is asymmetric. A credible disaster recovery line should therefore state three things: tolerable downtime, the date of the last verified restore test, and whether backups are immutable and separated from production credentials.
Add one operational line beneath it. Who answers at two in the morning, and how long before a human with authority is engaged. A recovery plan that depends on a ticket queue and a callback carries different risk from one where IT support answers live. Boards understand escalation paths. They have less patience for architecture diagrams, and rightly so.
What the page is actually for
A board technology risk summary is a governance record, not an IT update. Its function is to prove that specific exposures were named, priced, and consciously funded, deferred or accepted by people with the authority to do so — and to make next quarter's version comparable to this one. Everything else is decoration.
Judge your current version with one test. Hand it to a director who has never worked in technology and ask what decision it is requesting. If no decision appears on the page, the page is a status report, and the risk it documents most clearly is that nobody is deciding anything.
Pro Link Systems has served Los Angeles businesses from Woodland Hills since 1999, with an in-house, US-based help desk that operates 24/7 and answers the phone live. If your risk page reads like a color chart, our managed IT services team can help you rewrite it into something a board can sign.
Ready to talk to a real IT engineer?
Pro Link Systems has been protecting and managing IT for Los Angeles businesses since 1999. Book a free 15-minute discovery call — no pressure, no obligation, no scripts.