Risk committees tighten incident playbooks
Drawing from late-2025 risk briefings, here is the updated playbook risk committees are adopting for 2026.
Risk committees closed 2025 with sharper expectations: faster detection-to-decision cycles and clearer thresholds for board involvement. The emphasis is on rehearsal and ownership, not volume of reporting.
Define thresholds, then drill
- Set materiality triggers for cyber, AI, and operational incidents that require board notice.
- Run quarterly tabletop exercises with clear roles for management, counsel, and the board.
- Time-box decisions: require options, recommended path, and owner within the first briefing.
“Speed comes from rehearsals and single ownership, not bigger binders.”
Modernize the playbook
Late-2025 guidance called for merging cyber, AI, and third-party incidents into one response framework to reduce confusion. Boards want a single queue, not parallel escalations.
Board ask
Show us the first 72 hours: who convenes, what gets paused, when customers and regulators hear from us.
- Log mean time to detect, contain, and communicate across the last three incidents.
- Pre-authorize rollback and isolation steps for critical systems.
- Keep outside counsel and PR on retainer with defined SLAs for response.
Ready to brief your next board search?
We assemble researchers, operators, and assessors to keep your mandate on track. Expect a calibrated shortlist within weeks.
Delivery cadence
4-week sprint
Mandate alignment, success signals, and eligibility clarity.
Confidential outreach, operator-led screen, role fit check.
Dual-sided feedback, refined shortlist, committee readout.
References, governance checks, and introduction scheduling.