Blog Post
The Cyber Risk Number That Goes to Three Different Committees
October 7, 2026
An exposure figure is produced once and read three times. The audit committee sees it, the risk committee sees it, and the board sees it, and each is answering a different oversight question.
The figure travels well and the reasoning behind it does not. What arrives at the third reading is a number with no assumptions attached, and by then it reads as a fact.
What Does Each Committee Ask?
Three distinct questions, and each needs something different to travel with the number.
The audit committee asks whether the figure is accurate and controlled, so it wants the method, the inputs and who produced it. The risk committee asks whether the figure sits within appetite, so it wants the threshold it is measured against and the direction of travel. The board asks what the figure changes, so it wants the decision it supports and what the alternatives cost.
One Report Cannot Serve All Three
Provenance detail is what the audit committee needs and what the board will not read. A decision framing is what the board needs and what the audit committee treats as beside the point. The same figure requires three different accompaniments rather than three different figures.
What Gets Stripped at Each Handoff?
Whatever the previous reader needed and the next one did not, which produces a predictable pattern.
Each handoff summarizes, and summarizing removes the derivation before the risk committee and the appetite comparison before the board. So the audit committee receives a figure with a method and no threshold, the risk committee receives a threshold with no method, and the board receives neither.
Which Is Not Anybody's Mistake
Every step is a reasonable editorial decision made by somebody condensing for the next audience. The cumulative effect is a number stripped of everything that qualified it, produced by a process where no single step looks wrong.
Why Does the Figure Gain Confidence as It Travels?
Because the qualifications are what mark it as an estimate, and they are the first thing removed.
A figure presented with its assumptions, its date and its dominant sensitivity reads as a modeled estimate. The same figure three handoffs later reads as a measurement. Nothing was added to justify the extra confidence, and everything that invited scrutiny was taken away.
Which Is the Inversion Worth Naming
The further a number travels from the person who produced it, the more authority it carries and the less anybody in the room can interrogate it. So the reading with the highest stakes is the one conducted with the least available context, and what a modeled figure cannot establish is hardest to remember at exactly that point.
What Should Travel With the Number?
Three fields, short enough that nobody removes them for length.
- The as-of date: Which assessment the figure came from, so a number quoted months later is visibly a number quoted months later.
- The dominant assumption: The single input the figure is most sensitive to, and what it would be under the plausible alternative.
- The appetite threshold: The stated tolerance the figure is measured against, so the comparison survives the handoff.
Three lines, attached to the figure rather than to the report, so they move with it when somebody copies the number into a different deck.
Who Answers the Provenance Question?
Frequently nobody in the room, which is the structural problem underneath the reporting one.
A committee receives papers through a secretariat, and the person who built the model is rarely present. So when the audit committee asks how the figure was calculated, the answer comes from somebody relaying rather than somebody who knows, and the follow-up question cannot be answered at all.
What Is the Cheap Fix?
Naming the author alongside the figure. A named person who can be asked is a different governance position from an unattributed number, and it costs one line, which auditing a model somebody else built becomes considerably easier with.
Does It Matter Which Committee Owns Cyber?
Less than whether the handoff preserves context, though the arrangement has one predictable effect.
Where audit owns cyber oversight, the accuracy question dominates and the appetite question can go unasked entirely, because it is not audit's mandate. The figure gets scrutinized for how it was derived and never compared against a tolerance, so the organization knows the number is defensible without knowing whether it is acceptable.
Which Argues for the Comparison Being Explicit
A figure reported alongside its threshold forces the appetite question regardless of which committee is reading, and an appetite statement that can be breached is what makes the threshold a real number rather than a sentiment.
What Happens When the Figure Moves Sideways?
The same stripping, with an added problem, because a lateral handoff has no summarizing convention at all.
A figure produced for a board paper gets copied into a supplier questionnaire, an insurance submission, an acquisition data room and a regulatory response. Each destination has its own definition of what the number should cover, and the figure arrives without the scope it was built for.
Which Produces Inconsistency Rather Than Overconfidence
Vertically the figure gains unearned authority. Laterally it gains contradictions, since the same organization ends up stating different exposure figures to different external parties, each correct for its original scope and none reconcilable with the others. An acquirer comparing them finds a discrepancy nobody can explain.
What Prevents It?
Recording the scope alongside the figure as a fourth traveling field. A number labeled with what it covers can be legitimately different from another number covering something else, and without the label the two look like a disagreement, which two defensible routes to different answers covers as a diagnostic problem in its own right.
What Should Be Established?
Three things, and the first can be checked by reading last quarter's papers.
Whether the figure that reached the board carried its date, its dominant assumption and its appetite threshold, or arrived alone. Whether the person who produced it is named. Then which committee is expected to ask the appetite question, since where nobody is expected to, nobody does. Board reporting built from the same model the operational teams use is what keeps the three readings consistent, and the same numbers for two audiences covers the external version of the same problem.
The Number Arrives Alone
Three committees read one figure and ask three questions, so the audit committee wants the method, the risk committee wants the appetite threshold, and the board wants the decision. Each handoff summarizes and removes whatever the previous reader needed, leaving the board a figure with neither derivation nor comparison, produced by a chain where no individual step looks wrong. The qualifications are what mark a number as an estimate, so removing them makes it read as a measurement, and the reading with the highest stakes happens with the least context. Three fields fix most of it, being the as-of date, the dominant assumption and the appetite threshold, attached to the figure rather than the report. Kovrr's board reporting draws from the same model the operational teams use.
To see a board figure that carries its date, its assumptions and its threshold, book a demo with our risk experts.
Committee Reporting FAQs
Speak to an ExpertWhat does an audit committee ask about a cyber risk number?
What does a risk committee ask about a cyber risk number?
What should travel with a cyber risk figure between committees?
Why does a risk figure gain confidence as it loses context?
Does it matter which committee owns cyber risk oversight?
Who should be named alongside a reported risk figure?
