Board Reporting on Resilience

Board reporting on resilience exists to help the management body judge whether ICT risk is under control and whether recovery arrangements would work. A useful report therefore speaks in terms of services and customers: which services carry the greatest risk, how testing and incidents have tested recovery, which findings remain open, and where provider risk has changed. It also states plainly what is unknown or uncertain, because uncertainty is itself decision material.

A report that only lists projects completed, systems patched or meetings held does not meet that purpose. Activity is not assurance. The management body needs to know what has been proven, what remains unproven, and what it is being asked to decide. This guide explains how reporting can move from activity to judgement, and why the structure of a report shapes the quality of oversight that follows from it.

Reports organised by system or by project force the board to translate technology detail into customer impact, a translation it may not be equipped to make reliably. Reports organised by service reverse that burden. They start with the service, describe its dependencies in plain terms, and then explain the risks, tests and findings that bear on that service. The board can then judge customer impact directly, because the report has already made the connection.

A good report contains a concise risk picture, recent incident and test learning, open findings with owners and progress, provider developments, and decisions sought from the board. Each element should be linked to services. Incident learning should say which services were affected and what changed afterwards. Test results should say which scenarios were tested, how recovery compared with expectations, and which shortcomings remain. Provider developments should say which services depend on the provider in question.

Trends matter as much as snapshots. A single test result can mislead, while a pattern of repeated findings on the same service, or a pattern of actions repeatedly delayed, tells a governance story. Reporting should therefore show movement over time, including whether open findings are ageing and whether remediation is keeping pace with new findings. A report that resets its story each time, without carrying forward unresolved items, hides the very pattern the board most needs to see.

Reports should name uncertainty rather than smoothing it away. Recovery assumptions often depend on provider behaviour, on manual workarounds, or on staff availability during a widespread disruption, and those dependencies may never have been tested together. Stating that a recovery arrangement is untested, or tested only in part, is not a weakness of reporting. It is the information the board needs in order to decide whether to accept the risk, to require further testing, or to change the arrangement.

Bad news needs a route to the board that does not depend on optimism. If managers fear that reporting a weakness will be treated as personal failure, weaknesses will be softened before they reach the board. Governance can counter that tendency by treating surfaced problems as expected material for oversight, and by responding to honest reporting with decisions and support rather than blame. The tone set when a difficult report arrives shapes every report that follows.

Reports that only inform leave the board as an audience. Reports that seek decisions make the board a governing body. Decisions sought might include approving a revised framework, accepting a residual risk, requiring a retest, changing a provider arrangement, or prioritising remediation for a particular service. Each decision should be framed with the options, the reasoning, and the consequences of deferral, so that members can challenge and choose rather than merely note.

That discipline also prevents the pitfall at the heart of this cluster. A board pack that is noted, without a decision recorded, creates a record of attendance rather than accountability. When the next report arrives, the previous item should return as a decision already made or as an action in progress, not as a fresh discussion. Reporting and decision records therefore belong together: the report proposes, the minutes decide, and the action log tracks completion.

Reporting becomes weak when it is too long, too technical, or too reassuring. Length buries the important points, technical detail without a service explanation prevents judgement, and uniform reassurance removes the material for challenge. A report that uses the same positive framing for every service, regardless of test results, teaches the board to stop reading critically.