Governance · Board · Audit committee
Board and audit committee advisory
NIS2 and DORA make management accountable for cyber risk, and AI is heading the same way. I provide an independent reading of that risk for a few half-days a quarter: what to look at, what to ask, and what regulation expects of you.
Who it is for
- Executive committees
- Audit committees and boards of directors
- Independent non-executive directors
Typical situation
An incident in your sector, a new obligation (NIS2, DORA, the AI Act) that makes the management body accountable, or security reporting the committee struggles to interpret.
What I do
A light rhythm, aligned with your governance calendar.
Reading the risk
Reviewing the metrics and reporting presented to the committee, with an independent view of what they show.
Meeting preparation
Points of attention and questions to ask ahead of each meeting covering cyber or AI risk.
Management body duties
What NIS2, DORA and the AI Act expect of the management body, and how to demonstrate it.
Briefing sessions
Short sessions for committee members, focused on the decisions that are theirs to take.
Deliverables
- A briefing note ahead of each relevant meeting
- A list of questions to put to management
- A regulatory update on directors’ obligations
- Briefing sessions for the committee
Format and duration
- Format
- Recurring engagement, remote; attendance at key meetings can be arranged occasionally
- Indicative duration
- A few half-days a quarter
- Fees
- Quarterly fixed fee, quoted on requestEstimate the budget for this service
Frequently asked questions
Do you replace the CISO?
No. I work with the governance bodies, alongside the CISO or CIO, to help the committee carry out its oversight role.
Is AI in scope?
Yes. AI risk, AI Act compliance and the governance of internal AI use are covered in the same way as cyber risk.
Do you attend committee meetings?
Most of the work is done remotely: preparation, briefing notes and video calls, including during meetings. For a key meeting, attendance in person can be arranged occasionally, agreed in advance.
First call
In 30 minutes we can go through how your board and committees work, their calendar and what they need.