How do we decide what the executive committee sees each month, and what goes to the board?

Start

A metric could go to the committee, the board, or both

The pack runs three reporting levels. The security and IT leadership team runs the controls, monthly. The executive committee decides, monthly. The board governs, quarterly, through the board report. Each level gets the metrics it takes decisions on, and a metric that informs no decision is not collected.

• Then: Does it have an approved card and a target or thresholds?

Decision

Does it have an approved card and a target or thresholds?

Every metric needs an approved definition card before its first value is reported, and every performance indicator a target, every risk indicator green, amber and red thresholds. A metric with no target set does not reach any audience until one is set. If you are not sure the card is approved, treat it as not approved.

• Yes: Put it on the monthly operational dashboard
• No, or not known: Hold it back until the card and target are approved

Outcome

Hold it back until the card and target are approved

A number with no agreed target cannot be judged good or bad, so it moves the discussion to the measure instead of the risk. Finish the card first. For a risk indicator, the owner of the linked risk approves the thresholds, set from that risk's appetite and tolerance.

Step

Put it on the monthly operational dashboard

Every metric the organisation uses goes to the operational level, with trend, zone or status, and owner commentary. This is where the controls are run, by the security and IT leadership team, monthly.

• Then: Does the executive committee take a decision on it?

Decision

Does the executive committee take a decision on it?

A metric reaches the executive committee only if the committee decides on it. Write the decision as something a named person does: fund, reassess, escalate, change a plan, accept. The catalogue's Audience column shows the pack's starting view of which metrics are executive; adjust it to your committee.

• Yes: Report it to the committee every month, same value and card
• No: Keep it at the operational level

Outcome

Keep it at the operational level

It stays on the dashboard for the people who run the control. If no audience at all takes a decision on it, the pack's rule is that it is not collected. The yearly metric review retires metrics that informed no decision.

Step

Report it to the committee every month, same value and card

A metric shown to two audiences uses the same value and the same card at both; only the detail and commentary differ. Show each value with its target or thresholds, its direction since last period and its status in words. Never colour alone, never a combined index, never a score out of 100. A metric its owning pack defines over a quarter goes in the last month of each quarter only. In the pack's example, the committee's report gives its position against appetite in one sentence.

• Then: Is it a risk indicator outside green, or short of target?

Decision

Is it a risk indicator outside green, or short of target?

The committee level exists to decide, so its report centres on what needs a decision: the position against appetite, risk indicators outside green, performance indicators short of target, and the decisions the committee must take. Metrics on target or in green need no discussion.

• Yes: Give it a line of its own, with the plan and date
• No: on target or green: Keep it brief in the body; show its full figures

Step

Give it a line of its own, with the plan and date

For a risk indicator: its value, thresholds, direction, linked risk, the escalation made and its result. For a performance indicator short of target but within tolerance: the owner's commentary, the plan and the date; outside tolerance, an ask with options follows. Show every risk indicator outside green together, so the committee can see several warnings on one service at once.

• Then: Is a risk now past tolerance, or has a major incident happened?

Step

Keep it brief in the body; show its full figures

Metrics on target or in green need no discussion, so keep them short in the body of the report. Every value the committee receives is still shown with its target or thresholds, direction and status in words, so the committee can check any of them. Where that detail sits, such as an appendix, is your choice.

• Then: Does it feed one of the board measures you agreed?

Decision

Is a risk now past tolerance, or has a major incident happened?

These two cannot wait for the next board report. A move outside appetite but within tolerance waits for the next report. If a reassessment result is not yet clear, take the cautious branch.

• Yes, or not known: Tell the board or its equivalent out of cycle
• No: Does it feed one of the board measures you agreed?

Outcome

Tell the board or its equivalent out of cycle

In the pack's default, a short note to the chair within 5 working days, agreed first with the executive sponsor. Who that is depends on how you are governed: the board, or a board risk committee it has delegated to; the management board in a two-tier structure; executive management where there is no board. The news then opens the next full report.

Decision

Does it feed one of the board measures you agreed?

A measure reaches the board only if it answers a question the board asks and has a stated target or tolerance. The pack's board catalogue proposes eight board measures, and the board or its committee agrees the selection. The metrics catalogue shows which metric feeds which board measure; it feeds them and never copies them.

• Yes: Send it to the board quarterly, through its measure
• No: Does it need a decision only the board can take?

Step

Send it to the board quarterly, through its measure

In the last month of each quarter the same checked figures feed the board report, so the board and the committee see the same numbers. The board report follows Position, Direction, Exposure, Ask, with technical detail in an appendix. Whether the committee sees the board papers first is for your calendar to set; each ask says who has agreed it before the meeting.

• Then: Does it need a decision only the board can take?

Decision

Does it need a decision only the board can take?

The board decides appetite, priority, money above management's authority, and acceptance of risk above tolerance. Choosing a product, a supplier or a project plan is management's decision. Do not ask the board to decide what the committee should.

• Yes: Put it to the board as an ask with options
• No: The committee decides; the board sees only its measures

Outcome

Put it to the board as an ask with options

State the decision, why now, at least two real options with cost, a recommendation, the risk of not deciding, and who has agreed the ask before the meeting. Things the board only notes are kept separate, after the decisions.

Outcome

The committee decides; the board sees only its measures

The decision is taken at the executive committee, written as something a named person does, with a date. Follow it up at later meetings until it is closed, in your committee's own action list. The board sees the result through its agreed measures.