How do we…
How do we prepare for the questions the board will actually ask?
Add to board memoOpen the memo
The short answer
- Recommendation
- Rehearse before the papers go, not the night before. Have the executive sponsor mark every sentence a sceptical director would challenge, rehearse the likeliest and the uncomfortable questions, fix the report where you could not answer, and in the meeting never guess a number.
- Reasoning
- The report says where the organisation stands. The board's questions test whether it trusts that, and the person reporting it. A question you could not answer in rehearsal usually means the report is missing something, so it is fixed before the papers go. Trust is built by accurate answers, not confident ones: a figure said in the meeting goes in the minutes and outlives it, so a figure you do not have is promised by a date, then sent.
- Considerations
- The timings are the defaults in the CISO Times board reporting pack, counted in working days before the meeting: sponsor review at 9, rehearsal at 7, papers at 5, promised answers normally within 5 after. Your board calendar may set different ones. The order of the steps matters more than the days.
- If you may be in scope of NIS2 or DORA, prepare for questions on compliance, the board's own duties, liability and training. Agree those answers with legal first, say what the law requires in plain terms, and never tell a director they are not liable.
- After a breach in the news, never answer "it couldn't happen here". Check whether the same route exists here, and if it is not checked yet, say when it will be.
- Some questions belong to the sponsor, finance or legal. Agree in advance who answers which, so nobody improvises outside their authority.
The decision, step by step
Select any step for the reasoning behind it and where the pack covers it.
- Start
- Step
- Decision
- Outcome
Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.
Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.
Read as text
The same flow written out: each step, its reasoning and where the pack covers it. 17 steps.
Start
The draft report is ready for the sponsor's review
The report says where the organisation stands. The board's questions test whether it trusts that, and the person reporting it. In the pack's default cycle, the sponsor reviews 9 working days before the meeting and the rehearsal is 7 working days before, leaving time to fix the report before papers go.
In the pack
- P03-A06 Board Question Bank & Preparation BriefPurpose and audience
- P03-A06 Board Question Bank & Preparation BriefThe days before the meeting
Step
Have the sponsor mark every sentence they would challenge
The executive sponsor reads the draft and the one-page summary as a director would, and marks every sentence they would question. Each mark becomes a rehearsal question.
In the pack
- P03-A06 Board Question Bank & Preparation BriefWhat to do each day
Step
Pick the questions: most likely, uncomfortable, and unanswered
Take the most likely questions (ten in the pack's default), every uncomfortable one that applies, and any question the board asked last time that the report still does not answer. Uncomfortable ones include: why is this risk still outside appetite, have we been breached, would we pay a ransom, what would you do with more money, what keeps you awake at night.
In the pack
- P03-A06 Board Question Bank & Preparation BriefWhat to do each day
- P03-A06 Board Question Bank & Preparation BriefThe question bank
Decision
Has a breach in your sector or supply chain been in the news?
Directors read the same headlines and may be asked about them by customers, investors or their other boards. Check the news and sector alerts since the last meeting. If you are not sure whether a story will come up, prepare for it.
- Yes, or not sure: Prepare a short 'could this happen to us?' note
- No: Is the organisation in scope of NIS2 or DORA?
In the pack
- P03-A06 Board Question Bank & Preparation BriefIncidents
Step
Prepare a short 'could this happen to us?' note
In a paragraph: how it happened, in two sentences; whether the same route exists here, checked and not assumed; the answer, yes, partly or no, with the reason; and what is being done. If it is not checked yet, say when it will be. Never answer 'it couldn't happen here', and do not use the headline to ask for money without a costed ask.
In the pack
- P03-A06 Board Question Bank & Preparation BriefIncidents
Decision
Is the organisation in scope of NIS2 or DORA?
Both place duties on the management body itself, so directors ask about compliance, their own duties, liability and their own training. If scope has not been confirmed, prepare as if it applies.
- Yes, or not known: Agree the regulation and liability answers with legal first
- No: Rehearse with the sponsor, in the time you will have
In the pack
- P03-A06 Board Question Bank & Preparation BriefRegulation and personal liability
Step
Agree the regulation and liability answers with legal first
Expect these questions at every meeting until the board is confident of its duties. Say what the law requires in plain terms and point to legal advice; never tell a director they are not liable. Have the board's training record ready, and the minutes and action log that show its oversight.
In the pack
- P03-A06 Board Question Bank & Preparation BriefRegulation and personal liability
- P03-A06 Board Question Bank & Preparation BriefAdapting this template
Step
Rehearse with the sponsor, in the time you will have
Book 60 to 90 minutes (the pack's default) with the sponsor and, if you can, someone who thinks like a director. Present as you will, and stop at the time limit. The sponsor asks the chosen questions in no set order, at least three of them uncomfortable. Answer each in about a minute, with the answer in the first sentence. With no one to rehearse with, record yourself and listen back.
In the pack
- P03-A06 Board Question Bank & Preparation BriefThe rehearsal
Decision
Did any question go unanswered, or get a guess or jargon?
Record each gap: a question you could not answer, answered with a guess, or answered with technical detail. A question you could not answer usually means the report is missing something.
- Yes, or not sure: Fix the report or prepare the answer before papers go
- No: Agree who answers which questions
In the pack
- P03-A06 Board Question Bank & Preparation BriefThe rehearsal
Step
Fix the report or prepare the answer before papers go
Correct the report where the rehearsal found a gap. Prepare 'have ready' material for the likeliest questions as a short appendix or notes you carry, not as extra slides. Every figure comes from the signed-off data workbook.
In the pack
- P03-A06 Board Question Bank & Preparation BriefWhat to do each day
- P03-A06 Board Question Bank & Preparation BriefRequired inputs with owners
Step
Agree who answers which questions
Some questions belong to the sponsor, to finance or to legal: a legal duty, a budget figure, a personnel matter. Decide in advance who takes them, so nobody improvises outside their authority.
In the pack
- P03-A06 Board Question Bank & Preparation BriefThe rehearsal
Step
Send the papers, then freeze the figures
Papers go to the board secretary, by default 5 working days before the meeting. From then on, no figure changes without telling the chair. The day before, brief the sponsor on anything that has changed and read the last minutes and action log.
In the pack
- P03-A06 Board Question Bank & Preparation BriefWhat to do each day (rule BR-08)
Decision
In the meeting, can you answer from evidence you have?
Trust is built by accurate answers, not confident ones. A figure said in the meeting goes in the minutes and outlives it. If you are not sure of the figure, treat it as not known.
- Yes: Answer in one sentence first, then give the reason
- No, or not sure: Say you don't know, and give a date to come back
In the pack
- P03-A06 Board Question Bank & Preparation BriefAnswering honestly
Step
Answer in one sentence first, then give the reason
Answer the question asked, first: yes, no, a number, a position. Label facts, estimates and opinions. Do not reassure beyond the evidence: 'it reduces the risk; it doesn't remove it'. Put bad news first. Answer technical questions briefly and offer the detail afterwards.
In the pack
- P03-A06 Board Question Bank & Preparation BriefAnswering honestly
Step
Say you don't know, and give a date to come back
'I don't know' is a complete answer when followed by what you would need to find out, and when. Never guess a number. Give a date, by default within 5 working days, and record it as an action.
In the pack
- P03-A06 Board Question Bank & Preparation BriefAnswering honestly
Step
Record commitments, and add new questions to your bank
Agree the record of decisions and actions with the board secretary, by default 3 working days after the meeting. Add every unexpected question to your own question bank with the answer that worked. If a question shows a measure is missing, check it against your metric selection.
In the pack
- P03-A06 Board Question Bank & Preparation BriefCapturing questions, decisions and commitments
- P03-A06 Board Question Bank & Preparation BriefAfter the meeting
Outcome
Send every promised answer by its date
Use a one-page written follow-up to the chair through the board secretary: the question as minuted, a short answer, the detail, the source, what changes, and whether a decision is needed at the next meeting. Within a year your own question bank will be more useful than any template.
In the pack
- P03-A06 Board Question Bank & Preparation BriefFollow-up template
Practical checklist
- Have the executive sponsor read the draft and the one-page summary and mark every sentence they would challenge.
- Pick the likeliest and the uncomfortable questions, and prepare a short "could this happen to us?" note on any breach in the news.
- If NIS2 or DORA may apply, agree the regulation and liability answers with legal, and have the board's training record and the minutes and action log ready.
- Rehearse in the time you will have, answering each question in about a minute with the answer first.
- Record each gap: a question not answered, answered with a guess, or answered with jargon. Fix the report or prepare the answer, and agree who answers which questions.
- Send the papers, and change no figure afterwards without telling the chair.
- In the meeting, answer first, label facts, estimates and opinions, and give a date for anything you do not know.
- Agree the record of decisions and actions with the board secretary, and send every promised answer by its date.
Evidence to have ready
- The record of questions, answers and commitments from the meeting, agreed with the board secretary.
- The action log, with each promised answer, its owner and its due date.
- The written follow-ups sent to the chair through the board secretary, with the date each was promised and sent.
- Your own question bank, updated with the questions the board actually asked.
Assumptions
- There is an executive sponsor, or another senior colleague, who can read the draft and play a sceptical director.
- Timings shown are the defaults in the CISO Times board reporting pack, counted in working days before the meeting. Your board calendar may set different ones. The order of the steps matters more than the days.
Not covered here
- How to answer 'are we secure?' honestly. That is “If the board asks "are we secure?", then how do I answer honestly?”.
- What to say about directors' personal liability under NIS2. That is “If a board member asks about their personal liability under NIS2, then what do I say?”.
- How to answer a question about peers. That is “If the board asks how we compare with our peers, then how do I answer?”.
- When the board needs an update at all. That is “When does the board need a cyber update, and how often?”.
Related questions
- If the board asks "are we secure?", then how do I answer honestly?
- If a board member asks about their personal liability under NIS2, then what do I say?
- If the board asks how we compare with our peers, then how do I answer?
- How do we report cyber to the board as governance rather than a status update?
- When does the board need a cyber update, and how often?