Question 1

Which measures actually belong in a board pack?

Accepted Answer

Four to six, no more. In practice: risk posture against appetite, compliance coverage, mean time to remediate, third-party exposure, and spend against measured reduction. Anything a director cannot act on belongs in the management report underneath, not the board pack.

Question 2

Do you present at the meeting yourself?

Accepted Answer

On the Group tier we attend and present; on the others we prepare the pack and brief whoever owns the item. Many boards prefer their own executive to present, with us behind the numbers — that reads as ownership rather than outsourcing.

Question 3

Where does the data come from if we have no GRC platform?

Accepted Answer

From wherever the controls already run — ticketing, cloud posture tools, the risk register, HR systems. Reporting does not require a platform purchase; it requires agreeing which sources are authoritative and collecting from them consistently.

Question 4

Can this satisfy a regulator asking about board oversight?

Accepted Answer

That is much of its value. A dated series of packs showing measures against appetite, decisions taken and actions closed is the strongest available evidence that oversight was informed and continuous rather than reconstructed after the fact.