Board and executive reporting for each GRC leader: what the CCO, CRO, CAE, CISO and CPO each report

Why one board pack carries six voices

Boards hear from compliance, risk, audit, security, privacy and, increasingly, data and AI. Each leader answers a different question, and each has a source that sets the minimum they must say. The sections below give that minimum for each role.

Chief Compliance Officer: program effectiveness

The US Sentencing Guidelines set the baseline for compliance reporting. Under §8B2.1(b)(2)(A), the governing authority must be knowledgeable about the content and operation of the compliance and ethics program and exercise reasonable oversight of it. Under §8B2.1(b)(2)(C), the people with day-to-day operational responsibility must report periodically to high-level personnel and, as appropriate, to the governing authority or a subgroup of it, on the effectiveness of the program. They must also have direct access to that governing authority.

Effectiveness is the test, so the CCO's report shows evidence rather than activity: obligations covered, policy attestation rates, training completion, hotline outcomes, investigations closed, regulator contact, and remediation status. §8B2.1(b)(5)(B) requires periodic evaluation of the program's effectiveness, so the pack carries the latest evaluation result and what changed because of it.

Chief Risk Officer: risk against appetite

COSO's Enterprise Risk Management framework (June 2017) has five components supported by 20 principles. Three principles define the CRO's report. Principle 1 places oversight of strategy and governance with the board. Principle 7 requires the organization to define risk appetite. Principle 20 requires the organization to report on risk, culture and performance at multiple levels and across the entity.

The CRO's board report therefore shows the risk profile against appetite, the top risks and how they moved, key risk indicators that crossed a threshold, emerging risks, and culture indicators. The CRO reports management's own view of risk, a second-line view the board sets beside the CAE's independent assurance.

Chief Audit Executive: results, plan and independence

The IIA's Global Internal Audit Standards, published 9 January 2024, are the most specific source. Standard 8.1 Board Interaction lists five things the CAE must report to the board and senior management:

• the internal audit plan and budget, and any significant revisions
• changes that could affect the mandate or charter
• potential impairments to independence
• the results of internal audit services, including conclusions, themes, assurance, advice, insights and monitoring results
• the results of the quality assurance and improvement program

Where the CAE and senior management disagree on scope or findings, the CAE must give the board the facts so it can decide whether to intervene. Standard 11.3 Communicating Results requires the CAE to communicate results periodically and for each engagement as appropriate. Results can include engagement conclusions, themes such as root causes, and conclusions at business-unit or organization level. The Standards also note that the CAE reports functionally to the board while the administrative line usually runs to management.

Chief Information Security Officer: cyber governance and material incidents

NIST CSF 2.0, released 26 February 2024, added Govern as a sixth Function. Govern covers how the organization's cybersecurity risk management strategy, expectations and policy are established, communicated and monitored, and it informs the other five Functions. Its six categories give the CISO a report structure: Organizational Context (GV.OC), Risk Management Strategy (GV.RM), Roles, Responsibilities and Authorities (GV.RR), Policy (GV.PO), Oversight (GV.OV) and Cybersecurity Supply Chain Risk Management (GV.SC).

For US-listed companies the SEC's cybersecurity disclosure rules, adopted 26 July 2023, set what the board must be able to disclose. Item 106 of Regulation S-K requires the annual report to describe:

• the processes for assessing, identifying and managing material cybersecurity risks
• the material effects of threats and previous incidents
• the board's oversight of those risks
• management's role and expertise

Item 1.05 of Form 8-K requires disclosure of a material incident within four business days of the materiality determination. A delay is allowed only where the US Attorney General finds a substantial risk to national security or public safety.

NACD's Director's Handbook on Cyber-Risk Oversight, first published with the Internet Security Alliance on 22 March 2023 and now in a 2026 edition, states six principles for boards. Principle Five, "Guide Cybersecurity Risk Measurement and Reporting", shapes the CISO's pack: measures the board has agreed, not the measures security happens to have.

Chief Privacy Officer: monitoring at the highest management level

GDPR Article 38(3) gives the data protection officer a reporting line in law. The DPO "shall directly report to the highest management level of the controller or the processor". The DPO receives no instructions on how to perform the tasks and may not be dismissed or penalised for performing them. Article 39(1) lists those tasks:

• inform and advise the organization and its staff on their obligations
• monitor compliance with the regulation and the organization's own policies, including assignment of responsibilities, awareness-raising, training and related audits
• advise on data protection impact assessments and monitor their performance
• cooperate with, and act as the contact point for, the supervisory authority

The CPO and the DPO are not always the same person. Where a DPO is appointed, the CPO's board report carries the DPO's monitoring results: the DPIA register and outcomes, compliance monitoring and audit results, supervisory authority contact, and open incidents and complaints.

Chief Data and AI Officer: AI risk accountability

The NIST AI Risk Management Framework 1.0 (January 2023) has four functions: Govern, Map, Measure and Manage. Govern is cross-cutting and sets the accountability structure. Govern 1.1 requires legal and regulatory requirements involving AI to be understood, managed and documented. Govern 1.6 requires mechanisms to inventory AI systems. Govern 2.3 places responsibility for decisions about AI risk with executive leadership. The Chief Data and AI Officer's report follows that structure: the AI system inventory, the risk decisions executives have taken, the obligations mapped to each system, and monitoring results.

Key facts

Where the six reports meet

The six reports draw on the same registers: risks, controls, issues, evidence and actions. When each leader keeps a separate copy, the board sees six versions of one issue. One register with a report per role removes that. In SmartSuite, the GRC Reporting capability in the Enterprise Risk Management suite holds the risk, KRI and appetite reporting the CRO, CISO and CPO use. The Audit Management suite holds the CAE's plan, engagement results and action-plan tracking.

FAQs

Should the CRO and the CAE present the same risks?

They should present the same risk register from different positions. The CRO gives management's assessment against appetite, as COSO ERM principle 20 describes. The CAE gives independent assurance on whether governance, risk management and control processes work, as IIA Standard 11.3 requires. Showing both beside each other lets the board see where management's view and the audit evidence differ.

How often should each leader report?

Most sources leave cadence to the board. The US Sentencing Guidelines say "periodically". IIA Standard 8.1 says the board sets the frequency of CAE communications and the criteria for escalation. The one fixed clock is the SEC's: a material cybersecurity incident goes on Form 8-K within four business days of the materiality determination, whatever the board calendar says.

Does the CISO brief the board on every incident?

No. The SEC rule requires disclosure of incidents the company determines to be material, and the board needs a defined route for that determination. For everything else, NACD Principle Five asks the board to set the measures and reporting it wants. A good pack shows incident trends against those measures and reserves immediate escalation for incidents that could be material.

Does the CPO have to report to the board?

GDPR attaches the duty to the DPO, not the CPO, and the line runs to "the highest management level", which may be the board or the executive committee depending on structure. Where the CPO is also the DPO, Article 38(3) applies to them directly. Where they are separate, the CPO's board report should carry the DPO's monitoring results unchanged.

Sources

• US Sentencing Commission, Guidelines Manual 2024, §8B2.1 Effective Compliance and Ethics Program: https://www.ussc.gov/guidelines/2024-guidelines-manual/annotated-2024-chapter-8
• COSO, Enterprise Risk Management: Integrating with Strategy and Performance, Executive Summary, June 2017: https://www.coso.org/_files/ugd/3059fc_61ea5985b03c4293960642fdce408eaa.pdf
• The IIA, Global Internal Audit Standards, published 9 January 2024: https://www.theiia.org/globalassets/site/standards/globalinternalauditstandards_2024january9_printable.pdf
• NIST, The NIST Cybersecurity Framework (CSF) 2.0, 26 February 2024: https://doi.org/10.6028/NIST.CSWP.29
• SEC, press release 2023-139, SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies, 26 July 2023: https://www.sec.gov/newsroom/press-releases/2023-139
• NACD, Director's Handbook on Cyber-Risk Oversight, 2026 edition, principles: https://www.nacdonline.org/all-governance/governance-resources/governance-research/director-handbooks/2026-cyber-risk-oversight/cyber-risk-handbook-principles-2026/
• NACD and ISA, press release, 2023 Director's Handbook on Cyber-Risk Oversight, 22 March 2023: https://www.nacdonline.org/about/newsroom/press-release/press-release/nacd-and-isa-launch-2023-cyber-risk-oversight-handbook-featuring-cisa-and-fbi/
• Regulation (EU) 2016/679 (GDPR), Articles 38 and 39: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679
• NIST, Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1, January 2023: https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf

Related

• Category: Executive & Board Reporting
• GRC Foundation: How to make GRC reporting useful to the board
• GRC Foundation: Board GRC reporting checklist
• GRC Foundation: How to design GRC dashboards by role
• What is: Governance reporting
• Solution: Enterprise Risk Management
• Solution: Audit Management

Reviewer credential line: to be completed by the named reviewer before publishing.