Audit Committee Q&A Lab
It is the quarterly cyber session and the committee is in the room. Now the hard part: a director asks “are we secure?”, there is a material gap you could surface or bury, a finding is back for the third quarter running, and someone wants a remediation date today. Sit in the CISO's seat and make each call the way that builds the committee's trust rather than spends it — surface gaps before you are caught, answer with risk instead of a guarantee, and commit only to dates you can hit. Each decision shows you why.
Pair this drill with the free Audit Committee Cyber Briefing Pack — the document that structures the session you practise here. Educational drill, not legal or audit advice.
The real job. More noise, a tighter clock.
You are the CISO presenting at the quarterly audit-committee cyber session. Work 10 board-room decisions — surface the gaps, answer the hard questions honestly, commit to dates you can hit, and make each call the way that builds the committee's trust rather than spends it. You are graded on how many you get right against the clock.
What this lab is
- A free, browser-based decision drill on running the quarterly audit-committee cyber session: work ~14 board-room decisions about what to surface, how to answer the hard questions, and how to report posture so the session builds trust.
- The theme throughout: credibility comes from honesty and follow-through — surface material gaps yourself, answer "are we secure?" with risk, not a guarantee, and commit only to remediation dates you can actually hit.
- You practise the real moments: presenting a repeat finding, keeping the committee's oversight role distinct from management's, tying posture to a framework (NIST CSF / ISO) and the board-approved risk appetite, knowing when to escalate to the full board, and handling a director's pointed question without defensiveness.
- Each decision reveals why the trust-building answer is right, and you are graded S–D on how many you call correctly against the clock.
- Educational decision drill — not legal or audit advice. Pair it with the free Audit Committee Cyber Briefing Pack template.
Frequently asked questions
What is the Audit Committee Q&A Lab?
A free, in-browser decision simulation that puts you in the CISO's seat at a public company's quarterly audit-committee cyber session. You work through board-room decisions — how to answer "are we secure?", which control gaps to surface, what date to commit to, how to present a repeat finding — and each one has a single trust-building, defensible answer, revealed after you lock in your call.
How should you answer the board when they ask "are we secure?"
Never with an absolute "yes" — that is a guarantee you cannot keep and it will be read back after the next incident. The trust-building answer is honest and risk-based: name where residual risk sits relative to the board-approved appetite, what is improving, and the specific exposures you are most worried about, so directors have something they can actually oversee.
Is this legal or audit advice?
No. The lab is an educational drill. References to frameworks (NIST CSF, ISO 27001), the audit committee's oversight role, and disclosure escalation are summarised for orientation and can change. Confirm the current requirements and apply them to your governance structure with qualified counsel and your auditors.
Who is it for?
CISOs, security leaders, general counsel, CFOs, audit-committee members and board directors — anyone who sits in, or presents to, the committee that oversees cyber risk, and who wants to rehearse the quarterly session before it is real.