Institute of Risk Management · Board oversight
Posted by Dr Jenny Tan12 Aug 2026 ·
Should cyber risk be reported to the board in dollars?
Posted by Dr Jenny Tan12 Aug 2026 · 
Fewer than fifteen per cent of organisations in Asia-Pacific quantify cyber risk in financial terms. Most boards still receive heat maps and traffic-light dashboards.
Quantification promises better decisions and clearer trade-offs. Its critics say the numbers are false precision that create a dangerous sense of control.
Angles to consider
- Does your board see cyber risk as a number, a colour or a narrative?
- Has quantification ever changed an actual decision in your organisation?
- What is the minimum a director needs in order to make a good call on cyber investment?
Jenny's opening view
I think an imperfect number that provokes the right conversation beats a perfect colour that ends it. Convince me otherwise.
Enjoying the discussion?
Subscribe to hear about new questions, or invite Jenny to bring the conversation to your organisation.
Discussion ·