In the town of Millway, the city council recently experienced a harrowing cyberattack that exposed sensitive resident data, leading to a public outcry and a loss of trust. City Manager Sara Thomson, who had always been passionate about community safety, found herself at the center of the crisis. Residents bombarded her with calls and emails, demanding answers and solutions. The incident not only disrupted the town's operations but also put a strain on the council's ability to function effectively.

Realizing the gravity of the situation, Sarah knew that the council needed to take immediate action. She proposed a special meeting to address the cyber breach and to discuss the broader need for a more robust risk management strategy. The council's response would be crucial in restoring public confidence and ensuring the town's resilience against future threats.

As this scenario shows, public boards today can face an array of risks, from cyber threats and financial instability to natural disasters and declining trust. Whether you’re overseeing a municipality, school district or community college, one thing is clear: proactive risk management is essential for safeguarding operations, ensuring continuity and maintaining public trust.

Yet many organizations still lack a clear, board-level strategy for identifying and responding to risk.

So, how should a board proceed, especially if there’s no dedicated risk management committee in place? In this article, we’ll explore best practices for managing risk at the board level, how to establish or enhance oversight, and tools to streamline the process. Whether you’re building a formal committee or embedding risk planning into regular meetings, there are strategic steps every board can take now.

The time for risk management planning is now

Threats can spring up at any time. We’ve seen many examples in recent years, from pandemics and weather emergencies to financial crises and ransomware attacks. Any of these can affect a public board, whether its organization is a small municipality, large school system or a medium-sized community college.

Boards can't afford to wait to take action.

However, it's also important for boards to be clear on how their role interfaces with senior administrators — and not micromanage. The board isn't responsible for eliminating risks; they're only responsible for making sure that risks are accounted for and that a plan is in place for preventing and responding.

So, the board has a fine line to walk, but it can be helpful to think about active risk management for boards as being visionary and strategic. 

 requires taking knowledge of the past risks and past performance to predict future scenarios and solutions in order to ensure the long-term prosperity of the organization.

Planning efforts should balance the cost of action against potential risks.

As a Diligent Community customer on the Diligent One Platform, use Diligent AI Risk Essentials to simplify oversight with AI-powered benchmarking for identifying risks quickly

AI-powered risk benchmarking

Risks public boards need to be aware of and oversee

Operational, strategic, political and reputational risks each present unique kinds of opportunities as long as the board is aware of them and it takes a responsible approach to addressing them.

The list of risks is long, and no matter what type of entity you oversee, there is likely overlap between categories. Still, there are risks particularly significant for each type of organization. Let’s take a look:

Government: Unsustainable public finances, weak or unsustainable growth, labor shortages, deficient cybersecurity 

School districts: Cyber attacks, aging infrastructure, legal exposure 

Community colleges: Cyber breaches, faculty and staff attrition, student activism, national disaster 

Starting with the risks more likely to affect your organization or entity can make preparation efforts more manageable.

"Start with an objective, work backwards, look at the process, look at the technology, look at the provider and then look at it from a risk and resilience perspective, how do we keep the lights on and how do we ensure that that can be delivered." - Scott Bridgen, General Manager of Audit and Risk, Diligent

Establishing a board-level risk committee

Accountability is an important component to managing risk. Boards can assign responsibility to a risk management committee, so they have assurance of accountability. The committee takes responsibility for board-level risk management and oversight of management-level risk programs.

What does a board-level risk committee do?

Establish the organization’s risk profile and define its overall approach to risk management.

Explore the best ways to put controls in place to make sure all parties fulfill their obligations of controlling risks. Committee members could be instrumental in raising awareness of best practices and procedures of risk governance and providing education to the board.

Communicate the risk management profile to the board and the management team and encourage them to use it as a standard in making decisions. Boards can minimize or avoid major risks by practicing good oversight over the agreed-upon risk management profile.

Communication is key. Other board committees should equally be aware of the organization's risk profile. Boards with communication committees should coordinate their communications efforts with those of the risk management committee, and the audit, compliance and strategic planning committees must share the profile as well.

It's best to take an open and honest approach in communicating the 

Risk management without a dedicated committee

Perhaps your organization doesn’t have the resources to form a separate risk management committee. In that case, risk management tasks can be added to the regular meeting agenda to ensure your entity covers this topic meaningfully.

Much of the work of a risk management committee can be completed by smaller boards meeting regularly or by working groups providing regular updates.

The important thing is to take action, no matter the size or your organization.

A newly formed risk management committee, working group or effort will have many tasks ahead in the beginning. The first is to clarify the organization's risk tolerance and risk profiles. Noting the 

 of similar organizations and municipalities serves as a learning experience for all boards.

From there, the committee must evaluate the risks and rewards, as well as any potential trade-offs. The committee will also need to evaluate any environmental circumstances that they need to monitor or manage. In addition, they'll need to scan the internal and external environment for new threats and any new opportunities they might present.

A city has personally identifiable information, or PII, for employees and residents. What if a ransomware demand threatens the exposure of data?

A charity depends on a charismatic, well-networked executive director for a large percentage of annual donations. What happens if that individual departs suddenly?

An older facility on a school campus lacks modern fire-protection measures and is in an area prone to drought. What is the plan to relocate that building’s functions if it is threatened?

Upfront planning lessens the possibility that the board will need to be reactive toward viable threats like those above. Clear risk management reduces the negative impact on employees, processes, technology and the general environment.

How board management software can help with risk management

Diligent Community streamlines meeting preparation, making sure agendas and board packets are centralized, accessible and easy to update. With less time spent manually compiling agendas and board packets and fixing errors, the team can focus on identifying and addressing risks instead of wrestling with paperwork.

Board members can access key information for meeting preparation and decision-making easily on any device, anywhere and any time, and they can make private annotations as they prepare for upcoming discussions and votes.

Documents and board business are kept secure instead of in unsecure email or file-sharing systems, helping to mitigate against cyber risk.

Seamlessly manage multiple board committees or meeting groups all within Diligent Community

Customize who can create, access and engage with content within each committee, ensuring the right stakeholders are involved

Tailor custom workflows and approval trees for each committee, optimizing efficiency and accountability

Allow the public to subscribe to specific committee groups for updates through your public website, enhancing transparency and engagement

Optimize efficiency by creating custom workflows and approval trees for every committee

Diligent Community helps improve public trust around how the board is managing risks, by giving the board a way to show the community they are making thoughtful, responsible decisions. The tools make it easy to share meeting minutes, voting records and financial updates online. With everything out in the open, residents can feel reassured and board members feel empowered to keep making smart choices.

As a Diligent Community customer on the Diligent One Platform, your team will also be able to access 

, helping you simplify risk oversight with AI-powered benchmarking to identify relevant risks quickly, and support you along the way with guided onboarding and educational resources, including access to Diligent Institute’s new ERM Certification.

Risk management is increasingly falling under a public board’s purview, so every board member needs to be aware how teamwork on risk can protect the organization’s future. With Diligent Community, boards can streamline the work to minimize threats. 

Risk management for public boards: What you need to know

 Voting newswire. To register for a demonstration and trial of the product,

 continues around the merits and drawbacks of potential reforms to Rule 14a-8, DMI discusses the shareholder proposal process with Hester Peirce, commissioner at the Securities and Exchange Commission (SEC).

What would success in shareholder proposal reform look like for you?



For me, success would mean getting the balance right with shareholder proposals that are being made in the long-term value of the company as opposed to individual proponent’s idiosyncratic interests. The question is, how do you get that right balance? You've got to get the incentives right and at present, I don’t think that we have those.



How do you balance requiring a meaningful economic stake while keeping the process accessible to all investors?



I don't know if the process should be open to as many investors as possible. The thresholds should be high enough so that it is a barrier because you don't want to be in a situation where someone is just picking up a few shares for a short amount of time to lob in a shareholder proposal on an issue that's important to them.

When you put in a proposal, you are claiming the time, attention and resources of the company, and so you ought to have a real thesis behind it.

I think part of the problem is that the discussion around this topic is being phrased as if we should be drawing the parallel between shareholder democracy to voter democracy. It's a different thing. We don't let any voter who has an issue stick it on the ballot. This is just a different world.



Given the resources required to arbitrate between companies and proponents, should the current system be reworked? Could more direct negotiation and settlement agreements offer a simpler alternative?



One thing you could do which would not maintain the current processes is to say that the SEC staff isn't going to do this at all. The other thing is that with clearer rules and guidance, the number of proposals that companies feel needs excluding goes down.

I do worry about the process because it's unlike anything else that we do at the SEC. It is putting staff in the uncomfortable position of making decisions on these things, so I'm open to thinking about other ways of doing it.

It would be great if companies and shareholders worked this out, except for the problem that you have, which is that the settlement itself can be a very problematic occurrence.

What are they agreeing to? Is that something that is in the interest of the company, or are they just doing it to get that proposal to go away? How is that helping other shareholders? The other shareholders don't have any visibility into that process and that's problematic.

My preference is to have the SEC not involved in this. It should be decided at the state level how those are going to be handled, and then shareholders can opt in or out of companies depending on whether they like that or not.



If the SEC was to see further reductions in headcount, how might that affect enforcement?



Firstly, the goal to make the government more efficient is positive. We have a lot of wonderful talent at the SEC. We have lost some people, and we certainly have lost some experience with those people, but we have a very dedicated, professional, excellent workforce here and I think you will see that the SEC is still an agency that's committed to regulating the markets well.

Enforcement is not going to go away, because if you write rules and don't enforce them, then essentially, you don't have rules.

There may be decisions made, and I've been very open about saying that I think we've used our enforcement tools inappropriately in some instances so there will be careful consideration about when it is appropriate to use enforcement.

Also, there are lots of people who are working hard and maybe the addition of some tools can help them to do their jobs more efficiently. While artificial intelligence (AI) does pose some risks, it can be a valuable tool in helping make our people more efficient.



 that it had ended its defense of climate-related disclosure rules. Do you see a future for rulemaking that establishes mandatory reporting on climate or other ESG issues?



Materiality has been the touchstone of our disclosure regime. It has proved to be a very effective touchstone because it allows us to have a disclosure regime that works for all kinds of companies and helps people to see the company through the eyes of the management and board. That's the result we want.

Every time a new issue comes up for some companies, we don't want to have to change our disclosure rules. Our rules should be able to stand the test of time and that works better if you use materiality as the touchstone, I think that's consistent with the job that Congress gave us to do.



Should your time as commissioner end at your second term, what would you want your legacy to be?



I think this commission is about multiple people. It's not about one person, and we have excellent staff who do amazing work, so I think the legacy is not mine alone.

I am excited about Chairman [Paul] Atkins coming in. He's someone I worked with before. I am excited to be able to turn back to the issues of capital formation, helping to ensure that people of all different levels of wealth have access to financial services and products so that they can improve their lives.

There have been a lot of people over many years now working to make our capital markets the envy of people all across the world, the place where people want to come to raise money, where they want to come to build businesses. That is the work of many, many people in government and outside of government.



The views expressed in this Q&A are those of Commissioner Peirce and do not necessarily reflect those of the Securities and Exchange Commission or its staff.

IN-DEPTH: Q&A with SEC Commissioner Hester Peirce

Director outlook improves slightly in May amid continued headwinds

After a 30 percent decline in March, directors’ rating of business conditions in the U.S. retreated another 5 percent in May, according the 128 U.S. public company board members polled May 12-14 as part of this month's Director Confidence Index, conducted in partnership between Diligent Institute and 

The Index, which measures directors’ confidence in the current business environment, is now down to 4.4, on a scale where 1 is Poor and 10 is Excellent, from 4.7 in March and 6.7 at the start of the year.

Directors’ expectations for what those conditions will be 12 months from now, however, improved slightly in our May polling, clawing back 4 percent of the previous quarter’s 33 percent drop. While a small proportion, we captured a similar uptick in optimism among CEOs in the 

This month’s forecast highlights a potential 9 percent improvement in the business landscape 12 months out, according to our director survey—an improvement the board members polled attribute to a likely positive resolution to the current trade negotiations.

“Government efficiency and fair trade will ultimately improve economic outlook at a macro level,” said Phil Garfinkle, chair of the WidePoint board, noting however that some industries may nevertheless “stumble as they navigate the new horizon.”

Some directors added that the strength of the U.S. economy should also counterbalance the uncertainty surrounding tariffs. “A lot of noise currently with unknowns, but fundamentals are sound,” said one director, echoing others.

As a result, 40 percent expect business conditions will continue to improve over the coming months. That proportion is up from 36 percent last quarter. Perhaps even more telling is that the proportion of directors who forecast things will deteriorate further in the coming months declined by nearly half in May, to 21 percent from 41 percent in March.

“We need to get through the short-term tariff overhang; underlying business activity will strengthen as uncertainty lessens,” said one director.

“The policy transitions underway will be clearer [by this time next year]—and many will contribute to stronger forecast,” added another director who forecasts growth and improvement over the coming months.

Still, 57 percent continue to expect a recession within the next six months—a situation several called “unavoidable."

Overall, 48 percent say despite the uncertainty in the current environment, they remain focused on growth this year, though 36 percent said they are also keeping a close eye on risk mitigation through reforecasting and scenario planning.

More specifically, 39 percent said they are working on diversifying their supply chain and/or revising their pricing model, the two items they say have been the most impacted by recent changes to trade policies.

When asked how all of this is expected to impact companies’ bottom lines, directors shared their forecasts:

65 percent forecast increases in revenue in 2025, down from 69 percent in March.

59 percent forecast profit growth this year, down from 69 percent.

41 percent plan to increase capital expenditures in the months ahead, up from 32 percent in March.

Director Confidence Index: May 2025

Our AI Fact Sheet is your go-to resource for the latest research and insights from Diligent Institute on artificial intelligence (AI)integration and board oversight. Updated quarterly.

Artificial intelligence (AI) is transforming how companies operate, presenting both tremendous opportunities and new challenges for boards and leadership teams. As rapid advancement requires proactive oversight, Diligent Institute’s latest research provides a snapshot of how organizations and their boards are responding—and what actions they should consider next.

See below for a recap of some survey findings from the Diligent Institute on how AI is being used at different organizations and how the board is thinking about AI integration.

: An annual survey of U.S. public company directors conducted in partnership with Corporate Board Member and FTI Consulting.

42% of directors cite optimizing operations and enhancing workforce productivity as the biggest opportunities of incorporating generative AI into their businesses.

32% of directors identify the lack of knowledge and capabilities among leadership as the biggest risk in using generative AI.

80% of public company directors report their company has taken some sort of action regarding rapid changes in AI development and deployment.

44% of companies have incorporated AI into one or more areas of their business, including products and services.

: A quarterly survey of directors and GCs conducted in partnership with Corporate Board Member.

60% of directors said their GC provides minimal to no support to the board in its oversight of AI.

AI Insights from the Corporate Director Podcast

We also feature leaders in AI and governance, risk and compliance on our biweekly podcast! Below, you’ll find some key tips from our recent guests on AI integration.

Key quote: “I think it's probably 3 to 5 years before it would actually be a violation of our duties as General Counsel not to use A.I. The level of discourse will improve because we will see outstanding board texts prepared with the help of AI. You'll see real-time dashboards instead of a businessperson spending all night doing it.”—Cecilia Ziniti, Founder and CEO, GC AI

Incorporating gen AI into business strategy

Key quote: “A robust AI governance framework is crucial. This includes AI ethics guidelines, continuous risk assessment, data privacy compliance, transparency protocols, human oversight, and scenario testing to align AI investments with business objectives while managing risks." —Sophia Velastegui, AI Business Leader, Director and Committee Chair, BlackLine, Former GM of AI Products and Chief AI Officer, Microsoft

Key quote: “The pace of change with AI remarkably rapid. We're now entering the era of autonomous agentic AI, and that really emphasizes the need for directors to obtain ongoing education. You can't oversee something you don't understand. Keep an eye on the regulatory landscape. It's evolving, it's fragmented, and this really affects how and where a company may be able to use generative AI.”—Claudia Allen, Senior Advisor, KPMG Board Leadership Center

Additional resources from Diligent Institute

: This report, created with the Institute of Directors, guides you through leveraging AI responsibly. Based on expert insights, you'll understand open vs. closed systems, protect your data, upskill talent in AI engineering and leadership, ensure transparency and governance, and integrate AI effectively while mitigating risks.

"AI isn’t a luxury for big corporations only; it’s an essential tool for small businesses." —Rob Noble, Chair at The Webinar Vet, MBA-IT and Founder of Fidem Consulting

“Data privacy and security are critical, especially when it comes to AI. Companies need to ensure all policies and protocols are locked down.” —Craig Bentley, Co-Founder of Ignite AI Partners and Branch Chair of the IoD

"Maintaining a diverse team can foster innovation and reduce the risk of groupthink, which is vital for successful AI adoption.”—Pauline Norstrom, Founder and CEO of Anekanta AI

AI is no longer an emerging issue on the periphery—it is a board-level priority demanding deliberate action. Directors who prioritize education, effective governance, and responsible adoption can help their organizations harness AI’s benefits while mitigating risks. Explore Diligent Institute’s resources for deeper guidance and real-world case studies on AI oversight.

Diligent

Blog

Risk management for public boards: What you need to know

IN-DEPTH: Q&A with SEC Commissioner Hester Peirce

Your Data Matters