Service · Half a day with your board
A board session that leaves evidence behind
Boards do not buy training. They buy the ability to show, afterwards, that they exercised oversight. This is a facilitated half-day with your board or executive team, built around a scenario chosen for your organisation, and an evidence pack that records who was there, what was rehearsed, what was decided and on what date. The pack is the product. The session is how we get it.
From £2,400
plus VAT for a half-day session and the evidence packFixed fee
3.5 hours
in the room, with a break; at your offices or onlineFormat
5 to 12
people works best: the board, or the executive team, or the two togetherWho attends
Within 5 days
the evidence pack and suggested minute wording are with your company secretaryTurnaround
Who this is for
Boards and executive teams that have been asked — by an insurer's renewal form, a customer's questionnaire, an auditor, a regulator, or a non-executive who reads the papers — to show that cyber and AI risk is overseen rather than delegated and forgotten. It suits a board that has never had the conversation as much as one that has it every quarter and wants it recorded properly for once.
It is also used by organisations bringing in new directors, by charities whose trustees are personally exposed, and by regulated firms that need to evidence SM&CR or Consumer Duty accountability for operational resilience.
What happens in the room
Forty minutes on what the board is actually accountable for, in plain English and specific to your sector.
- The duties that already reach you: UK GDPR and the 72-hour clock, the Data (Use and Access) Act 2025, your sector regulator, the Companies Act duty of care
- What insurers and customers now expect to see, and where boards routinely fall short
- The three questions a non-executive should be able to answer about cyber and AI, and how to get the answers
Two hours working a scenario chosen for you — never a generic deck.
- A realistic incident: ransomware, a supplier breach, an AI assistant surfacing what it should not, a payment-diversion fraud
- The decisions the board would face at each point, made in the room and recorded
- Where the plan, the delegations and the communications actually broke
What you keep, and what you show.
- Attendance, date, scenario and the decisions taken, in a form an insurer or auditor accepts
- Suggested wording for the board minutes
- A prioritised list of what to fix, with an owner suggested for each item
- A dated letter confirming the session took place, for questionnaires and renewals
Why a facilitator, and why us
An internal IT lead cannot run this session, for two reasons. They are too close to the answers to let the board reach its own, and they cannot afterwards be the independent voice recording what the board did. We have no stake in the outcome, no products to recommend, and no follow-on to sell. If the session shows that your organisation is in good shape, the pack says so and that is the end of it.
Because we facilitate and record rather than advise on your controls, this session does not compromise our independence should you later want an independent assessment. We will tell you if anything we do here would.
What it costs
One half-day session, up to twelve people, at your offices in Great Britain or online, and the evidence pack.
From £2,400 + VATHalf a day
Travel beyond the North West of England is charged at cost and agreed beforehand. A second session for a different group on the same day is offered at a reduced fee — ask when you enquire.
Most boards run this once a year with a different scenario, which is what insurers and regulators increasingly want to see.
Reduced feeEach subsequent year, agreed in advance
If you would rather run a scenario yourselves first, the tabletop exercise packs start free. This session is the facilitated, recorded version of the same idea, for the board rather than the response team.
What actually happens, and when
First conversation
No charge. Twenty minutes with the chair, chief executive or company secretary on who will attend, what the board has been asked to evidence, and what it already worries about.
Within a week
A scoping letter with the fee, the date, the proposed scenario and a short pre-read for attendees — two pages, not a pack.
Your effort
One thirty-minute call with whoever runs IT or security so the scenario matches your systems. Attendees read two pages beforehand. That is all.
The session
Three and a half hours including a break. We facilitate and record; you decide. Nothing is filmed and no scores are given to individuals.
Within five working days
The evidence pack, the suggested minute wording and the prioritised fix list go to the company secretary or chair.
Afterwards
The findings are yours. If you want the fixes assessed once done, that is a separate engagement and we say so up front.
Questions we are usually asked
Our board is not technical. Will this go over their heads?
It is designed for boards that are not technical. There is no jargon in the room and none in the pack. The decisions a board makes in an incident are about money, people, customers and disclosure, and every director already knows how to make those.
Can we do it online?
Yes. The scenario works online, and the evidence pack is the same. In person is better for boards that rarely meet face to face, because the conversations in the break are often where the real findings come from.
Is this the same as the tabletop exercise?
They are cousins. The tabletop exercise tests the people who would actually run the incident — IT, operations, communications, legal. This session tests the board's oversight of them. Many organisations do both, six months apart.
Will our insurer accept the evidence pack?
The pack is written to answer the questions UK cyber insurers ask at renewal: has the board had incident-response training, when, and what was covered. We include a dated letter you can attach to the application. Whether it moves your premium is the insurer's decision, not ours.
Can our IT provider sit in?
Yes, and it is often useful. They should attend as a participant, not a presenter, so the board hears what it would hear on the day.
There is no charge for the first conversation and no obligation at the end of it.