What the committee actually needs
Boards do not need spectrum analyser output. They need to know that a named executive owns the risk, that the control operated as designed in the period, and that anything found or changed has been acted on. That is three lines in the risk report: coverage (which tiered spaces were inspected, on time or not), findings (by class — devices, anomalies, vulnerabilities — without operational detail), and changes (threat picture, scope, cadence).
Under regimes that make boards accountable for control effectiveness — the UK Corporate Governance Code's Provision 29 declaration, NIS2's Article 20 management responsibility, the SEC's Item 106 governance disclosure — this standing line is precisely the evidence trail the accountability rests on.
Metrics that inform without theatre
Useful: percentage of tier-one spaces inspected within cadence; trigger events fired versus triggers met; time from trigger to sweep; findings by class and their disposition; days since the last inspection of the room the committee is currently sitting in — a metric with a certain motivational quality. Not useful: counts of frequencies scanned, equipment lists, and vendor marketing statistics, all of which invite either false comfort or unwarranted alarm.
Report the residual honestly. The control is point-in-time detection with an accepted window between inspections; the committee's job is to confirm that window still matches the threat, not to be told the risk is closed.
Handling a find at board level
A find is a crisis communication event inside the organisation before it is anything else. The reporting pattern should pre-agree: immediate out-of-band notification to the chair of the audit or risk committee, legal privilege engaged from the first hour, and a single accountable narrative covering exposure window, information at risk, notification analysis, and remediation. Committees that have seen the three-line report every quarter handle this moment fluently; committees hearing about the programme for the first time do not.