Original practical guidance. Review the scope and current requirements with your qualified advisers; these resources do not establish compliance.
How to use this template
Copy the agenda into your own meeting notes. Replace each prompt with evidence from your organization. Agree the meeting owner, participants, period under review and who can approve risk or budget decisions. This is an original working template, not a prescribed standard or an audit certificate.
1. Changes since the last review
Record new services, suppliers, systems, incidents and regulatory questions. For each change, state whether the risk assessment, control ownership or continuity plan needs an update. Bring unresolved applicability questions to qualified legal advisers rather than treating the meeting as a legal opinion.
2. Risk decisions
Use the following row for each decision:
| Field | Record |
|---|---|
| Risk and business consequence | What could happen and which service is affected? |
| Evidence and uncertainty | What is known, tested or still missing? |
| Options | Treat, avoid, transfer or accept, with rationale |
| Decision authority | Who is authorized to decide? |
| Action and review | Owner, due date and next review |
Avoid a dashboard that counts actions without explaining their effect on risk. Escalate overdue items when business exposure has increased.
3. Control performance
Discuss a small number of meaningful measures: access-review completion with exceptions, restoration-test results, critical vulnerability treatment and incident exercise findings. Note the denominator and reporting period so percentages have context. Record where evidence is too weak to support a conclusion.
4. Resources and priorities
Decide which work requires people, money or business support. Make trade-offs visible. Assign an accountable owner to each priority and confirm how completion will be evidenced. Where action is deferred, record the reason and who accepted the residual risk.
5. Close and follow up
Read back decisions, owners and dates before the meeting ends. Distribute a concise decision record to the authorized participants. At the next review, check outcomes before adding new actions. Store minutes according to your access and retention rules; avoid unnecessary personal or sensitive incident details.
