A newly hired IT director of a large international enterprise has been asked to provide periodic updates regarding IT risk to the board. Which of the following is the MOST effective way to initially…

Providing a complete IT risk register monthly would be too detailed and frequent for board members, who typically require summarized, strategic information, not operational level data.

Presenting key IT risks in a quarterly dashboard is most effective because it provides the board with a high-level, focused summary of the most critical risks relevant to their strategic oversight, without overwhelming them with excessive detail. Quarterly updates offer appropriate periodicity for strategic governance, allowing for meaningful trends and mitigation efforts to be observed.

Submitting only IT audit findings is too narrow, as it covers past issues and not the broader ongoing IT risk landscape that the board needs to understand for proactive governance.

Scheduling quarterly meetings to discuss all open IT risks could be overly time-consuming and inefficient; a summarized dashboard allows for focused discussion on the most critical items, with the option to deep dive if needed.