What is the BEST way for a board of directors to improve its ability to identify material changes to the enterprise IT risk profile?

A comprehensive list of risks is static and a snapshot; it doesn't dynamically show *changes* in the risk profile over time.

A SIEM tool is an operational security technology; while crucial for incident management, its implementation is a management responsibility, not the board's primary way to *identify* changes at a strategic level.

Key Risk Indicators (KRIs) are metrics that provide an early signal of increasing or decreasing risk exposure, helping management and the board to proactively monitor potential threats and vulnerabilities. Regular review of KRIs allows the board to understand trends and identify material changes in the enterprise's IT risk profile before they escalate into significant incidents, enabling timely strategic adjustments.

Key Performance Indicators (KPIs) measure organizational performance and progress towards objectives; while related, they do not directly focus on identifying changes in the *risk profile* as explicitly as KRIs do.