Write the decision before assembling the slides
Start with the question that needs a director's judgement. Is an unsupported business application remaining in service? Is the recovery investment enough to meet the agreed outage tolerance? If no decision is required, state that the item is for assurance and explain the evidence behind it.
Give each decision an owner, options, recommended action and consequence of delay. Avoid asking directors to approve a security tool without explaining the process it supports and the capacity needed to run it. The licence is rarely the entire commitment.
Use business scenarios that can be challenged
Describe a plausible route from a weakness to a business consequence. A compromised supplier account could change payment details; a compromised privileged identity could interrupt several services. Distinguish assumptions from observed control failures rather than presenting every possibility as equally likely.
Explain the current safeguards and where evidence is missing. A recovery plan is not proof that restoration meets the business objective. Directors should be able to ask when it was exercised, what failed and whether the follow-up actions are complete.
Show the uncomfortable parts of the trend
Include overdue actions, repeated exceptions and risks that have not reduced despite spending. A report showing only completed work prevents the board from seeing blocked decisions. A delay caused by a supplier or maintenance restriction still belongs in the report.
State when the scope or counting method changed. If a new scanning agent discovers more assets, the apparent deterioration may be improved visibility. Keep the old and new baselines separate long enough to explain the difference.
Keep an evidence trail outside the pack
The pack should link each summary to a maintained risk record, test result or remediation action. Horizon can organise those records, owners and review dates so the board summary is not rebuilt from unrelated spreadsheets each month.
Record the decision and follow-up in the same process. A risk marked accepted without the approval, reasoning and next review date leaves the next meeting asking the same question again. Keep sensitive technical detail out of widely circulated packs.