Service · half a day with your board
A board session that leaves evidence behind
Boards do not buy training. They buy the ability to show, afterwards, that they exercised oversight. This is a facilitated half-day with your board or executive team, built around a scenario chosen for your organisation, and an evidence pack recording who was there, what was rehearsed, what was decided and on what date. The pack is the product. The session is how we get it.
Who this is for
Boards and executive teams that have been asked — by an insurer's renewal form, a customer's questionnaire, an auditor, a regulator, or a director who reads the papers properly — to show that cyber and AI risk is overseen rather than delegated and forgotten. It suits a board that has never had the conversation as much as one that has it every quarter and wants it recorded properly for once.
It is also used by organisations appointing new directors, by charities and not-for-profits whose boards are personally exposed, and by federally regulated financial institutions evidencing the operational-resilience expectations in OSFI's guidance.
What happens in the room
Forty minutes on what the board is actually accountable for, in plain language and specific to your sector.
- The duties that already reach you: PIPEDA and its provincial equivalents, Quebec's Law 25, your sector regulator, and the directors' duty of care
- Why there is no Canadian AI Act, and why that makes oversight harder rather than easier
- What insurers and customers now expect to see, and where Canadian boards routinely fall short
- The three questions a director should be able to answer about cyber and AI, and how to get the answers
Two hours working a scenario chosen for you — never a generic deck.
- A realistic incident: ransomware, a supplier breach, an AI assistant surfacing what it should not, a payment-diversion fraud
- The decisions the board would face at each point, made in the room and recorded
- When the notification obligations start, to whom, and who decides — including where Quebec staff or customers put the CAI in the picture alongside the federal Commissioner
- Where the plan, the delegations and the communications actually broke
What you keep, and what you show.
- Attendance, date, scenario and the decisions taken, in a form an insurer or auditor accepts
- Suggested wording for the board minutes
- A prioritised list of what to fix, with an owner suggested for each item
- A dated letter confirming the session took place, for questionnaires and renewals
Why a facilitator, and why us
An internal IT lead cannot run this session, for two reasons. They are too close to the answers to let the board reach its own, and they cannot afterwards be the independent voice recording what the board did.
We have no stake in the outcome, no products to recommend and no follow-on to sell. If the session shows your organisation is in good shape, the pack says so and that is the end of it.
This one does not compromise our independence. Because we facilitate and record rather than advise on your controls, running this session does not stop us assessing you later. That is not true of everything we do, and we will tell you plainly if something would.
What it costs
One half-day session, up to twelve people, at your offices or online, and the evidence pack.
From CAD $4,500
Plus applicable taxes. Travel beyond the Greater Toronto Area is charged at cost and agreed beforehand. A second session for a different group on the same day is offered at a reduced fee — ask when you enquire.
Most boards run this once a year with a different scenario, which is increasingly what insurers and customers want to see.
Reduced fee
Each subsequent year, agreed in advance. If you would rather run a scenario yourselves first, the tabletop exercise packs start free — this session is the facilitated, recorded version of the same idea, for the board rather than the response team.
What actually happens, and when
First conversation
No charge. Twenty minutes with the chair, chief executive or corporate secretary on who will attend, what the board has been asked to evidence, and what it already worries about.
Within a week
A scoping letter with the fee, the date, the proposed scenario and a short pre-read for attendees — two pages, not a pack.
Your effort
One thirty-minute call with whoever runs IT or security, so the scenario matches your systems. Attendees read two pages beforehand. That is all.
The session
Three and a half hours including a break. We facilitate and record; you decide. Nothing is filmed and no scores are given to individuals.
Within five working days
The evidence pack, the suggested minute wording and the prioritised fix list go to the corporate secretary or chair.
Afterwards
The findings are yours. If you want the fixes assessed once done, that is a separate engagement and we say so up front.
There is no charge for the first conversation and no obligation at the end of it.