Somewhere in your next board pack there is a five-by-five grid. Likelihood along one axis, impact along the other, a scatter of numbered dots drifting from red towards green. It will take ninety seconds of the meeting. Someone will ask about dot 7. Someone else will note that dot 12 has moved. And then the board will turn the page, having learned almost nothing, feeling almost reassured.
That is the heat map's genius, and its indictment. It was never built to inform. It was built to be finished with.
What the grid actually compresses away
Consider what has to be true for a dot to land on the chart. Someone judged the likelihood of, say, "a material cyber event" — a guess about an adversary's intentions, dressed as a number. Someone judged the impact — another guess, averaging away the difference between a bad week and an extinction event. The two guesses were multiplied, a piece of arithmetic with no defensible meaning, and the product was mapped to a colour chosen mainly for how it would land in the meeting. Amber, usually. Amber is the colour of not having the argument.
Every decision-relevant fact died in that compression. Which service would actually stop. Whether the exposure is growing or shrinking. What we're doing about it, what that costs, and whether it's working. How confident anyone is in any of this. A heat map is what remains of a risk conversation after everything a board could act on has been boiled off.
And it fails in both directions at once. It's too abstract to support a decision, and just concrete-looking enough to create the feeling that oversight has occurred. The NEDs can't interrogate it — there's nothing load-bearing to press on. Dot 9 moved from red to amber because a workshop re-scored it. Nothing in the world changed. The chart improved anyway.
The heat map's real function is to end the conversation — and the conversation is the only thing the board was there to provide.
Regulators have noticed. The supervisory question is no longer "does the board see cyber risk information?" It's "can the board evidence that it challenged anything?" A page of unchallengeable colours is not just unhelpful now. It's a liability with a page number.
Give them something to judge
The board's job is not to absorb assurance. It's judgement: weighing what the executive proposes, pressing where the answers wobble, choosing between costly options under uncertainty. So give them material that judgement can grip. In practice that's a handful of plain-English questions, answered honestly, a page or two at most.
What would hurt us most? Not a risk category — a scenario, in words. "Our claims platform is down for four days and we can't pay customers." Name the two or three that would genuinely wound the firm, and say plainly how exposed we are to each, in the terms the board already thinks in: days of outage, customers affected, money.
Are we getting better or worse? A trend, not a temperature. Time to detect, time to recover, what the last real incident and the last exercise actually showed. Better or worse than a year ago — and if the honest answer is "worse, because the estate grew faster than the controls", say that. Boards forgive bad news. They shouldn't forgive discovering it late.
What did we decide last quarter, and did it work? This is the question almost no board pack answers, and it's the one that turns reporting into governance. We approved £800k for privileged access; here's what changed and what didn't. We accepted the risk on the legacy platform; here's what that acceptance has cost us since. Decisions that are never revisited aren't decisions — they're gestures.
Notice what these three have in common: each one can be wrong. A named scenario can be challenged as the wrong scenario. A trend can be disputed. A decision review can reveal that the money bought nothing. That's the point. Judgement needs a surface with grip, and grip means falsifiable claims in plain English — not a grid that is compatible with every possible state of the world.
Your NEDs will thank you, and not out of politeness. The good ones know the ninety-second heat-map ritual is theatre; they've sat through it at every firm on their portfolio, and they know exactly what it's for. Handing them three answerable questions is handing them their actual job back.
The heat map asks the board to admire your risks. The alternative asks them to govern.
If the board can't be wrong about what you've shown them, you haven't shown them anything.