01
Risk Appetite Alignment
Current risk exposure assessed against Board-approved technology risk appetite statements as at March 30, 2026.
Cybersecurity
Status: Within Appetite
Third-Party Risk
Status: Outside Appetite
18% of Tier 1 vendors have not completed annual reassessment. Remediation plan approved; target closure Q3 2026.
Cloud Risk
Status: Outside Appetite
Three open audit findings related to cloud security posture management (CSPM) configuration drift. Owner: VP Cloud Engineering.
AI / Emerging Technology Risk
Status: Outside Appetite
Use case intake volume outpacing review capacity. Temporary Tier 1 intake freeze recommended as a mitigant pending AI risk framework sign-off.
Operational Resilience
Status: Within Appetite
Data Governance & Privacy
Status: Within Appetite
02
Key Risk Indicators (KRIs)
| Metric | Current Value | Threshold | Trend | Status |
|---|---|---|---|---|
| Critical vulnerabilities unresolved beyond SLA | 6.2% | < 5.0% | ▲ Increasing | Amber |
| Tier 1 vendors without completed annual reassessment | 18% | < 10% | ● Stable | Red |
| Privileged access violations (PAM policy breaches) | 14 | < 5 per quarter | ▲ Increasing | Red |
| Failed control tests (automated & manual)ⓘ IT operations domain results pending final review — 3 test cases under re-assessment | 9.4% | < 7.0% | ▼ Improving | Amber |
| Mean time to contain — P1 security incidents (hours) | 3.8 hrs | < 4.0 hrs | ▼ Improving | Green |
| Patch compliance rate — enterprise endpoints | 94.1% | > 95.0% | ● Stable | Amber |
| Disaster recovery tests passing within RTO/RPO targets | 100% | 100% | ● Stable | Green |
| MFA adoption — privileged usersⓘ Privileged user population count under reconciliation — HR directory sync in progress | 97.3% | > 99.0% | ▲ Improving | Amber |
| GenAI use cases with human-in-the-loop controls verified | 88% | > 95% | ▲ Improving | Amber |
ⓘ Indicators marked with a caveat note are based on preliminary data. Final figures subject to confirmation by control owners. Dashboard refreshed as at March 30, 2026.
What this demonstrates: leading-indicator design, risk appetite thresholds, trend monitoring, and transparent data-quality caveats.
03
Control Effectiveness
Based on Q1 2026 control testing cycle (124 controls tested across 3 domains).
Identity & Access Management (IAM)
41 controls tested
Effective: 66%Partial: 24%Ineffective: 10%
Change Management
52 controls tested
Effective: 79%Partial: 17%Ineffective: 4%
Backup & Recovery
31 controls tested
Effective: 87%Partial: 10%Ineffective: 3%
Effective
Partially Effective
Ineffective
04
Issues & Audit Management
31
Open Issues
8
Overdue Issues
5
High Severity
| Issue Title | Severity | Owner | Days Overdue |
|---|---|---|---|
| Privileged account review not completed — Production | HIGH | CISO Office | +42 days |
| CSPM misconfiguration — Azure Policy exceptions undocumented | HIGH | VP Cloud Eng. | +28 days |
| Vendor contract renewal — SLA terms not updated post-SOC 2 | MEDIUM | 3rd Party Risk | +17 days |
| DR test remediation items — 2 failover scripts not updated | MEDIUM | Infra & Ops | +11 days |
| Legacy encryption protocol (TLS 1.1) still active — 3 endpoints | HIGH | Network Sec. | On Target |
What this demonstrates: remediation governance, ownership accountability, aging analysis, and overdue escalation.
05
Third-Party Risk
214
Total Vendors
47
Tier 1 (Critical)
82%
% Assessed
23%
% of Tier 1 High Risk
Vendor risks requiring management attention:
Apex Data Services Inc. High Risk
Annual SOC 2 Type II assessment overdue by 60+ days. Provides managed database services for Group Benefits core platform. Escalation in progress with executive sponsor.
GlobalNet Communications Elevated
Subcontractor usage increased beyond original contract scope without Technology Risk approval. Concentration risk flagged — two additional carriers now handling network failover traffic.
What this demonstrates: vendor concentration oversight, tiering logic, risk acceptance, and board-level escalation discipline.
06
Emerging Risk — AI & Technology
38
AI Use Cases Registered
26
Reviewed by Risk
71%
Approved / Conditional
4
Pending Decision
Primary concern areas: Model Risk Data Exposure Prompt Injection Agent Tool Permissions Third-Party Model Dependency
Risk function assessment: The volume of AI use case submissions has increased 40% quarter-over-quarter, outpacing the current review capacity of the AI governance team. Seven submitted use cases involve third-party large language models with access to sensitive data classes, raising concerns under PIPEDA and data classification expectations; three have been conditionally approved pending data residency confirmation from the vendor. Two use cases involving automated underwriting decision support have been escalated to the Model Risk Committee for independent review, as outputs may be relied upon in a manner that requires model validation under OSFI Guideline E-23. Runtime monitoring of approved generative AI use cases identified four policy violations this quarter — primarily attempted prompt-injection and data-handling deviations — all contained without data exposure; agent tool permissions are being narrowed in response. The Technology Risk function has recommended a temporary intake freeze on Tier 1 AI use cases until a formal AI risk framework, currently in draft with control mapping to NIST AI RMF and ISO/IEC 42001, receives sign-off from the Chief Risk Officer and is socialized with the Audit Committee. An AI-specific incident response annex covering model rollback, output containment, and vendor notification is in draft alongside the framework.
What this demonstrates: AI intake governance, model oversight, regulatory alignment, runtime monitoring, and emerging-risk assessment.
↳ Management Focus — derived from current risk position above
07
Management Focus — Priority Actions for Q2 2026
Actions identified by the Technology Risk function as requiring senior management prioritization in the coming quarter. Owners and target dates to be confirmed at the next Technology Risk Committee.
1
Remediate privileged access management exceptions — 14 violations vs. <5 threshold
PAM policy breaches have increased for two consecutive quarters and are materially outside appetite. A root-cause review is required before the next internal audit cycle commences. Continued non-compliance may attract regulatory attention under applicable ICFR obligations.
Suggested owner: CISO Office | Target: Q2 2026 ⏱ Immediate
Urgent
2
Close open CSPM audit findings — 3 items overdue, Azure Policy exceptions undocumented
Cloud security posture management findings have remained open beyond agreed remediation dates. Undocumented policy exceptions represent a control gap relevant to ICFR reporting. External audit window opens Q3 2026 — closure required before that date.
Suggested owner: VP Cloud Engineering | Target: Q2 2026 📅 Pre-audit closure required
Urgent
3
Complete Tier 1 vendor reassessments — 18% of critical vendors past due
Annual due diligence for critical third-party suppliers is running significantly behind schedule. Failure to complete assessments by end of Q2 maintains a breach of appetite and increases regulatory exposure if a vendor incident occurs without a current assessment on file.
Suggested owner: Third-Party Risk Function | Target: Q2 2026
Elevated
4
Achieve MFA adoption target for privileged users — currently 97.3% vs. 99.0% threshold
Remaining privileged users without MFA enrolment represent a residual access risk. Identity reconciliation between HR directory and PAM tooling is in progress. Full population to be enrolled and verified ahead of Q2 access certification review.
Suggested owner: Identity & Access Management Team | Target: April 2026
Elevated