Minutes | Board Risk Committee (BRC) Meeting | 20 February 2020

BRC Attendees: Harald Alvestrand, Lito Ibarra (Chair), Kaveh Ranjbar, Nigel Roberts, and Matthew Shears

BRC Apologies: Merike Käo and Akinori Maemura

Other Board Member Attendees: León Sánchez

ICANN Org Attendees: Franco Carrasco (Board Operations Specialist), James Caulfield (VP, Risk Management), Jennifer Scott (Senior Counsel), and Amy Stathos (Deputy General Counsel)


The following is a summary of discussions, actions taken and actions identified:

  1. Review of Threat Landscape Monitoring Update – The BRC received an update from ICANN org on threat landscape monitoring. The existing threat monitoring process is being enhanced to include existential threats. ICANN org executives and each function's risk liaisons have been briefed on the updated approach and have been asked to identify any potential existential risks and evaluate any existing risks to determine if they might be categorized as potentially existential. The results will be reported to the BRC at its April meeting.

    • Action: ICANN org to report at the BRC's April meeting any proposed updates to the Risk Register identifying existential threats.
  2. Review of Risk Appetite Statement Proposed Draft – The BRC received a presentation from ICANN org on the proposed draft of the ICANN Risk Appetite Statement. The Risk Appetite Statement is informed by the Risk Register and identifies the types of risks that ICANN is managing, their risk profiles and ICANN's appetite for each. ICANN org requested the BRC's feedback on the statement with the intention of finalizing the proposed draft at the BRC's April meeting. Upon finalizing the draft, the statement will be shared with the Board for review and adoption, with the intended eventual publication on ICANN org's website. As part of the presentation, the BRC discussed the statement, including suggestions to add language about how the Risk Appetite Statement can be leveraged when facing risks in the future and to align the Risk Register, Risk Appetite Statement and the risks addressed in ICANN's Strategic Plan.

    • Actions:

      • BRC members to review draft Risk Appetite Statement and provide any suggested revisions via email.
      • ICANN org to follow up with individual BRC members, including those who were unable to attend today's meeting, to answer any specific questions or provide more information about the draft Risk Appetite Statement.
      • ICANN org to send current version of Risk Register to BRC members to support their review of the proposed draft Risk Appetite Statement.
      • ICANN org to update the draft Risk Appetite Statement with BRC suggestions for further discussion and finalization at the BRC's April meeting.

Published on 18 March 2020