Minutes | Meeting of the Risk Committee of the Board (BRC) | 19 December 2023

BRC Attendees: Harald Alvestrand, Maarten Botterman, Becky Burr, Chris Chapman, James Galvin (Chair), Wes Hardaker, and Patricio Poblete

ICANN organization Attendees: Franco Carrasco (Board Operations Manager), Xavier Calvez (SVP, Planning & Chief Financial Officer), John Crain (SVP & Chief Technology Officer), John Jeffrey (General Counsel and Secretary), Elizabeth Le (Associate General Counsel), and Amy Stathos (Deputy General Counsel)

The following is a summary of discussions, actions taken and actions identified:

1. Selection of BRC Chair Alternate – The Committee Chair identified, and the Committee agreed, Harald Alvestrand to serve as the BRC Chair alternate in the event that the Chair is unavailable for a meeting, or recuses himself from presiding over a matter, or is otherwise unavailable to fulfill the role as Chair.
2. Risk Register Update – The Committee discussed the most recent updates to the Risk Register and reviewed the controls and mitigation measures in place for the updated risks. The updates are a result of a periodic validation of the Risk Register and the Risk Controls Assessment process. The Risk Register was reviewed by the org's CEO Risk Management Committee and approved by the Interim President and CEO. The Committee discussed enhancements to the risk descriptions and applying additional structure to the Risk Register. The Committee also discussed further visibility into the org's approach to prioritizing risks, as well as the allocation of investments and resources dedicated to risk management. The Committee requested that the org provide information regarding the time frame associated with the risks identified on the Register. The Committee agreed to continue its discussion following receipt of the requested information from org.
   • Actions:
     • ICANN org to provide Committee with information regarding the time frame associated with the risks identified on the Register.
     • The BRC to continue its discussion following receipt of information from org.
3. Risk Appetite Statement (RAS) Update – The Committee considered proposed updates to the Risk Appetite Statement based on the Committee's previous discussion. Following discussion, the Committee agreed to maintain the current RAS and to revisit the proposed updates once it receives additional information from ICANN org on the categories of the RAS. 
   • Actions:
     • ICANN org to provide the Committee with additional information on the categories of the RAS.
     • The BRC to continue the discussion at its next meeting.