Session 7 · ERQI Global Virtual Risk Summit
From drift to deliberate: reclaiming the board's duty of care
Astrid Yee-Sobraquès & Andrew Shea
Overview
Astrid Yee-Sobraquès argues that every strategic decision embeds a risk assumption, and the board either makes that assumption consciously or lets it happen without realizing it. In conversation with Andrew Shea, she showed how acquisitions and vendor consolidations become risk appetite decisions by default, and why the governance failure is not a wrong decision but an uninformed one. She laid out four steps for bringing risk to the board at the moment of decision, and argued that the board's duty of care is to make conscious choices about risk, not to eliminate it.
Session 7 recording, ERQI Global Virtual Risk Summit 2026
Where appetite gets set
Yee-Sobraquès, who spent 26 years in financial services and enterprise and cyber risk management, opened with something she often hears from directors: the board focuses on strategy, and risk management is delegated to a committee. Her answer is that the two are not separate. Her example was UnitedHealth's roughly $13 billion acquisition of Change Healthcare, examined for antitrust, finance, competition and regulation, but not for security posture. In her account, an external-facing server lacked the multi-factor authentication that company policy required, the head of cybersecurity knew, and nothing was done. The February 2024 ransomware attack crippled payment systems across the country. Shea added that M&A practitioners had told him security diligence gets little effort because it slows the deal down, so a board that thought it was buying a revenue asset also inherited an infrastructure liability.
She described a consolidation from 15 payment vendors down to three. Risk sees the tail exposure, legal sees a contract that limits liability, and compliance sees SLAs met and audits passed. Finance and operations move forward to hit margin targets, and the board approves the cost savings without ever explicitly approving the concentration. That, she said, is not governance. It is outsourcing the board's job to whichever function has the loudest voice.
Asked whether executives discount risks that rarely happen, she said the skepticism is real, and that low probability is precisely where risk gets expensive. CrowdStrike in July 2024 was a known concentration that most organizations never planned to recover from. Her sharpest example was a mortgage servicer hit repeatedly with severe regulatory violations; the bank had no backup vendor and the cost of exit was prohibitive. No one had asked, when the vendor was chosen, whether the bank could exit in 180 days, and at what cost.
A four-step method
The fix is not more people or committees; the integration happens at the time the decision is made. First, identify decisions early, with risk management stating how much concentration a proposal creates against a threshold set in advance. Second, force alignment between risk, legal and compliance before the board approves the deal, aiming for clarity of facts. Third, the board approves a documented exit or backup strategy at the same time as the transaction, and only then weighs whether the savings are worth the risk. Fourth, monitor and update: is the exit plan still valid 12 or 24 months later, and has it been tested?
Accountability and culture
Yee-Sobraquès described tiered accountability: practitioners inside the company as the first line, then customers who can walk away, regulators with enforcement powers, and finally lawsuits. She pointed to the Silicon Valley Bank litigation, where management as well as directors are being sued, as a reminder that fiduciary duty means something. Improving ethical decisions, she said, comes down to hiring and promoting the right people, since every decision at every layer builds or erodes culture.
On third parties, she cited the Citizens and Frost lawsuits, in which the companies, not their vendor, were sued after the vendor's breach. Responsibility for customer data does not stop at the perimeter. Shea observed that the perimeter of ownership and accountability does not transfer; her answer was that the message is not lost but willfully set aside to manage legal exposure. She welcomed the idea, debated inside ERQI, of measuring culture as part of risk assessments and audits.
From implied appetite to real governance
Yee-Sobraquès closed with three points. Boards should ask explicitly about the risks they are taking on before a major decision. Risk, legal and compliance, along with the CISO, CIO, third-party risk and vendor management where relevant, belong in the actual decision, and the disagreements surfaced there are governance, not dysfunction. When the board accepts a risk such as concentration because the efficiency is worth it, it should document the risk, the backup plan, the exit strategy and the conscious choice. The board's job is not to eliminate risk, which is impossible, but to make conscious, visible, documented decisions about it.
“That's the difference between we didn't know and we knew and we decided.”
Astrid Yee-Sobraquès, on documenting the conscious choice
Key takeaways
1
Treat strategy and risk as one conversation
A vendor consolidation, acquisition or technology investment is also a risk appetite decision, and the board should know it is making one before it approves.
Watch at 2:422
Recognize where appetite is really set
The annual statement is abstract. The operative choices happen daily in procurement, finance and operations, often by default.
Watch at 7:093
Integrate the answers at the time of decision
Bring risk, legal and compliance into the decision itself, aim for clarity on concrete business impact, and treat the disagreements as governance.
Watch at 22:434
Approve the exit with the concentration
Document how long a backup or exit takes and what it costs, then revisit and test it as vendors and strategies change.
Watch at 24:015
Know what failure looks like
Governance failure is not a wrong decision but one that was not fully informed. Mistakes are acceptable when the decision was the best one possible with the information available.
Watch at 19:43
