--- title: Too Much or Too Little? How Much Information Should a Bank Board Receive and Review? description: A board’s primary responsibility is to manage risk of all types in the bank, including information security risk. Carrying out good risk management also helps the director to avoid personal liability. image: https://insights.bankonitusa.com/hubfs/Blog/boi-pattern-08.jpg --- Sales: [405-653-1920](tel:4056531920) 24/7/365 Support: [1-800-498-8877](tel:18004988877) [Client Portal](https://portal.bankonitusa.com/) [![BankOnITUSA](https://insights.bankonitusa.com/hubfs/BOI-Logo-SVG.svg "BankOnITUSA")](https://www.bankonitusa.com/) - [About](https://www.bankonitusa.com/about/) - [Technology Tour](https://www.bankonitusa.com/about/technology-tour/) - [Solutions](https://www.bankonitusa.com/solutions/) - [Gain Competitive Advantage](https://www.bankonitusa.com/solutions/gain-competitive-advantage/) - [Acheive Operational Efficiency](https://www.bankonitusa.com/solutions/achieve-operational-efficiency/) - [Reduce Risk](https://www.bankonitusa.com/solutions/reduce-risk/) - [Client Stories](https://www.bankonitusa.com/client-stories/) - [Saint Louis Bank](https://www.bankonitusa.com/client-stories/saint-louis-bank/) - [Commercial National Bank of Texarkana](https://www.bankonitusa.com/client-stories/commercial-national-bank-of-texarkana/) - [Watermark Bank](https://www.bankonitusa.com/client-stories/watermark-bank/) - [Integrity Bank & Trust](https://www.bankonitusa.com/client-stories/integrity-bank-and-trust/) - [Valliance Bank](https://www.bankonitusa.com/client-stories/valliance-bank/) - [First National Bank of Oklahoma](https://www.bankonitusa.com/client-stories/first-national-bank-of-oklahoma/) - [Lisle Savings Bank](https://www.bankonitusa.com/client-stories/lisle-savings-bank/) - [Bank of Prairie Villiage](https://www.bankonitusa.com/client-stories/bank-of-prairie-village/) - [Insights](https://insights.bankonitusa.com/) - [Billion $ Playbook](https://www.bankonitusa.com/billion-playbook/) - [Careers](https://www.bankonitusa.com/careers/) [Let's Get Started](https://www.bankonitusa.com/lets-get-started/) Nov 10, 2025 # [Information Security Brief - November 2025](https://insights.bankonitusa.com/information-security-brief-november-2025) This Email is Making Me FEEL Something Scammers manipulate your emotions! IS AN EMAIL, TEXT, OR DM MAKING YOU FEEL SUDDEN, URGENT EMOTIONS? “You won o... [Read More](https://insights.bankonitusa.com/information-security-brief-november-2025) - - - - [mailto:url=https%3A%2F%2Finsights.bankonitusa.com%2Ftoo-much-or-too-little-how-much-information-should-a-bank-board-receive-and-review](mailto:url=https%3A%2F%2Finsights.bankonitusa.com%2Ftoo-much-or-too-little-how-much-information-should-a-bank-board-receive-and-review) [← Return to Blog](https://insights.bankonitusa.com) 3 Jan, 2019 ## Too Much or Too Little? How Much Information Should a Bank Board Receive and Review? A board’s primary responsibility is to manage risk of all types in the bank, including information security risk. Carrying out good risk management also helps the director to avoid personal liability. To perform top-level oversight and monitoring of information security as regulators require, the board needs accurate and high-quality information. There are several ways to think about what kinds of IT information the board should receive, and how much: Directors Should Receive the Information That Regulators Expect the Board to Review. The FFIEC outlines what types of systems reports and due diligence information a bank should obtain from “critical activities” IT-related vendors.[1](https://insights.bankonitusa.com/too-much-or-too-little-how-much-information-should-a-bank-board-receive-and-review#source)Someone at the bank—usually the IT Officer—must carefully review the details of this vendor material and report on it to the IT Committee and the board. The board doesn’t need to look at a full-length version of the vendor’s information. It’s enough if someone at the bank is capable of preparing and providing to the board an accurate summary and analysis of this documentation, including at least the important points, as well as pointing out any serious concerns raised by what is contained in or missing from the vendor’s documents. Directors Should Be Given Information That May Significantly Assist Them in Carrying Out Their Responsibilities. If some directors are not very familiar with topics that the board will take action on, such as IT, management should consider providing supplemental information to get those directors up to speed. But providing more and more information is not the ultimate goal. The quality, accuracy, and relevance of information to be provided are all more important than increasing the quantity. Depending on the specific issue, a well-prepared summary of key information is often more appropriate than giving the board a lot of very lengthy materials. Directors Should Have Enough Information to Feel Comfortable Discussing Key Issues in a Board Meeting. A director who lacks confidence that he or she understands a subject well enough is unlikely to participate in board discussions about that matter. Having enough information encourages directors to express their opinions more freely, to ask good questions about what the board is considering, and to vote with confidence. Directors Need to Receive Enough Information to Provide a “Credible Challenge” to Management. Regulators want the board to have enough details to be able to probe and discuss any important issue presented by management, not simply voting as management suggests because the directors may not understand the subject well enough. Providing a “credible challenge” doesn’t mean that directors should disagree with whatever management recommends. Rather, the board should exercise its own judgment. When appropriate the board should ask management to explain or defend any suggested approaches or actions. If management’s recommendations are good, they will still be good after discussion. Directors Need Enough Information to Meet Their Fiduciary Duty. If board members do not fulfill their duty to monitor and manage all critical risks in the bank, not only the bank’s customers and shareholders could be harmed, but even the FDIC insurance fund — and directors could be financially liable. If there is any high-risk area that a director is not very familiar with — including information security — it’s important to deliberately spend more time studying and managing it, in order to satisfy the director’s fiduciary duty. From an examiner’s standpoint, a further step is also needed—proper documentation of the board’s review process. A bank should be careful to record in the board minutes the specific information that has been presented to the directors and reviewed, including if appropriate any response by the board to that information. For example, “a summary of ‘due diligence’ information provided by Vendor XYZ was reviewed by the board and determined to be satisfactory.” ---- SOURCE [1FFIEC – IT Examination Handbook Infobase](https://ithandbook.ffiec.gov/) See separate IT handbooks on Information Security; Outsourcing Technology Services; Supervision of Technology Service Providers; and Management. [← Return to Blog](https://insights.bankonitusa.com) ##### Disclaimer This publication attempts to provide timely and accurate information concerning the subjects discussed. It is furnished with the understanding that it does not provide legal or other professional services. If legal or other expert assistance is required, the services of a qualified professional should be obtained. ### Search ### Subscribe Here! You'll receive our latest updates in your inbox. ### Posts by Tag - [Cybersecurity (52)](https://insights.bankonitusa.com/tag/cybersecurity) - [Reduce Risk (49)](https://insights.bankonitusa.com/tag/reduce-risk) - [Information Security Brief (36)](https://insights.bankonitusa.com/tag/information-security-brief) - [Information Technology for Banking Leaders (15)](https://insights.bankonitusa.com/tag/information-technology-for-banking-leaders) - [Achieve Operational Efficiency (13)](https://insights.bankonitusa.com/tag/achieve-operational-efficiency) - [Strategy (11)](https://insights.bankonitusa.com/tag/strategy) - [CEO Update (9)](https://insights.bankonitusa.com/tag/ceo-update) - [Gain Competitive Advantage (9)](https://insights.bankonitusa.com/tag/gain-competitive-advantage) - [Regulation (5)](https://insights.bankonitusa.com/tag/regulation) - [Information Security Bulletin (2)](https://insights.bankonitusa.com/tag/information-security-bulletin) - [Regulatory Bulletin (2)](https://insights.bankonitusa.com/tag/regulatory-bulletin) - [Press Release (1)](https://insights.bankonitusa.com/tag/press-release) See all ### Popular Posts #### [CEO Update - Q3 2025](https://insights.bankonitusa.com/ceo-update-q3-2025) #### [CEO Update - Q4 2025](https://insights.bankonitusa.com/ceo-update-q4-2025) #### [Information Security Brief - December 2024](https://insights.bankonitusa.com/information-security-brief-december-24) #### [Information Security Brief - July 2025](https://insights.bankonitusa.com/information-security-brief-july-2025) ## Submit your comment Upon completion you will be automatically redirected to the electronic Authorized Resellers Agreement. ## Related Posts Ready to do MORE with BankOnIT? [Let's Get Started](https://www.bankonitusa.com/lets-get-started/) **Receive BankOnIT Insights.** Get timely information on cybersecurity, regulation, and other trends impacting your bank. #### About - [Overview](https://www.bankonitusa.com/about/) - [Technology Tour](https://www.bankonitusa.com/about/technology-tour/) #### Solutions - [Overview](https://www.bankonitusa.com/solutions/) - [Gain Competitive Advantage](https://www.bankonitusa.com/solutions/gain-competitive-advantage/) - [Achieve Operational Efficiency](https://www.bankonitusa.com/solutions/achieve-operational-efficiency/) - [Reduce Risk](https://www.bankonitusa.com/solutions/reduce-risk/) #### Contact - [Support: 1-800-498-8877](tel:18004988877) - [Sales: 405-653-1920](tel:4056531920) #### Social - [Follow Us On LinkedIn](https://www.linkedin.com/company/bankonitusa/) ![BOI-Logo-PNG](https://insights.bankonitusa.com/hubfs/BOI-Logo-PNG.png "BOI-Logo-PNG") © 2023 BankOnITUSA, LLC.[Privacy](https://www.bankonitusa.com/privacy-policy/)