When reviewing SAMA cybersecurity committee structure, most regulated institutions in the Kingdom default to a combined approach: one board-level risk committee that oversees enterprise risk, compliance, and cybersecurity together. The logic is defensible—cyber risk is enterprise risk, and consolidation avoids meeting fatigue. Yet two Riyadh-based banks reached the opposite conclusion within the same eighteen-month period, separating cybersecurity oversight into a distinct committee with its own charter, membership, and escalation path.
Neither institution made the change lightly. Both had operated combined structures for years, satisfied their SAMA supervisory reviews, and met the Saudi Central Bank's Cyber Security Framework requirements through existing governance. The separation came not from regulatory pressure but from three operational patterns that made the combined model unworkable.
This article describes those patterns, the structural changes that followed, and the decision framework that helps board members and chief risk officers determine whether separation makes sense for their institution.
The Combined Model and Its Appeal
The standard approach places cybersecurity under the board risk committee's remit. The committee—typically composed of three to five non-executive directors with finance, audit, or risk backgrounds—meets quarterly to review enterprise risk registers, credit concentrations, market exposures, operational incidents, and cyber threats. The CISO attends when cyber topics appear on the agenda, presents a dashboard, answers questions, and leaves before the committee moves to other matters.
This model offers real advantages. It avoids proliferating board committees, which consume director time and dilute focus. It reinforces the principle that cyber risk is not a technical silo but an enterprise concern. It ensures the same directors who oversee credit and liquidity also see cyber exposure, enabling cross-risk judgments. For many institutions, particularly smaller banks and finance companies, the combined structure works well.
Three Triggers That Justify Separation
The two institutions that separated their committees encountered the same three patterns, each of which eroded the effectiveness of combined oversight.
Agenda Dilution and Time Compression
In both cases, the risk committee agenda grew steadily. SAMA's updated frameworks—covering climate risk, third-party risk, and model risk—added standing items. Regulatory reporting cycles compressed review windows. Credit portfolios required deeper discussion as economic conditions shifted. Cybersecurity, allocated fifteen to twenty minutes per meeting, became the item most often deferred or summarized in writing.
The consequence was not that cyber risk went unmonitored—the CISO still reported, and the committee still approved policies—but that meaningful discussion disappeared. Directors asked fewer questions. Threat intelligence became a briefing slide rather than a strategic conversation. Incident post-mortems were noted but not interrogated. The committee fulfilled its formal duty but lost the depth required for effective oversight.
Incident Escalation Delays
Both institutions experienced cyber incidents—one a credential-compromise attempt, the other a third-party data exposure—that required board notification within hours under SAMA's incident-reporting obligations. The combined risk committee structure introduced friction. The committee chair, who also chaired the audit committee and served on two other boards, was traveling. Convening an extraordinary meeting required coordinating five directors' schedules. The full committee was not needed for the decision—only the subset with cyber fluency—but the charter required quorum.
In each case, the institution escalated through the board chair directly, bypassing the committee. The incident was managed correctly, but the governance structure had been routed around. When the same pattern repeated months later, both boards recognized a structural problem: the combined committee was too slow and too broad for time-sensitive cyber decisions.
Mismatched Expertise and Engagement
Risk committees are typically composed of directors with financial and audit backgrounds. Cyber discussions involve threat actors, attack vectors, control maturity, and technology architecture. In both institutions, one or two directors engaged deeply with cyber topics; the others deferred or asked process questions rather than substantive ones. The CISO calibrated presentations to the least technical audience, which meant threat briefings stayed high-level and control discussions focused on compliance status rather than effectiveness.
The mismatch was not a failure of director competence—these were experienced board members—but a recognition that cyber oversight benefits from different expertise than credit or market risk. The institutions needed directors who could challenge threat assumptions, assess control architecture, and evaluate vendor security, not as a courtesy agenda item but as a primary responsibility.
The Structural Changes That Followed
Both institutions made similar adjustments, though the sequence and details varied.
Committee Charters and Membership
Each board established a standalone cybersecurity and technology risk committee. The charter defined the committee's scope: oversight of information security, technology resilience, cyber incident response, third-party technology risk, and digital transformation security. Enterprise risk, credit, market, and liquidity remained with the risk committee.
Membership changed deliberately. One institution appointed three directors: two with technology or cybersecurity backgrounds from other sectors, and one from the existing risk committee to preserve continuity. The other appointed four, including a director with operational technology experience relevant to payment systems. Both committees included at least one member of the audit committee to coordinate control assurance.
The charters clarified escalation authority. The cybersecurity committee could convene on twenty-four hours' notice for incidents. It could approve emergency expenditure up to a defined threshold without full board approval. It received standing invitations for the CISO, CIO, and Chief Information Security Officer to attend all meetings, not just when summoned.
Reporting Lines and Coordination
Separation introduced a coordination challenge: how to prevent the two committees from operating in silos or duplicating work. Both institutions addressed this through explicit reporting and cross-membership.
The CISO reported to the cybersecurity committee but provided a summary cyber risk view to the risk committee quarterly. The enterprise risk register, owned by the Chief Risk Officer, included cyber risks, but detailed control assessment and remediation tracking moved to the cybersecurity committee. The cybersecurity committee chair attended risk committee meetings when cyber items appeared on the enterprise risk register, and vice versa.
Both institutions updated their governance charter to clarify that the cybersecurity committee was not a technical working group but a board committee with the same authority and formality as audit and risk committees. This distinction mattered for regulatory supervision: SAMA expects board-level oversight, and the charter made clear that the new committee fulfilled that role.
Meeting Cadence and Efficiency
Neither institution added net meeting time. Both reduced the risk committee's meeting frequency from quarterly to three times per year, reallocating the saved meeting to the cybersecurity committee, which met quarterly. Extraordinary meetings—previously rare for the combined committee—became routine for the cybersecurity committee during incident response or major technology changes, but these were shorter, focused sessions rather than full board meetings.
The result was more total oversight hours for cybersecurity, but distributed across directors with relevant expertise and interest, rather than consuming the time of the full risk committee.
When Separation Makes Sense
Not every institution should separate these committees. The decision depends on three factors.
First, agenda saturation. If the risk committee consistently defers cyber topics, compresses discussion, or relies on written reports without dialogue, the combined model is failing. If the committee comfortably accommodates cyber oversight within its existing cadence, separation adds complexity without benefit.
Second, incident velocity. If the institution operates in a high-threat environment—retail banking, payment processing, capital markets—or has experienced incidents requiring rapid board decisions, a dedicated committee with streamlined escalation authority reduces response time. If incidents are rare and the existing escalation path works, the combined model suffices.
Third, director expertise and engagement. If the risk committee includes directors with deep cyber or technology backgrounds who actively engage with the topic, separation may fragment their contribution. If cyber discussions reveal a persistent expertise gap or disengagement, a smaller committee with targeted membership will be more effective.
Practical Adjustments to Charter and Terms of Reference
Institutions that proceed with separation should expect to update several governance documents.
The board governance charter must define the new committee's authority, scope, and relationship to other committees. It should specify decision rights—what the committee can approve independently, what requires full board endorsement, and what must be coordinated with the risk or audit committee.
The committee terms of reference should clarify membership criteria, meeting frequency, quorum requirements, and standing agenda items. Both institutions required at least one member with recent cybersecurity or technology risk experience, defined as current or prior executive responsibility in those domains within the past five years.
The RACI matrix—responsible, accountable, consulted, informed—should map each governance activity to the correct committee. Cyber risk appetite, for example, remained a board responsibility in both institutions, but the cybersecurity committee was responsible for recommending it and monitoring adherence, while the risk committee was consulted to ensure alignment with enterprise risk appetite.
The enterprise risk register required adjustment. Both institutions maintained a single register but assigned ownership of cyber risk entries to the CISO, with the cybersecurity committee as the reviewing body. The Chief Risk Officer retained oversight of the register's methodology and aggregation, ensuring cyber risks were weighted and reported consistently with other enterprise risks.
Preserving Board Efficiency
The concern most often raised by boards considering separation is meeting proliferation. Directors already serve on audit, risk, nomination, and remuneration committees; adding a fifth committee risks governance fatigue.
Both institutions addressed this by reducing meeting frequency elsewhere and by keeping the cybersecurity committee small. Three to four members proved sufficient. The committee could move quickly, dive deep, and avoid the coordination overhead of larger groups. Non-member directors received the committee's minutes and could attend as observers, preserving transparency without requiring attendance.
Neither institution added standing agenda items to the full board. Cyber topics appeared on the board agenda only when they required board decision—approval of risk appetite, major incidents, or capital allocation for security programs. Routine oversight stayed at the committee level, with the committee chair providing a brief update during the board chair's report.
Aligning the Change with SAMA Expectations
SAMA's Cyber Security Framework and the broader Principles for Financial Market Infrastructures require board-level oversight of cybersecurity but do not prescribe committee structure. Both institutions notified their SAMA supervisory teams of the governance change as part of routine reporting, describing the rationale and providing updated charters.
In both cases, the supervisory response was neutral to positive. SAMA's concern is that oversight occurs, that it is documented, and that it is effective. Separation, when justified by the institution's risk profile and explained clearly, meets that standard.
The institutions also updated their compliance monitoring to reflect the new structure. The compliance monitoring and KPI dashboard design now tracked committee meeting frequency, attendance, and the time from incident detection to committee notification, providing evidence that the new structure improved rather than complicated governance.
Building the Program Beneath the Structure
Committee structure alone does not create effective oversight. Both institutions invested in the underlying governance program: a clear cybersecurity risk methodology and risk register that the committee could review, a unified control framework with cross-framework mapping that showed how controls satisfied SAMA, NCA ECC, PDPL, and ISO 27001 simultaneously, and a policy and standard set that translated committee decisions into operational requirements.
The committee's effectiveness depended on receiving coherent, decision-ready information. That required the CISO and risk function to build a program with clear ownership from the board to control operators, so the committee could trace a control gap to the responsible team and a risk decision to its operational impact. It required a risk methodology tied to risk appetite, so the committee could judge whether a residual risk was acceptable or required treatment. It required metrics that show leadership how risk is changing, not just compliance status.
Both institutions completed this work in parallel with the committee restructure, recognizing that governance structure and governance content must evolve together.
Governance Structures That Reflect Operating Reality
The decision to separate or combine risk and cybersecurity committees is not doctrinal. It is a practical judgment about how a specific institution, with a specific risk profile and board composition, can best oversee a rapidly evolving risk domain.
For many institutions, the combined model works. For others—particularly those facing high incident velocity, agenda saturation, or expertise gaps—separation improves both the depth and speed of oversight. The key is to recognize the symptoms early, make the change deliberately, and invest in the program and documentation that make the new structure effective.
How We Support Governance Redesign
CISO Consulting's Governance, Risk & Compliance service helps institutions design and implement governance structures aligned to Saudi and international frameworks. We deliver a governance charter, committee terms of reference and RACI, a cybersecurity risk methodology and risk register, a unified control framework with cross-framework mapping, a policy and standard set, and compliance monitoring and KPI dashboard design. The engagement typically runs 8–16 weeks, then optional ongoing support, and ensures clear ownership from the board to control operators, a risk methodology tied to your risk appetite, one control set mapped across SAMA, NCA, PDPL and ISO 27001, continuous evidence instead of assessment-season scrambles, and metrics that show leadership how risk is changing. We work with the GRC tool you already use, designing the program first and then configuring it in your existing platform, or recommend one if you have none.
