Minutes | Meeting of the Risk Committee of the Board (BRC) | 30 July 2024

BRC Attendees: Harald Alvestrand, Maarten Botterman, Becky Burr, and Patricio Poblete

BRC Member Apology: James Galvin (Chair), Chris Chapman, and Wes Hardaker

Other Board Member Attendee: Katrina Sataki

ICANN organization Attendees: Xavier Calvez (SVP, Planning & Chief Financial Officer), Franco Carrasco (Board Operations Manager), Irina Douzadjian (Risk Management and Internal Audit Sr. Director), and Elizabeth Le (Deputy General Counsel).

The following is a summary of discussions, actions taken and actions identified:

1. Introduction and Opening Remarks – The Chair opened the meeting, introduced the agenda, and discussed action items.
2. BRC Action Items Log – The Committee reviewed the BRC Action Items Log. The Committee noted that the Risk Appetite Statement updates have been discussed over the last couple of BRC meetings and a proposed draft version was included as part of the BRC report to the Board. With respect to the BRC charter update, the Committee noted that the charter is in the process of being revised and will be presented to the BRC for consideration. As it relates to the critical path for the New gTLD Program: Next Round (Next Round) action item, ICANN org noted that staff will conduct a comprehensive risk overview of the Next Round which would include the critical path.
   • Action – ICANN org to conduct comprehensive risk overview of New gTLD Program: Next Round to develop critical path.
3. Risk Committee Workplan FY24 – FY25 Update – The Committee received a presentation regarding the Risk Management Workplan for FY24 – FY25, in particular the Internal Audit Function. The presentation included a discussion of the governance structure of the Committee's oversight responsibilities of risk management and the Internal Audit Function. The Internal Audit Function is under the oversight of the Board in the form of the Risk Committee. The Internal Audit Function will be developed in alignment with global industry standards. The Committee discussed the enhancement plan for the Risk Management Function, noting that the data regarding the current risk maturity state needs to be updated to reflect the current state due to the discontinuity between the earlier enhancement plan and the enhancement plan presented to the Committee. The Committee also discussed the development of the Internal Audit Function, which will be presented to the Committee once developed.
   • Action – ICANN org to update the data regarding the current risk maturity state to reflect the current state.