A risk officer asks the board to fund tighter checks on customer payment instructions. The CFO wants to know how much loss those checks could prevent, what they cost and whether they will delay legitimate payments. After a fraud, the questions become harder: what did the firm know, why did it choose that protection and did anyone act when the assumptions changed?
A useful cyber risk decision record lets someone answer those questions using the evidence available when approval was given. It connects a plausible failure to money, explains the uncertainty and records what people agreed to do. For a financial firm regulated in Abu Dhabi Global Market (ADGM), that is good governance which can also support regulatory reporting. A loss estimate alone cannot establish that the firm has met its obligations.
Establish which obligations apply to the entity
ADGM commercial incorporation does not establish authorisation by its Financial Services Regulatory Authority (FSRA). Start with the legal entity providing the service and its permissions. Ask the compliance lead to confirm the applicable rules and any customer or supplier commitments that constrain the decision. The EU Digital Operational Resilience Act (DORA) does not apply merely because an entity is in ADGM. Relevant EU entities, services and contractual obligations need separate examination.
The FSRA cyber risk management amendments have been in force since 31 January 2026. They require Authorised Persons and Recognised Bodies to integrate cyber risk into their existing risk frameworks, with proportionality and consideration of IT service providers. The framework does not mandate monetary cyber risk quantification or buying an advisory service. Cornerstone Red can help a firm examine financial exposure and its choices; this work does not provide compliance certification.
Keep the rule interpretation separate from the spending comparison. A cheaper option may still be unavailable because it fails an applicable requirement. Record who checked that boundary and when. The person approving the budget needs to know which choices the firm can legitimately make before comparing their costs.
Show the money and the assumptions behind it
Define the failure in terms of the work affected. Identify whose instructions could be falsified, which payments could leave the firm and how staff would detect and stop them. Name the systems and outside providers on which those steps depend. A broad label such as fraud risk leaves too much room for different people to imagine different events.
Estimate a range of loss for that defined event. Separate money that might be unrecoverable from investigation costs, customer redress and the cost of restoring service. Explain exclusions and avoid counting the same customer loss twice. State the currency and period covered. If insurance or recovery from another party could reduce the loss, show that separately with the conditions and uncertainty attached.
Distinguish the cost of an event from how often it might happen. A severe loss range says nothing by itself about expected annual loss. If the comparison uses an annual estimate, explain the frequency assumptions as well as the possible losses. Where evidence is weak, say which judgement fills the gap and whether changing it would alter the funding decision.
Make the estimate inspectable
Give each material assumption a dated source. Payment limits and transaction records can support the amount exposed. A recovery exercise can show what staff achieved under its test conditions. An insurer's wording can establish exclusions. A supplier's assurance about a protective measure remains something to verify. Record versions and keep sensitive evidence in a controlled location that the people responsible for review can access.
Check whether the evidence covers the failure being priced. A test of password security cannot establish that staff will challenge a convincing fake executive call. The FSRA's April 2026 notice to virtual asset service providers explicitly highlights AI and deepfake fraud, alongside key compromise and supply-chain threats. Deepfakes are fabricated audio or video that can impersonate a person. Where impersonation could authorise a payment, evidence about the approval process matters more than a general statement that staff have received training.
Record what approval changes
Compare the proposed protection with the real alternatives over the same period, including keeping the present arrangement where that is permissible. Show costs, disruption to customers and the loss that could still occur after each option. Explain why the chosen option is proportionate to the firm's exposure. A smaller estimated loss does not remove duties to customers or make an untested measure dependable.
Name the person authorised to approve the choice, the funded work and who must deliver it by when. If the decision depends on a restriction, specify who keeps it working and who can stop the affected activity if it fails. Set a review date and triggers tied to the assumptions: a changed provider, a failed test or a higher payment limit should reach the decision owner without waiting for the next scheduled committee meeting. Preserve earlier versions so later reviewers can distinguish an approved change from work that was never completed.
Use the record without delaying incident notification
The FSRA's official IT-risk guidance specifies immediate notice for incidents impacting operations under GEN 8.10.6 and notice no later than 24 hours for material cyber incidents under GEN 3.5.18. The latter is not permission to wait where immediate notice applies. The compliance and incident leads should establish the applicable reporting process in advance. Completing a financial estimate or obtaining another board approval must not delay a required notice.
During an incident, the record helps locate the affected service, its dependencies and the people responsible for decisions. Keep emerging facts and their times separate from the earlier forecast. It gives the board a basis for asking whether the event was anticipated, whether promised work was completed and whether a review trigger was missed. It supports those enquiries; it cannot replace incident evidence or determine regulatory materiality through a monetary threshold alone.
| Record field | The question it answers |
|---|---|
| The money at risk | What could be lost, in which currency and over what period? |
| The evidence behind the estimate | Which dated sources support the estimate and its assumptions? |
| The chosen action and owner | What was approved, why, and who must deliver it? |
| Review date and triggers | When is review due, and which changes reopen approval? |
| Notification process | Who reports an incident, through which route and by when? |
Before approving the next cyber budget, ask the risk officer and CFO to take a material exposure and assemble its decision record together. Have the compliance lead confirm the obligations and reporting route. If the record cannot explain the loss range, the evidence behind it and what would reopen approval, identify the missing evidence before relying on that estimate to choose the spend.