A key responsibility of charity trustees is to review the risks they face and decide how best to manage them.  Historically this may have been undertaken by the Board as an annual exercise, with the risk register taken off the shelf, dusted off and reviewed to ensure it remained suitable. However, in the context of high-profile cases where the impact of specific risks were arguably grossly underestimated, and both the rapid pace of technological change and its associated cyber risks, experience suggests that Boards should be prepared to invest more time than ever thinking about risks and how to manage them.