Last reviewed 29 October 2026 against the sources linked in this post.
A company secretary opens the board pack and finds one line on cyber risk, with no questions for the directors to ask. That gap is why board of directors training matters. In the United States, the Securities and Exchange Commission says its 2023 rules require companies to describe the board's oversight of cybersecurity threats, along with management's role and expertise, in the annual report. A director cannot describe oversight they have not practised.
This is a list of 13 ready-made courses for company secretaries, general counsel and chairs who plan the annual board education calendar. They cover cyber, AI, fraud, bribery, ethics, safety and culture. Each entry says what the course covers, why a director needs it and what the room does in the session. Each group ends with an Meie valik. After the list comes a rollout order and a way to run the sessions live.
All 13 courses at a glance
| Kursus | Mida see hõlmab | Pikkus | Legal duty on the organisation? |
|---|---|---|---|
| Cyber risk governance for managers and boards | The oversight questions to put to management | 40 min | Ei |
| Who is responsible? AI Act roles, deployer duties and your organisation's AI governance | Who is accountable for AI deployment | 45 min | Ei |
| Social engineering, fraud and deepfakes | Phone, payment and impersonation scams | 35 min | Ei |
| Anti-bribery & corruption (FCPA) | US foreign bribery basics | 40 min | Jah |
| UK: Bribery Act 2010 | Failing to prevent bribery | 35 min | Jah |
| Records retention & internal controls (SOX) | Controls and records as board duties | 35 min | Jah |
| Käitumiskoodeks | Modelling the code the board approves | 35 min | Ei |
| Ethical leadership and building trust | Tone from the top | 35 min | Ei |
| Safety law, committees, management systems and audits | Challenging management's safety systems | 40 min | Ei |
| Supervisor, manager and safety representative duties | Safety duties senior officers carry | 45 min | Ei |
| Preventing retaliation | Protecting people who raise concerns | 40 min | Jah |
| Respectful workplace & anti-bullying | Leaders' behaviour and respect | 35 min | Ei |
| Resilience, stress and wellbeing at work | Executive burnout as a governance risk | 35 min | Ei |
Cyber, fraud and AI governance
Cyber risk governance for managers and boards
This course frames the governance questions a board should put to management: what are our crown jewels, who decides in an incident, how do we know controls work? Directors need it because oversight is theirs, even when the detail is not. In the session, run a Pick Answer scenario: a ransomware note arrives at 2 am, and who is called first? Compare the room's answers with your own incident plan.
Who is responsible? AI Act roles, deployer duties and your organisation's AI governance
This course explains who is accountable when your organisation uses AI. The European Commission says deployers of high-risk AI systems are responsible for human oversight and monitoring once the system is on the market, which lands on leadership. In the session, use a Word Cloud: "Where does our organisation already use AI?" The gaps show what the board has not seen.
Social engineering, fraud and deepfakes
Executives are common targets for impersonation and payment fraud, including deepfake voice scams, because a request in their name gets obeyed fast. This course covers phone, payment and impersonation scams and the habit of verifying on a second channel. In the session, play a short voice-clip scenario and ask the room, by poll, whether they would approve the transfer.
Our pick: Cyber risk governance for managers and boards. It gives a director the questions to ask on day one, and the same questions carry into the AI and fraud sessions.
Bribery, controls and ethics
Anti-bribery & corruption (FCPA)
Bribery risk sits with the organisation and, in some cases, with the individuals involved, so directors need the basics. The US Department of Justice says the Foreign Corrupt Practices Act's anti-bribery provisions prohibit corruptly offering, paying or promising anything of value to a foreign official to gain an improper advantage in business. In the session, give a Pick Answer scenario about a "facilitation" payment from an overseas agent and ask what the board would do.
UK: Bribery Act 2010
The Act makes a commercial organisation guilty of an offence when a person associated with it bribes another person intending to obtain or retain business for it, with a defence if it had adequate procedures in place. That makes procedures a board-level concern. In the session, use a Rating Scale: "How confident are we that our agents know our rules?" Discuss the lowest score.
Records retention & internal controls (SOX)
Internal controls and records retention go to the heart of what a board oversees. The SEC says Section 404 requires annual reports of covered companies to include management's assessment of the effectiveness of internal control over financial reporting. In the session, run a quiz with a short control-failure case and ask where it should have been caught.
Käitumiskoodeks
Directors approve the code of conduct for the whole organisation, so they must be seen to follow it first. The course covers what a good code says and how it is enforced. In the session, show three real-style gift and hospitality cases and run a poll: acceptable, declare or decline? Differences between directors show where the code is vague.
Ethical leadership and building trust
Tone from the top shapes culture, and a board sets that tone through what it rewards and what it ignores. This course covers ethical leadership and how trust is built and lost. In the session, use an Open Ended slide: "Describe a decision where the right choice cost us something." Read the answers aloud and ask what the board would want to hear about.
Our pick: Anti-bribery & corruption (FCPA). A scenario poll gets blunt answers fast, and the stakes of getting it wrong make the course memorable.
Safety law and duty of care
Safety law, committees, management systems and audits
Directors need enough safety law, committee and audit knowledge to challenge management's systems rather than accept a clean dashboard. The course covers how safety committees work, what a management system should show and what audits reveal. In the session, run a Pick Answer quiz on which safety report a board should ask for first, then compare it with the pack you receive today.
Supervisor, manager and safety representative duties
In many jurisdictions, safety duties reach senior officers and not only the front line, so check the law that applies to you. This course clarifies what supervisors, managers and safety representatives must do, so a director can tell whether the chain from boardroom to shop floor is intact. In the session, use a Word Cloud: "Name one safety duty you hold yourself." Blank spaces on the cloud are the discussion.
Our pick: Safety law, committees, management systems and audits. It teaches directors how to challenge, which is the skill every other safety course depends on.
Culture, respect and wellbeing
Preventing retaliation
Boards need to make sure retaliation against people who raise concerns is never tolerated. The US Equal Employment Opportunity Commission says employers cannot retaliate against applicants or employees for participating in the EEO process, such as filing a charge or complaint or acting as a witness. In the session, run a Pick Answer scenario about moving a complainant to a "quieter" team and ask whether it counts.
Respectful workplace & anti-bullying
Senior leaders' behaviour sets what counts as respectful across the organisation, and staff copy what they see in the boardroom. This course covers respectful conduct, bullying and how leaders respond. In the session, use an anonymous Rating Scale: "How safe is it to disagree with a director?" A low average is a finding the board can act on.
Resilience, stress and wellbeing at work
Executive burnout is a governance risk, because tired leaders decide badly and set an unhealthy pace for everyone else. This course covers resilience and sustainable pressure. In the session, ask directors to answer an Open Ended slide anonymously: "What one change to board workload would help most?" Share the themes with the chair.
Our pick: Preventing retaliation. A board hears about problems only if people dare to raise them, so this protects every other control on the list.
How to roll the plan out
Start with the courses that cover a legal duty: FCPA, the UK Bribery Act, SOX and preventing retaliation, plus anything your onboarding already requires. Then schedule annual refreshers for the fast-moving topics, cyber, AI and fraud. Finish with role-specific depth, such as safety for operational directors and wellbeing for the chair.
Add the regional course your location needs. A US-listed company may pair FCPA with SOX, and a company carrying on business in the UK adds the Bribery Act.
Anchor each session to the same fact. The SEC says its 2023 rules require companies to describe the board's oversight of cybersecurity threats, so a short, dated record of cyber training is useful evidence of what oversight looks like in practice. Keep attendance and the questions raised in the board minutes.
Ways to run these courses on AhaSlides
You can offer all 13 in three formats:
- Omatempolised kursused. Kasuta AhaSlides course creator to send each director a course to complete before the meeting.
- A live Q&A deck. Collect questions from directors ahead of the session, then answer them in the room.
- Pre and post surveys. Measure what changed in the same session.
Four slide types do most of the work:
- Pick Answer. Ask: "A supplier offers a gift before a tender closes. Accept, declare or decline?" Show the split before you reveal the answer.
- Word Cloud. Ask: "Where does our organisation already use AI?" The size of each word shows what directors know about.
- Rating Scale. Ask, before and after: "How confident are you asking management about a cyber incident?" Rate from 1 to 5 and compare the averages.
- Open Ended. Ask: "What would you want the board told within 24 hours of a breach?" Answers can be anonymous, so people say what they think.
KKK
What training should board members have?
Governance duties, cyber and AI oversight, anti-bribery and ethics, and safety or duty-of-care responsibilities. The 13 courses above are grouped that way, and the legal duties for your country should come first.
Do directors need cybersecurity training?
No source cited here sets a training duty, but the oversight is expected. In the US, the SEC says public companies must describe the board's oversight of cybersecurity threats, and training is how directors prepare to do it. Check your own listing rules.
Is board of directors training mandatory?
There is no single rule that applies everywhere, and this post cites no general legal duty for directors to take training. The legal duties it does cite fall on the organisation, such as the UK Bribery Act's offence for failing to prevent bribery. Listed companies and regulated sectors may have their own expectations, so ask your regulator.
How often should boards refresh training?
Our suggestion is every year for cyber, AI and fraud, which change fastest, and at least every two years for bribery and ethics. None of the regulators cited here sets a refresh frequency.
This post is general information, not legal advice. For a decision about your own workplace, speak to a qualified lawyer or the regulator.
