Topics in this domain
- Risk Management Concepts and Frameworks
- Inherent Risk, Residual Risk, Appetite and Tolerance
- Threat Actors, Motivations and Attack Vectors
- The Evolving Threat Landscape: AI, Cloud and Supply Chain
- Threat Modelling and Cyber Threat Intelligence
- Vulnerability Assessment and Scanning
- Control Deficiencies and Security Gap Analysis
- The Risk Assessment Process
- Qualitative Risk Analysis: Likelihood and Impact
- Quantitative Risk Analysis: SLE, ALE and Loss Estimation
- Risk Scenarios and Prioritisation
- Risk Treatment Options: Mitigate, Transfer, Avoid, Accept
- Risk Acceptance: Approval, Expiry and Review
- Cost-Benefit Analysis for Risk Treatment
- Risk Ownership vs Control Ownership
- RACI and Risk Escalation Paths
- The Risk Register
- Continuous Risk Monitoring and Key Risk Indicators
- Risk Reporting to Executives and the Board
- Integrating Risk Management into Business and IT Processes
Risk Reporting to Executives and the Board
Reports are for decisions
A risk report has one job: help someone decide. If the reader can’t tell which risks matter, whether they’re getting better or worse and what they’re being asked to do, the report has failed, however much data it contains. One CISM task is to report information security risk, including non-compliance and changes in risk, to stakeholders to support decisions.
Different readers, different reports
| Audience | They need | How often |
|---|---|---|
| Board | Top risks against appetite, trends, decisions needed | Quarterly |
| Executives | Risks in their area, treatment progress, acceptances | Monthly |
| Steering committee | Top risks, overdue actions, conflicts to resolve | Monthly or quarterly |
| Risk owners | Their risks, KRIs, control failures | Monthly or on change |
| Regulators | Required reports, incidents, compliance | As required |
What a board report contains
- top risks compared with appetite, often on a heat map
- trends: what’s moved since last time, and why
- significant incidents and their lessons
- treatment progress, overdue actions and accepted risks
- non-compliance and emerging risks
- the decisions the board needs to make
Keep it short: a page or two plus an appendix. Directors read many reports.
Business terms, not technical terms
| Technical | Business |
|---|---|
| “12,000 intrusion attempts blocked.” | “The risk of a payments outage is down from High to Medium.” |
| “CVSS 9.8 on edge devices.” | “Our remote access could be used to stop production within days.” |
| “SIEM coverage at 64%.” | “A third of our critical systems could be breached without us noticing.” |
Timing and honesty
Significant changes, such as a major incident, a new high-impact threat or a key control failing, are reported when they happen, not held for the next scheduled report.
Example. Two days after the quarterly report, a critical supplier suffers a breach involving the company’s customer data. The CISO doesn’t wait for next quarter: the CEO and the chair of the risk committee are briefed the same day, with the facts known, the likely impact and the decisions needed.
Report bad news early and accurately. Hiding or softening it destroys the trust the security manager depends on.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Most important content of a board risk report | Top risks against appetite, in business terms |
| Main purpose of risk reporting | Support informed decisions |
| A significant new risk appears | Report it promptly, outside the normal cycle |
| Best way to show progress | Trends over time |
| How to tailor reports | Match content and detail to the audience |
In short
- Risk reporting exists to support decisions; every report should make clear what, if anything, the reader needs to decide.
- Tailor reports to the audience: the board needs top risks against appetite and trends; owners need detail on their risks.
- Report in business terms (impact on objectives, money, customers, compliance), not technical detail.
- Include trends, changes since the last report, overdue actions, accepted risks and non-compliance.
- Be accurate and timely; report significant changes and incidents promptly, not only at the next scheduled report.
- Honest reporting of bad news builds credibility; hiding it destroys trust.
Exam traps
- Technical metrics (alerts blocked, patches applied) aren't board risk reporting.
- A report without trends or comparison with appetite gives no basis for decisions.
- Significant new risks shouldn't wait for the quarterly cycle.
- Reporting only good news undermines the security manager's credibility.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Different readers, different reports