Topics in this domain
- Risk Response Options: Accept, Mitigate, Transfer, Avoid
- Aligning Responses with Appetite and Tolerance
- Cost-Benefit Analysis of Risk Responses
- Bias in Risk Decisions and Reporting
- Risk Owners and Control Owners
- RACI and Escalation
- Third-Party Risk Governance and Due Diligence
- Contracts, SLAs and the Right to Audit
- Monitoring Third Parties and Planning Exit
- Managing Issues, Findings and Control Deviations
- Risk Acceptance, Exceptions and Exemptions
- Control Frameworks and Their Purpose
- Control Types and Functions
- Designing and Selecting Controls
- Implementing Controls and Why Implementations Fail
- Control Design versus Operating Effectiveness
- Control Testing: Objectives, Evidence and Frequency
- Building and Tracking Risk Action Plans
- Collecting and Aggregating Risk Data
- Validating Risk Data Quality
- KRIs, KPIs and KCIs
- Thresholds, Escalation Triggers and Appetite
- Metric Pitfalls and Misuse
- Continuous Monitoring versus Periodic Assessment
- Tailoring Risk Reports to the Audience
- Heat Maps, Dashboards and Scorecards
- Identifying and Assessing Emerging Risks
- Integrating Emerging Risk into Decisions
Tailoring Risk Reports to the Audience
Same risks, different reports
What every report needs
- What’s changed since last time, and why.
- Risks against appetite, with trends.
- Progress on treatment and overdue actions.
- Decisions or support needed.
- The data date and known limitations.
Writing for the board
| Instead of… | Say… |
|---|---|
| 147 critical vulnerabilities | Customer portal breach risk is above appetite |
| EDR coverage 82% | 1 in 5 laptops could spread ransomware undetected |
| SIEM ingested 2 billion events | (Leave it out) |
Example. A quarterly board risk report was cut from 40 pages to 4: top risks against appetite, three trends, two overdue actions and one decision needed. The board discussed risk for the first time instead of skimming.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| MOST important content for the board | Top risks against appetite, in business terms |
| Why tailor reports | Each audience needs different detail to decide |
| Report risk owners need | Their risks, KRIs and action status |
| Board receives the full register | Summarise it into a risk profile |
In short
- Different audiences need different detail: summary and decisions go up, detail goes down.
- Board reports show top risks against appetite, trends and decisions needed, in business terms.
- Risk owners need their risks, KRIs, control failures and action status.
- Good reports are accurate, timely, consistent, concise and explain what's changed and why.
- Reports should lead to decisions; say clearly what's being asked of the reader.
Exam traps
- Sending the board the full risk register.
- Reporting technical metrics to executives.
- Changing formats and scales every period, hiding trends.
- Reports that inform but never ask for a decision.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Same risks, different reports
1 / 7