Risk Experts / Using it

Reporting that prompts a decision

A heat map is a picture, not a paper.

Risk reporting to a board frequently consists of a matrix, a movement summary and a list of the highest-rated items. It is received, noted, and produces no decision, which is a reasonable outcome given that nothing in it asks for one.

A report that changes something asks a question: here is an exposure, here is what treating it further would cost, here is what accepting it means, and here is the decision required. That is a different document and it is harder to write because it forces the risk function to have a view.

The other content worth reporting is movement with reasons. A rating that fell should be accompanied by what changed, and if the answer is that the assessment was revised rather than the exposure, that should be visible. Ratings drift downward over time in the absence of that discipline.

Reporting what was accepted, by whom, is the item most often omitted and the one most valuable in retrospect. It is the record that distinguishes a considered position from an oversight.

It is worth reporting the risks that were removed as well as those that remain. A register that only ever grows suggests either an organisation accumulating exposure or one unwilling to close anything, and distinguishing between those two is useful information for whoever is receiving the report.