Creating Risk Reports That Leave an Impact | 6clicks Blog

Why Risk Reporting is Important in GRC

A lack of quality risk reporting in the organization leaves the board ill-equipped in determining the efficacy of the risk management systems in place. Risk reporting also enables the board to offer strategic guidance to the organization.

Furthermore, a management team that has valuable risk information is better able to drive operational improvements to better support the business’s objectives.

What Makes a Risk Report Effective?

The report should address how your risk and compliance program is addressing the risk in question (ie. the company's existing policies and controls), as well as a timeline for action or a request for additional resources.

Every risk in a risk report should include a description of its potential impact. The impact can be defined along several lines;

• Financial: monetary penalties as part of regulatory enforcement; related personnel or equipment costs for that investigation (outside counsel, new technology, etc.); lost revenue or profit.
  
  
• Operational: whether a risk might lead to inventory that can’t be sold, factories or hospital wings that can’t be used, business processes that might not work when necessary, and so forth.
  
  
• Strategic: whether a risk could thwart certain long-range options, such as leaving the company with too little cash to acquire merger targets or develop new products.
  
  
• Reputational: could risk damage the corporate reputation among customers, consumers, or business partners.

Not every risk needs a full overview of every point above, but you should consider these variables and which are most relevant to the risk you are highlighting.

Formatting a Risk Report

Keep your report concise, to the point and easy to digest. Start with an executive summary, followed by an overview of each risk (with your supporting data) and close with a positive 'forward-looking' statement.

Knowing that your audience will be management and operations folks, you might tie each risk to a stated business objective for greater context; the connection telling the reader why it matters. Anything beyond 10 pages is too lengthy.

Just getting started in your GRC journey? How about a whistle-stop tour with one of our 6clicks maestros?

Easy - just click the button below and let the good times roll.

All we want to do, every day, is make the world of GRC easier to manage. We can't do that without you, so we hope to hear from you real soon!