Monitoring, Reporting, and Communication
Monitoring and reporting close the risk management loop. Candidates must know the difference between continuous monitoring (ongoing controls testing, KRIs) and periodic review (risk assessments, audits), and the role of Key Risk Indicators (KRIs) versus Key Performance Indicators (KPIs) and Key Control Indicators (KCIs). Good KRIs are predictive, measurable, linked to appetite, and have thresholds (green/amber/red) that trigger escalation.
Understand risk reporting to the board and committees: content (top risks, movements, breaches, emerging risks, treatment status), frequency, and the principle of decision-usefulness. Know loss-event reporting, incident management, and near-miss capture. Understand emerging risk identification and horizon scanning. Communication must be timely, accurate, complete, and tailored to the audience; risk registers and dashboards are common tools.
Traps: confusing a KRI (risk leading) with a KPI (performance) or KCI (control); reporting only backward-looking losses; overloading boards with operational detail; and assuming green indicators mean no risk (indicators can be lagging or manipulated). Also watch for the claim that monitoring is a one-time exercise.
Rule of thumb: Report by exception - flag movements and breaches, not everything. Worked example: a KRI tracks staff turnover in a key control function with thresholds at 10% (amber) and 15% (red). Turnover reaches 16%, triggering escalation to the risk committee, which commissions a retention plan and reassesses the associated operational risk rating.