Stakeholder Communication and Reporting
Core idea
Risk communication turns analysis into decisions. Candidates must know how to tailor content to audience: the board needs aggregated exposure against appetite, emerging risks and trends; operational managers need specific, actionable risk detail; regulators and customers need accurate, timely and fair disclosure. Understand the components of a strong risk report: clear purpose, defined scope, consistent scales, comparison to appetite, movement since last period, and explicit actions with owners.
Communication concepts
Know the difference between risk reporting (periodic, structured) and risk communication (continuous, two-way). Understand materiality thresholds, aggregation and the risk of misleading dashboards that hide tail risk behind averages. Recognise the value of a risk register as a living tool rather than a static list, and the importance of recording decisions and exceptions. Consider stakeholder mapping by interest and influence, and the ethics of disclosure, including avoiding misleading reassurance.
Traps
Common errors: reporting only residual scores, which hides whether controls are degrading; presenting heat maps without narrative context; using inconsistent scales across business units so aggregation is invalid; and communicating emerging risks only when they become incidents. Another trap is assuming more data improves communication; relevance and clarity matter more than volume.
Worked rule of thumb
Structure every risk report around four questions: what is our exposure against appetite, what changed, what are we doing about it, and what decision do we need? If a report cannot answer the last question, it is information rather than communication and should be shortened.