Risk Communication and Reporting
Communication and reporting turn risk work into decisions. This domain tests stakeholder analysis, the ISO 31000 communication and consultation process, escalation rules, and reporting that is timely, material and honest.
Communication versus consultation
Communication is two-way information exchange; consultation involves stakeholders in shaping decisions and brings in knowledge the risk team lacks. A plan states who needs what, when, how, and who owns the message. Internal audiences include the board, risk committee, business units and control functions; external audiences include regulators, customers, investors, insurers and the public.
Reporting that earns marks
Board packs typically show top risks, movement since last period, appetite position, KRI status, incidents, treatment progress and emerging risks. Report residual risk against appetite, with trend and direction of travel. Use consistent scales and define thresholds in advance. Escalation should be triggered by threshold breaches, velocity, concentration, regulatory events or failed controls - not by seniority preference.
Worked example
Phishing simulation click rate has a baseline of 8%. Amber is set at 12% and red at 15%. The latest two-month result is 22%, and two credential-harvesting incidents followed. Reasoning: the KRI is red, so the CISO is notified within 24 hours, the risk committee within 48 hours, and the board sees it in the quarterly pack with a trend chart. The report does not stop at the number: it states likely causes (a large new-starter cohort and a changed campaign), the action (targeted training, email filtering rule, re-test in 60 days), the owner and the revised residual score. The loop closes when the next result is reported against the same baseline.
Traps that cost marks
One-way reporting that never invites challenge; inconsistent scales between business units; reporting inherent risk to the board without saying so; hiding bad news until it is unavoidable; setting KRIs without thresholds or owners; overloading committees with operational detail; failing to record decisions and rationale; treating communication as a one-off announcement rather than a continuing process.