Risk Monitoring, Reporting, and Communication
Domain 6 tests the feedback loop: keeping risk information current, measuring control performance, and communicating to the right audience.
Core rules
- Monitoring tracks risk levels, treatment progress, control effectiveness, and changes in context.
- Key risk indicators are leading indicators with thresholds; key control indicators measure whether controls operate as designed.
- Reporting must match the audience: the board needs appetite, trends, and top exposures; operations need specifics and owners.
- Escalation paths and trigger thresholds should be defined before a breach occurs.
- Monitoring frequency should reflect risk velocity and criticality, not a fixed annual calendar.
Worked example
A KRI tracks the percentage of internet-facing servers missing critical patches for more than 14 days. The green threshold is below 5%, amber is 5–10%, and red is above 10%. In March the KRI hits 12%. The risk owner escalates to the CISO, reports the trend and affected business services to the risk committee, and opens a treatment plan with a 30-day deadline. The board summary shows the red KRI, the exposure, and the remediation date-not a list of every server. The reasoning links a measurable indicator to a pre-agreed action and audience-appropriate reporting.
Traps
- Relying only on lagging incident counts.
- Reporting raw technical data to the board without risk context.
- Setting thresholds that no one has authority to act on.
- Reviewing the register annually while the business changes monthly.