Risk Reporting, Monitoring and Assurance
Risk Reporting, Monitoring and Assurance
This domain tests how risk information flows to decision-makers and how assurance is coordinated. Expect questions on KRIs, dashboards, escalation thresholds, board risk reports, assurance mapping and combined assurance.
Core rules
- Reporting should be timely, forward-looking and linked to objectives and appetite. A dashboard of 60 metrics is not useful; focus on the few that indicate movement toward or away from risk limits.
- Escalation thresholds define what goes to management, the risk committee and the board. Include trigger, owner, action and deadline.
- Assurance mapping shows which risks are covered by management testing, compliance review, internal audit and external audit. Combined assurance coordinates these providers to avoid gaps and duplication.
- The audit committee oversees internal audit independence and the effectiveness of assurance; the board risk committee oversees the risk profile and appetite.
Worked example
An administrative risk dashboard shows late statutory filings as a KRI. The threshold is zero overdue filings. A filing is 5 days late because a director’s signature is missing. The dashboard turns red and escalates to the company secretary and risk committee. The report states the cause, penalty exposure, remediation and revised filing checklist. The committee asks internal audit to test the filing calendar for the next quarter. Reasoning: a KRI is useful only when a breach triggers an owner, action and assurance follow-up.
Traps
- Reporting historical incidents only, with no forward-looking indicators.
- Setting thresholds with no escalation route.
- Assuming more assurance is better; duplication wastes resources.
- Treating the risk report as a data dump rather than a decision tool.