What decision does this report support?

A risk report should help its audience understand what changed and what requires action. This article looks at how to connect risk movement and control performance with accountable ownership and the decision management needs to make.

The report that changes nothing

Most technology risk reports are accurate. They list the risks, show the ratings, count the open issues, and color the heat map. Then the meeting moves on, and nothing changes.

The problem is rarely the data. It is that the report was built to describe the risk position rather than to support a decision about it. Executives and board members are not short of information. They are short of clarity on three things: what has changed, whether it matters, and what they are being asked to do.

So before I review the content of any risk report, I ask one question of every section: What decision does this support? If no one can answer, the section is either background material or noise.

The reporting chain

A report line that supports a decision has five links. Missing any one of them turns a decision into a status update.

Figure 1. Each link answers a question the audience will otherwise ask in the meeting.

1. Risk movement: what changed? Direction and cause matter more than the current rating. “Elevated, up from moderate last quarter” tells the reader something. “Elevated” alone does not.
2. Control performance: why did it change? Connect the movement to evidence: a failed control test, an overdue remediation, a new threat, a business change.
3. Accountable owner: who owns it? A named person, not a department. Ownership is what turns a finding into an action.
4. Decision requested: what is needed? Accept the risk, fund the fix, change the deadline, escalate, or simply note. Say which.
5. Action and date: by when? A committed date, and what happens if it slips.

Before and after

The difference is easiest to see side by side. The examples below are illustrative, not drawn from any organization.

A report that describes	A report that supports a decision
Access management risk: High	Privileged access risk rose from moderate to high this quarter. Quarterly access reviews were not completed for two critical applications. Owner: VP, Application Services. Decision needed: approve temporary contractor support to clear the backlog by March 31, or formally accept the risk until the next cycle.
Third-party risk: 14 open issues	Open third-party issues are steady overall, but three critical vendors have overdue SOC report reviews. Owner: Head of Vendor Management. Decision needed: none this quarter; the review plan is on track for completion by the end of next month.
AI governance: In progress	Two AI use cases went live without documented performance thresholds. Owner: Chief Data Officer. Decision needed: confirm that new deployments are paused until thresholds are approved.

The right-hand column is longer, but it is faster to act on. Every line answers the questions the committee would otherwise spend the meeting asking.

Report on control performance, not just risk ratings

A risk rating is an opinion. Control performance is evidence. A credible report shows the evidence behind the opinion. For technology risk, I look for a small set of indicators that genuinely move:

Element	Weak version	Strong version
Key risk indicators	Many metrics, no thresholds	A few indicators, each with an agreed threshold and an owner
Control testing	A single percentage of controls rated effective	Which key controls failed, why, and the impact on the risk
Issues and remediation	Count of open issues	Overdue issues by severity, aging, and repeat findings
Risk acceptance	Not reported	Accepted risks, who accepted them, and when they expire
Trend	Current quarter only	Direction of travel over several periods, with the reason
Emerging risk	Long list of external threats	The few new risks that change the organization’s position

Two items deserve particular attention. Repeat findings show whether remediation actually fixes root causes. Expired risk acceptances show whether “accepted” really means accepted or simply forgotten.

Different audiences, different decisions

One report rarely serves every audience. The board and the management committee make different decisions, so they need different views of the same underlying data.

Audience	Decisions they make	What they need to see
Board or board risk committee	Risk appetite, oversight of management, major investments	Position against appetite, the few material risks, significant breaches, whether management is in control
Executive risk committee	Prioritization, funding, escalation, risk acceptance	Movement and cause, overdue actions, decisions requested with options
Risk and control owners	Day-to-day remediation and control operation	Detailed issues, test results, deadlines, dependencies

A board pack that reads like an operational issue log fails the board. An operational report that reads like a board summary fails the people doing the work.

A one-page structure that works

For an executive or committee audience, this structure fits on a page and keeps attention on decisions:

1. Summary: the overall position against risk appetite in two or three sentences.
2. What changed: the risks that moved, and why.
3. Decisions requested: each with the owner, the options, and a recommendation.
4. Off-track actions: overdue remediation and repeat findings, with revised dates.
5. For information: stable items, one line each, with detail in an appendix.

Put the decisions near the top. If the meeting runs short, the decisions still get made.

A quick test for your next report

Before your next report goes out, check each section against these questions:

• Does it say what changed since the last report, and why?
• Is the movement linked to evidence of control performance?
• Does every material item have one named owner?
• Is it clear what decision is being requested, or that none is needed?
• Are there dates for every action, and is slippage visible?
• Could a reader who missed the last three meetings understand what to do?

If a section fails most of these, it may still be worth keeping, but as background, not as the main event.

The measure of a good report

A good risk report is not measured by its accuracy or its length. It is measured by what happens after it is read. If the right people make the right decisions sooner because of it, the report has done its job.

---

This article reflects my professional perspective and is general information, not legal or regulatory advice. Apply it in light of your organization’s obligations and risk appetite.