The Five Elements of an Effective Board Risk Report
Board risk reporting is one of those things that everyone agrees is important and almost no one is completely satisfied with. The problem is rarely a lack of information — it is usually too much of the wrong kind, presented in a way that does not help the board do its job.
1. A clear view of the top risks
The board needs to know what the organisation's most significant risks are and whether the picture has changed. A short, well-prioritised list — ideally no more than ten — with a clear direction of travel (improving, stable, deteriorating) does more useful work than a comprehensive risk register with 200 entries.
2. Connection to strategy and objectives
Risk does not exist in isolation. The board wants to understand how the current risk profile connects to what the organisation is trying to achieve. Are there risks that could derail the strategy? Framing risks in terms of strategic objectives makes them immediately more relevant.
3. Forward-looking content
Most board risk reports are dominated by what has already happened. That is necessary, but it should not dominate. Boards care more about what is coming — what risks are on the horizon, what scenarios to think about, how the external environment is shifting.
4. Clear appetite adherence
The board report needs to make clear where the organisation is operating within appetite and, critically, where it is not. Appetite breaches and near-misses deserve specific attention. This is one of the primary ways the board holds management accountable.
5. A small number of clear asks
Every board risk report should end with a short list of items requiring board attention or decision — not just "for information" but specific questions, decisions, or challenges. This transforms a report from a status update into a genuine governance tool.
Good board risk reporting takes discipline. It requires risk teams to be ruthless about what goes in and what gets left out, and to always ask: does this help the board do its job?