risk reporting

Types of risk reporting

A fundamental truth of risk management is that risks vary from one another in scope. For example, a minor risk might delay a project's completion by a day or two. Conversely, businesses might occasionally face major risks that jeopardize the wellbeing of the entire organization.

Not only do risks vary by severity, but they can also vary in terms of their impact. Some risks affect a whole organization or even an entire industry. Other risks might only impact a single department or a particular account.

Because risks can vary so widely from one another, there are several different types of risk reporting. Some of the more common risk reporting types include the following:

• Project risk reporting. As the lowest level of risk reporting, this pertains to risks that might affect a particular project, such as a supply chain disruption or a change in the price of raw materials.
• Program risk reporting. In business, programs are generally made up of multiple projects. A program risk report generally covers any project-level risks or other risks that are significant enough to adversely affect the entire program.
• Portfolio risk reporting. This is generally an aggregate summary of program-level risks across an organization's entire portfolio or collection of programs.
• Business risk reporting. This is used for significant risks that have the potential to affect the entire organization.

What should a risk report include?

A risk report's structure can vary based on the report's intended purpose. For example, a risk report that outlines risks to employee safety would likely be structured differently from a report meant to convey financial risks. Even so, several elements commonly included in a risk report include the following:

• Executive summary. A synopsis for senior management to identify the biggest risks.
• Risk profile. A description that uses numerical values to help quantify a risk. Although these risk profiles can be created in various ways, they are often based on a risk's seriousness combined with the odds of the risk actually occurring.
• Risk capacity. A metric reflecting how much risk an organization can afford to take. For example, a risk capacity might be a worst-case statement of how much money an organization could lose without going out of business.
• Tolerance levels. A measurement of how much risk an organization is willing to take on. Whereas risk capacity reflects how much an organization could lose before going bankrupt, risk tolerance measures how much an organization is willing to lose. A risk tolerance value is normally much lower than its risk capacity value and is sometimes categorized as conservative, moderate or aggressive.
• Key risk indicators (KRI). Metrics that are tied to a risk that has been identified. If one of these metrics reaches a threshold value, it can indicate that the identified risk is beginning to happen. As such, KRIs act as an early warning system that can give management teams time to act before an identified risk can fully occur.
• Effective risk management. A section of the report that explains how the organization will attempt to proactively reduce or eliminate risks that have been identified.
• Environmental risks. Identifies risks that the organization's activities pose to the environment due to factors such as pollution. This section is not always required, depending on the type of risk report.

Best practices for building an effective risk report

Some common best practices for creating an effective risk report include the following:

• Include charts or other graphical elements in the report whenever possible. These can make the report easier to digest.
• When possible, include a sunrise and sunset for each risk. The sunrise is the point at which a risk comes into play. The sunset is when an identified risk is no longer considered to be a risk. For example, in the case of making a large financial investment, the sunrise might be the time at which the contract is signed, and the sunset might be the point at which the organization has hit the break-even point for the investment.
• Each identified risk should include a clearly written risk statement explaining the threat. If necessary, a corresponding context statement can add additional clarity. For example, this section might include KRIs explaining the significance of each indicator and what the organization plans to do if certain conditions are met.
• Each risk should also include a closure criteria statement explaining what the organization is doing in terms of risk mitigation.

Brien Posey is a 15-time Microsoft MVP with two decades of IT experience. He has served as a lead network engineer for the U.S. Department of Defense and as a network administrator for some of the largest insurance companies in America.