Alexei Sidorenko[1] asked “what should an awesome risk report look like?” It’s an excellent question.
He wisely says:
If we wanted to really make a difference to decision makers we would switch from risk reporting to risk-adjusted performance reporting instead. Risk managers always have a choice: generate own risk reports or use the outputs of risk analysis to improve existing performance and management reports instead. To me the choice is clear. Integrating risk information into existing management reporting is the future.
I think about it this way.
- Leaders of the organization in management and on the board work towards enterprise objectives (or goals). In most organizations, their compensation depends largely on that, and the success of the organization is measured based on the achievement of those goals and objectives.
- Investors and analysts base their investment decisions (and whether they will vote to re-elect board members) on the published enterprise objectives, goals, plans, forecasts, outlook, etc.
- Leaders need to know whether they are likely to achieve those goals and objectives, and what might affect their achievement: risks and opportunities, ‘what might happen’.
- Management reporting should be based on an appreciation of all the risks to each enterprise objective.
- They need to be able to…
