Board reporting
Risk Management → Reports
Five views of the same register, each answering a different question. Nothing here is authored — every number is derived from the register, the engagements and the treatment record, so a report cannot disagree with the pages it is built from.
Board profile
The view to take to a risk committee.
Board pack
Board Profile → Board pack downloads the same picture as a document, in PDF or Word, in English or Arabic. It covers exposure by level (now and before controls), the top ten risks, appetite headroom per category with open breaches, key risk indicators with the reds named, treatment, accepted risks and those expiring within 60 days, and review discipline. Levels follow your risk methodology. It is rebuilt from live data at every download, and each download is recorded in the audit log.
The top ten are ranked by residual score — what is left after controls — and fall back to the inherent score for any risk that has never been assessed. A risk reduced from 20 to 6 by controls that work is not one of your top risks, and a risk nobody has looked at yet does not drop to the bottom for being unexamined. Both scores are shown side by side so you can see which is which.
The target column is the score the risk is being worked towards. It is set per risk on the register, and the comparative view is where you see how many risks are meeting it.
The trend arrow compares the last two assessments of that risk, and only assessments from engagements that have closed. An assessment sitting in an open engagement is somebody's work in progress: it has not been reviewed and it has not been written back to the register, so it does not move the arrow. A risk assessed only once shows as new rather than stable — one reading is not a trend.
Treatments overdue counts a treatment as overdue when it is past its due
date, or when it has already been flipped to the overdue status by the
overnight job. Both, because they are the same thing seen a day apart.
A risk with no residual has not been assessed. The board profile shows a dash, the heat map leaves it out of the residual distribution, and the average residual is the average of the risks that have one. None of these are claims that the exposure is nil.
Heat map
The 5×5 matrix, twice: inherent and residual. Switching between them is the fastest way to show a committee what the control environment is actually doing — the inherent map is where the risks start, the residual map is where they are now, and the distance between the two is the argument for the programme's budget.
Trends
Average assessed and residual scores by month across the period, plus a per-risk movement list. Driven by engagement assessments, so a period with no closed engagement is a flat line rather than an improvement.
Comparative
Inherent against residual for every risk, with the percentage reduction and whether the risk is meeting its target. Risks with no target set are counted separately — a register where most risks have no target will say so here.
Engagement
The report for a single engagement: what was in scope, what each risk was assessed at, what was concluded, and which risks sat above the engagement's appetite threshold.
Export
Export Full Register produces an Excel workbook of the register as it stands. It is a point-in-time extract, not a live link.
Permissions
| Action | Minimum role |
|---|---|
| View any report | Viewer |
| Export the register | Analyst |