Risk and control reporting

In the previous section, we reviewed the importance of risk monitoring and how it can impact an organization’s resilience toward malicious attacks. In this section, we will review how those monitored risks and metrics can be best reported to the management team. Different organizations choose different mechanisms to report on risks and controls. Some are okay with sending a brief executive summary, while others need to elaborate with reports and dashboards. There are no right or wrong ways to present these risks to senior management; however, the risk practitioner, as well as the business owner, should tailor the reports and reporting mechanism per the audience. Would it really make any sense to report the number of phishing attempts in the past month to the head of physical security?

Here are some key aspects the risk practitioner should keep in mind while reporting:

• Audience: Who is the right audience for the report?
• Actionability...