how to write a risk management report

Risk Management Report Sample

March 20, 2024

A risk management report sample typically provides a structured document that outlines the results and summary of risk management activities within an organization.

It includes details on the risk assessment process , identification of potential risks , analysis of the likelihood and impact of these risks, and the measures taken to mitigate them.

For instance, a risk management report template provides key oversight of an organization’s risk management reporting functions and might include reporting on the status of key risks, actions taken, and an overview of the risk profile.

Another example includes a sample risk analysis report , which would typically reflect the results of risk factor identification and assessment, quantification of risks, and contingency analysis.

These reports are essential for communicating with stakeholders, like a board of directors, about the current risk landscape and the steps the organization is taking to manage risk effectively .

Risk management reports are essential for businesses of all sizes, providing a structured approach to identify, evaluate, and address risks through strategies like risk avoidance and mitigation.

These reports include key elements like risk identification methods , impact assessment techniques , and reporting with monitoring to enhance decision-making processes .

By exploring sample risk assessment templates and case studies, organizations can gain valuable insights into effective risk management practices to strengthen their resilience in handling uncertainties and emerging threats.

Key Takeaways

• In-depth risk assessment methodologies .
• Comprehensive risk mitigation strategies .
• Detailed risk impact analysis .
• Effective risk monitoring techniques .
• Clear and concise risk reporting formats .

Importance of Risk Management Reports

Risk management reports play a pivotal role in organizations by outlining risk mitigation strategies and providing support for decision-making processes.

These reports offer a structured approach to identifying, evaluating, and addressing potential risks that could impact the business.

Risk Mitigation Strategies

Effective risk mitigation strategies are essential components of thorough risk management reports for businesses of all sizes.

These strategies aim to identify, assess, and prioritize risks , followed by implementing measures to minimize, monitor, and control them.

Common risk mitigation strategies include risk avoidance , where the business chooses not to engage in high-risk activities, risk reduction through implementing safety measures , risk transfer by purchasing insurance, and risk acceptance for risks deemed unavoidable or too costly to mitigate.

Decision-making Support

In the domain of business operations, well-crafted risk management reports play an essential role in providing decision-making support by offering valuable insights into potential threats and opportunities .

These reports enable stakeholders to make informed decisions that can help mitigate risks and capitalize on emerging possibilities.

By presenting data in a structured manner, risk management reports aid in understanding the current risk landscape and assist in prioritizing actions to address these risks effectively.

The table below illustrates the types of decision-making support that can be derived from thorough risk management reports .

Key Elements of a Risk Report

The key elements of a risk report include :

• Risk identification methods.
• Impact assessment techniques.
• Risk mitigation strategies.
• Reporting and monitoring.

These components collectively form the bedrock of a thorough risk management strategy , aiding organizations in understanding, addressing, and minimizing potential risks.

Risk Identification Methods

Identifying risks is a fundamental aspect of compiling a thorough risk management report . There are various methods used by organizations to identify potential risks .

One common method is the brainstorming technique , where team members come together to generate a list of possible risks based on their expertise and experience.

Another method is the use of checklists and historical data to identify risks that have occurred in similar projects or situations.

Additionally, interviews with stakeholders, conducting risk surveys, and utilizing risk assessment tools can help in identifying risks that may impact the project or organization.

Impact Assessment Techniques

Effectively evaluating the potential consequences of identified risks is crucial in developing a thorough risk management report.

Impact assessment techniques serve as valuable tools in this process, aiding in understanding the severity and implications of various risks on the organization.

Common techniques include qualitative assessments , which involve evaluating risks based on predefined criteria, and quantitative assessments , which assign numerical values to risks for better comparison.

Scenario analysis is another technique where different risk scenarios are explored to gauge their potential impact.

Sensitivity analysis helps in understanding how changes in variables can affect risk outcomes.

By utilizing these techniques, organizations can gain a holistic understanding of the potential impacts of identified risks, enabling them to make informed decisions and develop effective risk mitigation strategies .

Utilizing evaluation techniques to understand the severity and implications of identified risks is fundamental in developing effective risk mitigation strategies within a thorough risk management report .

By analyzing the potential impact of risks, organizations can proactively implement strategies to minimize the likelihood of these risks occurring or reduce their negative consequences. Below is a table outlining common risk mitigation strategies:

Reporting and Monitoring

An integral aspect of a thorough risk management report is the meticulous documentation and vigilant oversight of potential risks through exhaustive reporting and monitoring.

Reporting involves the detailed analysis and presentation of risk data, highlighting areas of concern and potential vulnerabilities.

Monitoring, on the other hand, requires continuous tracking and evaluation of identified risks to guarantee prompt responses and effective risk mitigation strategies.

By implementing robust reporting mechanisms and establishing regular monitoring practices, organizations can proactively identify, assess, and address risks before they escalate into significant threats.

This systematic approach not only enhances risk awareness but also enables informed decision-making and the timely implementation of corrective actions to safeguard business operations and objectives.

Sample Risk Assessment Template

The sample risk assessment template includes key risk factors and mitigation strategies to help organizations identify and address potential threats to their operations.

By outlining these factors and strategies, businesses can proactively manage risks and protect their assets.

Implementing a structured risk assessment template enhances decision-making processes and promotes a culture of risk awareness within the organization.

Key Risk Factors

Identifying and analyzing key risk factors is vital in developing an effective risk assessment template for thorough risk management.

Key risk factors are elements or situations that could potentially jeopardize the achievement of a project or business goal.

These factors can vary widely depending on the nature of the project or industry but commonly include financial risks , market competition, regulatory changes , and technological disruptions .

By thoroughly understanding and documenting these key risk factors , organizations can proactively plan for potential challenges , allocate resources efficiently, and implement strategies to minimize negative impacts .

Regular review and updates to the list of key risk factors are essential to make sure that risk management efforts remain relevant and effective in addressing potential threats.

Mitigation Strategies

Developing effective mitigation strategies is essential for organizations to proactively address potential risks identified in the risk assessment template.

These strategies aim to reduce the likelihood of risks occurring or minimize their impact if they materialize.

Mitigation strategies can include implementing robust security protocols, conducting regular training sessions for employees, diversifying supply chains, creating backup systems for critical operations, and establishing emergency response plans .

By identifying vulnerabilities and formulating tailored mitigation strategies , organizations can enhance their resilience against various risks.

Continuous monitoring and periodic reviews are critical to guarantee the effectiveness of these strategies and adapt them to evolving threats.

Mitigation strategies play a significant role in safeguarding organizational assets and maintaining operational continuity in the face of uncertainties.

Case Studies in Risk Management

Effective risk management hinges on the meticulous analysis and application of proven strategies in real-world scenarios. Examining case studies provides valuable insights into how organizations navigate challenges.

For example, Company X faced a supply chain disruption due to a natural disaster . By having a robust risk management plan in place, they quickly identified alternative suppliers, mitigating the impact on their operations.

In another case, Company Y encountered a cybersecurity breach that threatened sensitive data.

Through proactive risk assessment and cybersecurity measures, they were able to contain the breach and strengthen their defenses.

These real-life examples demonstrate the importance of proactive risk management and the effectiveness of implementing strategies to mitigate potential risks .

Tips for Effective Risk Reporting

To effectively report risks , it is essential to employ clear communication methods that ensure stakeholders understand the potential threats. Utilizing visual aids , such as graphs or charts, can help convey complex information in a more digestible format.

Clear Risk Communication Methods

Clear and concise risk communication is essential for effective risk reporting in any organization. When communicating risks, it’s vital to use simple language that is easily understandable by all stakeholders.

Avoid jargon and technical terms unless explaining them is necessary.

Clearly outline the nature of the risk , its potential impact, and the actions being taken to mitigate it. Utilize multiple communication channels such as emails, presentations, or reports to guarantee the message reaches all relevant parties.

Tailor the communication style to the audience, providing detailed information to management while summarizing key points for other team members.

Utilize Visual Aids

Employing visual aids is a vital approach to enhance the comprehensibility and impact of risk reporting within an organization.

Visual representations such as graphs, charts, and diagrams can simplify complex data , making it easier for stakeholders to grasp key information at a glance.

These aids can help in identifying trends, patterns, and outliers, enabling more informed decision-making processes.

When utilized effectively, visual aids not only improve the clarity of risk reports but also enhance their overall effectiveness.

It is essential to choose the right type of visual aid that aligns with the nature of the data being presented and the intended audience.

Visual aids should complement the written information, providing a visual summary that reinforces the key messages being conveyed.

Regular Stakeholder Updates

For effective risk reporting, providing regular updates to stakeholders is essential in maintaining transparency and ensuring informed decision-making within the organization.

Regular stakeholder updates help in keeping all involved parties informed about the current status of risks, mitigation strategies, and any emerging issues that may impact the project or business.

Frequently Asked Questions

What are the common challenges faced when implementing risk management reports in an organization.

Implementing risk management reports in organizations can face challenges like data accuracy, stakeholder alignment, and resource constraints.

Ensuring consistent data collection, engaging key stakeholders, and allocating adequate resources are essential for successful implementation.

How Can Organizations Ensure That Risk Management Reports Are Effectively Communicated to All Stakeholders?

Organizations can guarantee effective communication of risk management reports to stakeholders by utilizing clear and concise language, incorporating visual aids for better comprehension, scheduling regular updates and feedback sessions, and establishing a designated communication protocol for dissemination.

What Are Some Best Practices for Continuously Monitoring and Updating Risk Management Reports?

Continuous monitoring and updating of risk management reports require regular review of data, identification of emerging risks, and collaboration among stakeholders.

Utilizing technology for real-time tracking, engaging in regular risk assessments, and fostering a culture of risk awareness are key best practices.

How Can Organizations Measure the Effectiveness of Their Risk Management Strategies Based on the Information Provided in the Reports?

Organizations can measure the effectiveness of their risk management strategies by analyzing key performance indicators , conducting regular risk evaluations, tracking incident response times, evaluating the alignment of risk strategies with business objectives, and soliciting feedback from stakeholders.

What Are Some Emerging Trends or Technologies That Are Impacting the Field of Risk Management Reporting?

Emerging trends in risk management reporting include the adoption of advanced analytics, AI, and machine learning for more accurate risk assessments .

Blockchain technology is also revolutionizing data security and transparency in risk management processes.

In summary, risk management reports play a vital role in identifying, evaluating, and mitigating potential risks within an organization.

By including key elements such as risk assessments , case studies, and effective reporting tips, businesses can better understand and manage risks to achieve their objectives.

Organizations need to prioritize risk management and utilize thorough reports to guarantee the sustainability and success of their operations.

Chris Ekai is a Risk Management expert with over 10 years of experience in the field. He has a Master’s(MSc) degree in Risk Management from University of Portsmouth and is a CPA and Finance professional. He currently works as a Content Manager at Risk Publishing, writing about Enterprise Risk Management, Business Continuity Management and Project Management.

Risk Reporting: Importance and Best Practices

Ai Risk Management

Reach out to understand more about Enterprise Risk Management, Project Management and Business Continuity.

© 2024 Risk Management

The Risk Report in Project Management

Project management is most frequently associated with the topics of cost, quality, and time. Yet, those three legs of project management are all directly impacted by risk. Risk management is crucial in all projects; whether an opportunity or threat, all risks should be identified and planned to increase the possibility of a successful outcome for a project. Project managers (PMP) conduct risk analysis work, maintain a risk watch list, and generate a risk report as part of overall risk management work.

On this page:

• Risk Report
• Purpose of a Risk Report

Basics of a Risk Report

• How a Risk Report fits into Risk Management documents

Get Your Comprehensive Guide to Risk Management

Learn how to manage risk in every project.

Risk Report PMP

The Project Management Professional (PMP)® certification exam seeks to assess one’s knowledge of all things project management, including risk management tools, activities, and documents. Depending on the industry, the type of project management methodology used, and the specific project management tools employed by an organization, there can be different levels of formal risk tools and documents used. However, there are foundational aspects of risk management that through the standards measured by Project Management Institute (PMI)’s PMP exam and their A Guide to the Project Management Body of Knowledge ( PMBOK ® Guide ), all PMP credential holders know.

Purpose of a Risk Report PMP

Searching for the difference between the risk report, risk analysis, and risk register can be frustrating. If the project manager is conducting risk analysis and maintaining a list of identified risks in the risk register, what is the need for a risk report? The answer lies in understanding stakeholders and the ongoing communications required for any project.

For example, the team members are actively using the risk register to capture risks and potential mitigation strategies for each, as they should. The risk register may end up being quite lengthy (images of small font sizes and excel files that require seemingly endless scrolling could be flashing in your mind). The CEO, a primary stakeholder, asks the project manager, “what is the status of the project’s risk? Are we at high risk for any problems?” If the project manager only shows the CEO the risk register in response, trying to convey how risk is being managed, there is a failure to communicate the overall status of risk management. The risk of only using the risk register to convey the status of risk is the stakeholders will lose confidence in the work and that can lead to a lack of support. This is where the risk report fits into the overall project management strategy – it is a risk summary reflecting the potential impacts to the budget, timeline, and deliverables which can convey key points to stakeholders.

The difference between a risk register and a risk report is the register is an ongoing document used throughout the project to make informed risk management decisions whereas the risk report is a snapshot of risk management work in a given moment.

By definition, a risk report is a communication tool within risk management. The report should be clear, concise, and indicate actions taken, preparation for other risk-related actions, and any inputs needed by stakeholders to ensure continuous risk management support.

When to Create the Report

In the context of formal traditional (waterfall) project management, a risk report is created during the Identify Risk process. Then the report is updated during the processes of :

• Perform Qualitative Risk Analysis
• Perform Quantitative Risk Analysis
• Plan Risk Responses
• Implement Risk Responses
• Monitor Risks

From a “risk report PMP” lens, that is the strict timing of creating and updating the risk report which is the basis of related PMP certification exam questions. However, a project manager should strive to understand the culture of the business and the needs of critical stakeholders, which can influence when a risk report is needed. It would not behoove a project manager to reply to the inquiry of “what is the status of our risk?” with a reply of “we are not at the point where I update the risk report, so you need to wait to find out.” Factors to consider for the timing of risk reports:

• The needs of the most influential stakeholders
• The results of the risk watch list work that indicate significant changes in risk
• Following a reporting schedule to manage the time needed for reporting
• Maintaining consistent communication with the team and with stakeholders on risk activities

When considering the timing of risk reports, aim to be consistent and timely versus trying to follow an inflexible schedule.

What to Include in the Report

The type of project, the project management methodology practiced, the project management standards of the business, and the scope of the project will all influence the level of detail and content of a risk report. Most commonly, these information types are included in a risk report:

• overall project risk sources
• overall project risk status (e.g. high, medium, low)
• number of identified risks, labeled as threats or opportunities
• distribution of risks across risk categories
• risk trends across risk categories
• identified risks that have occurred and what action taken
• changes in how risks are assessed for the probability of occurrence
• financial impact of occurred risks
• timeline impact of occurred risks
• predicted level of overall project risk for next risk report milestone

Additionally, the inputs from risk analysis efforts will shape risk report content as will changes in the risk watch list.

Studying for the PMP Exam?

How to create a Risk Report

There is not a single perfect risk report template. As indicated by the range of information that can be included in a report, so too does the report vary by project. What should not vary is the report itself within a given project. It is important that within a project, the risk reports are consistent in content and approach. The team and stakeholders should know what to expect in the report and what information will be found in it.

From just one risk management consulting firm, they show five different risk reports as examples of the range of options.

Where possible, leverage existing proven templates and software to create a report that is accurate and easy to maintain. If the project manager can influence existing templates or is in the situation of creating a new risk report, use these guidelines:

• Does the report provide the information needed to make decisions (versus showing a bunch of colored graphs for the sake of having a graph)?
• Does the report convey how risk is being managed (versus just reporting status)?
• Is the report giving equal attention to all risks (versus focusing on the highest potential risks)?
• Is the report data connected to risk management activities (versus functioning as a standalone document)?
• Do report updates require excessive time from the team (versus the use of automation or software tools to minimize time and maximize accuracy)?

As the project manager builds out the template for a project’s risk report, know it can leverage a combination of summary text, dashboards, heat maps, and/or matrixes, but what is most important is the value it brings to the overall risk management work.

How Risk Report fits into Risk Management documents

The risk report does not replace other risk management documents. It serves a specific purpose within the overall project risk management efforts.

The risk register document has information about individual risks, assessment, and status. It is an input into the risk report which conveys the overall risk status at a given moment. Both are part of the overall risk management plan.

A risk report is an indicator of the performance of the overall risk management work. Project managers should use the risk report to convey risk status to the team and to provide information to stakeholders to inform risk management decisions.

Upcoming PMP Certification Training – Live & Online Classes

• Megan Bell #molongui-disabled-link What is a Project Schedule Network Diagram?
• Megan Bell #molongui-disabled-link Scheduling Methodology: Build & Control Your Project Schedule
• Megan Bell #molongui-disabled-link Schedule Baseline: How to Create, Use, and Optimize
• Megan Bell #molongui-disabled-link How to Use Agile in Project Management as a PMP® Credential Holder

Popular Courses

PMP Exam Preparation

PMI-ACP Exam Preparation

Lean Six Sigma Green Belt Training

CBAP Exam Preparation

Corporate Training

Project Management Training

Agile Training

Read Our Blog

Press Release

Connect With Us

PMI, PMBOK, PMP, CAPM, PMI-ACP, PMI-RMP, PMI-SP, PMI-PBA, The PMI TALENT TRIANGLE and the PMI Talent Triangle logo, and the PMI Authorized Training Partner logo are registered marks of the Project Management Institute, Inc. | PMI ATP Provider ID #3348 | ITIL ® is a registered trademark of AXELOS Limited. The Swirl logo™ is a trademark of AXELOS Limited | IIBA ® , BABOK ® Guide and Business Analysis Body of Knowledge ® are registered trademarks owned by International Institute of Business Analysis. CBAP ® , CCBA ® , IIBA ® -AAC, IIBA ® -CBDA, and ECBA™ are registered certification marks owned by International Institute of Business Analysis. | BRMP ® is a registered trademark of Business Relationship Management Institute.

The Project Management Guide

No nonsense Project Management tips, tricks, strategies and shortcuts

How To Write A Good Risk Statement

Risks should be written down as a Risk Statement and logged in the Risk Log. They should be reviewed regularly to ensure they are being managed and communicated effectively.

It is essential to write clear risk statements in order to understand them, assess their importance, and communicate them to stakeholders and people working on the project.

The Risk Statement helps everyone understand and prioritise the risks on the project. The Project Manager will focus on communicating and managing the highest priority risks.

Risk Statement is a communication tool

The Risk Statement is used to communicate the risk to the relevant stakeholders, if it is of sufficient importance. It should state clearly:

• What the risk is
• What the trigger is for the risk ie what will cause it to happen
• What the impact of the risk is if it happens

In addition to this each risk should be:

• One single risk
• Understandable to the audience intended ie it should be jargon free or non-technical if targeted at executives

The key point is that if people understand what the risk is they can then help to mitigate it.

Risk Statement format

Using a standard format for writing Risk Statements helps to ensure all of the essential elements are covered. For example:

“If <event X> happens then there is a risk <consequence> that the project could be impacted in <Y way> ”

Example 1: If the new servers are not delivered by 10 th February, then there is a risk that the commissioning engineers will not be able to start on the 11 th and so there could be a delay to the project timeline.

Broken down:  If [EVENT] the new servers are not delivered by 10 th February, then there is a risk that the [CONSEQUENCE] commissioning engineers will not be able to start on the 11 th and so there could be a [IMPACT] delay to the project timeline

Example 2: If the new HR software is not delivered by 1 st May, then we may have to extend the contracts for the HR software testing team meaning there would be an increase in budget required.

Broken down:  If [EVENT] the new HR software is not delivered by 1 st May, then we may have to [CONSEQUENCE] extend the contracts for the HR software testing team meaning there would be an [IMPACT] increase in budget required.

Prioritising Risks

Once the Risk Statement has been completed then its likelihood and impact can be assessed and scored. The Project Manager can then decide how important the risk is and who needs to know about it and assist with its mitigation.

See the article: How to rate project risks for likelihood and impact .

Back to Help with starting and running projects

Become A Better Project Manager

Get expert Project Management tips directly to your InBox by subscribing to The Project Management Guide blog.

• How it works
• Case studies

How to create standout risk reports that demonstrate the real value of Risk

Risk management - and the risk team itself - can gain greater traction with senior leaders and the board if risk reports centre around a few key principles; know your audience, make it relevant, hone the narrative, visualise your risk, and provide a future outlook. From examples contributed by our membership, we've aggregated the core components that make up effective risk reporting.

As risk leaders look for a way to advance their risk reporting frameworks and better engage the business on risk, the next step for many risk teams is finding a way to add demonstrable value to the business through reporting.

With this in mind, we have distilled key insights shared by risk leaders in our membership to produce this article. It provides a high-level overview as to why risk reporting is important, how risk teams can effectively report risk to senior leaders, and how businesses report risks to the wider world.

It also underlines the importance of evolving your risk reporting process so that it remains relevant and continues to meet the needs of business leaders, as well as the wider pool of external stakeholders who keep a watchful eye over how the organisation is managing its risks. 

1. What is risk reporting and why is it important?

A. risk reporting definition.

It is not enough for the risk team to identify threats and opportunities to the business and monitor them in a silo. Ultimately, the purpose of the risk management function is to support the rest of the business to manage its risks better. This is where risk reporting comes in.

Through the risk reporting line, risk teams typically feed information up to the audit and risk committee and/or the executive board to raise awareness of any new risks to the business, provide updates on the status of existing risks, and potentially get senior leaders' buy-in for risk projects (read more on common risk reporting lines ).

With this information, senior leaders (especially risk owners) can cascade responsibility for the steps that need to be taken to the relevant parts of the business. For instance, if the risk team had determined that health and safety risks have become more probable based on indicators, the risk owner (with the support of the risk function) can work with parts of the business to strengthen controls and mitigate the potential risk.

b.  What's the difference between internal and external risk reporting?

Reporting to who?

• Internal risk reporting is delivered by the risk team to their direct report - which in some cases is the board itself.
• External risk reporting is conducted by the business on a yearly basis via the organisation's annual report. This lets external stakeholders, such as investors, know what risks the business is monitoring and how they are being managed.

What frequency?

• Internal risk reporting tends to happen on a more frequent basis for the business to be agile enough to anticipate and respond to risks.
• External risk reporting is less frequent, as it's produced for the company annual report.

How does the content differ?

• Internal risk reporting has greater depth than what is covered in a typical risk section of a company annual report. With more detail and no mandated requirements, the report is tailored to the needs of the business, focusing on action points.
• External risk reporting is a more brief, high-level overview of the risks the business is focusing on. The contents is often dictated by the mandates of the jurisdiction the company is in. These require listed businesses to include certain information in their reports (e.g. since April 2022, the UK has required listed businesses to report on their climate-related financial disclosures).

c. When and how often should companies generate risk reports?

According to two benchmark studies we've conducted recently: 

• It is most common for risk reports to be generated quarterly, regardless of the company's risk operating model . This is because, for most companies, the CRO or direct report of the risk team (for example, the chief financial officer) reports to the audit and risk committee (ARC) or the board once a quarter. This places a requirement on the centralised or decentralised group risk function to review their risk registers, indicators and other data sources and prepare their report on a regular basis.
• When risk teams report directly to the board, 48% of businesses generate and deliver risk reports on a biannual basis.
• 69% of companies report quarterly into the audit and risk committee.

d. How can risk reporting add value to a business?

It is one thing to improve the quality of different aspects of your risk reporting,  but the key question risk leaders are asking themselves is, how can risk reporting add value to the business? Having the answer to this question is what will get you noticed by senior stakeholders and business decision-makers.

2. How do risk teams report on risk to the business?

A. most common risk reporting lines used by businesses.

A typical risk reporting structure at most businesses will see the risk team report information up to senior management and the board. However, the risk reporting lines that sit beneath this broad structure tend to differ from company to company.

Based on research we have conducted with a range of practising risk managers across multiple sectors in our global benchmark on risk operating models , two risk reporting lines stand out:

• For companies with a 'head of risk' the most common reporting line is to the organisation's chief financial officer (CFO), who would be responsible for providing feedback on risk at board-level management committees.
• For companies that have a chief risk officer (CRO), approximately half of them have a direct reporting line into the CEO and the board on risk. This is a particular trend amongst heavily regulated organisations, such as financial institutions.

While these two reporting lines stand out from the rest, the graphic below highlights the diversity of risk reporting lines currently being used by organisations - many heads of risk report into general counsel, while the number of risk teams who report into a chief strategy officer is on the rise, indicating a movement towards integrating risk with strategy at many organisations.

There are many variables at play that may influence the risk reporting lines certain cohorts of businesses have in place. Companies within particular sectors may be more likely to have a specific type of risk reporting line, while geography is also a factor - for instance, European-based companies tend to have a CRO who reports into the board. Download the benchmark for more trends and analysis.

b. Create an effective risk reporting template

In order to standardise risk reporting and ensure consistency, most risk teams use a template to structure their risk reporting. When preparing their risk reporting template, risk leaders should consider who the audience will be and factor this in when deciding what details (and how much) to include.

If the answer is a member (or members) of the executive committee, several of whom may be risk owners, you may want to include more practical information to help them understand how to manage these risks better. However, if the report is going to the board, it may be better to keep information high level so that they are not overwhelmed with the specifics and are more likely to engage.

Our Risk reporting to the ARC and board benchmark  highlights divergences between the reports delivered to these two entities - for example:

• 55% of those contributing to the benchmark agree that ARC and board reports required different content.
• 30% of companies comment that their board reports are more strategic, while 20% note that ARC reports focus more on the short-term impact of risks.

What almost all risk leaders agree on is that risk reporting should be used to anticipate and answer questions before the audience asks them - this is a key part of building trust with the board. How do you get buy-in from the board and ARC ?

So, what might you include in your risk reporting template?

Risk reporting models for the ARC and board

This analysis takes a deep-dive into the key reporting models used by over 50 multinational organisations using data from our benchmark. Download here .

c. Source information by using the right indicators

According to risk leaders, the main challenge when it comes to sourcing data for your risk report is identifying a single source of truth, especially if there are multiple legacy systems to combine and different processes across the business for collecting risk information. The latter is a particular obstacle for large, multinational organisations with a decentralised governance structure.

Ultimately, to have confidence in your risk reporting, you need to have confidence in your key risk indicators (KRIs). Many risk leaders define a set of relevant and manageable KRIs by adopting a quality-over-quantity mindset, focusing on indicators that i) actually matter to the organisation and ii) are not too complex to monitor and update regularly.

To make these KRIs reliable, it is important to establish clear ownership for gathering and inputting information. In most cases, this will mean risk owners taking responsibility for their risk registers and checking that tasks have been completed consistently and at the right time. Many risk teams also remain on hand to support risk owners and challenge the data provided when necessary.

In addition, indicators are most useful when they have a dual purpose: to monitor an increase (or decrease) in the likelihood of any given risk, and provide an insight into the potential impact and appetite of the risk.

Connecting your suite of indicators to risk appetite will help to keep the threat and opportunity aspects of risk in balance. While it is vital to wave the red flag to executives and the board when too much risk is being taken, not taking enough risk should also be highlighted in risk reports.

d. Engage stakeholders with visual risk reporting

When preparing a risk report, risk teams have to consider what will engage senior leaders - an overabundance of narrative and text, or visuals that communicate ideas simply and efficiently . 

For most companies, a visual representation of how the business' principal/material risks are developing - most commonly displayed in the form of a heatmap - is the preferred method. But risk leaders at organisations in our network are taking their risk reporting to the next level with their visualisations.

e. Get buy-in from the board and ARC

While using visuals is one effective method to boost engagement from senior leaders during the risk reporting process, there are many other ways to get buy-in from the board and ARC that risk leaders in our membership are implementing. 

Firstly, it's crucial to tell a story during risk reporting and provide context to your audience: don't just tell them what is happening, but why it is happening. For instance, one risk leader in the network uses a visual moodboard of risks to tie the business' principal/material risks to events developing in the organisation's external environment:

Some risk teams are working with guest contributors to add credibility and weight to their risk reporting. Using a subject matter expert voice from within the business to add credence to your argument - whether it be a quote in a risk report or attending a meeting with the board in person - can get senior leaders to take notice and place more importance on suggested actions.

Moreover, deviating from the status quo every so often can prove effective so that the content of your risk reporting doesn't become stale or boring - if business leaders feel like risk reporting is a repetitive process that rarely develops or changes, this may cause certain risks to be overlooked.

Ultimately, engaging with executives and the board requires you to know your audience: what concerns them, and how can risk management impact this in a positive way. If the board cares about the long-term success and viability of the business, framing risk through a strategic lens is a good way to get their attention.

f. Link risk to strategy and objectives

Risk leaders in the network have shared, from experience, that compiling a risk report from the default position of "what could go wrong" can leave you with a list of risks that feels disconnected from the business itself. Instead, asking first "what matters to the business" can help you to achieve greater stakeholder engagement from the outset.

In order to focus on what matters to the business, it can help to overlay risks onto the company's strategic objectives - in other words, how will risks impact, for better or worse, the ability of the business to achieve its goals? An easy way to visualise this relationship is employing a Venn diagram: 

Where there are overlaps between risks and objectives, you can signal to business leaders that threats or opportunities should be prioritised.  Furthermore, drawing a clear link between strategy in your reporting can help to embed risk within the strategic mindset of the business and get Risk a regular role in strategy conversations. While it is useful for the risk team to highlight areas where risks may affect the business' existing strategy, the next evolution of this is for Risk to guide the development of new goals and strategies. Once again, this will allow risk management to add value.

g. Create a radar of risks for emerging risk reporting

Outer layer

Emerging threats and opportunities the business should be aware of, even if no actions are required at this point.

Middle ring

Contains what some risk leaders refer to as 'Tier 2 risks' - those risks that the executive leadership team (including risk owners) should be monitoring.

Innermost circle

'Tier 1 risks' - the priority risks that need to be escalated to the board.

a. What are the key features of a risk section in an annual report?

Most businesses, especially listed companies in jurisdictions where there are specific reporting requirements, will include a risk section in their annual report, although the content of these sections, as well as the amount of detail given, varies between companies.

Using data from the Risk Reporting Comparison Tool , there are some clear trends around the risk section of an annual report:

• On average the risk section of a company's annual report takes up about 5% of the overall document , highlighting that it is not an insignificant part of the overall reporting process.
• Rounded to the nearest whole number, the average number of principal / material risks shared by businesses is 12; usually, a company's list of principal or material risks only varies slightly year-on-year.
• Most risk sections will include reference to the trend of individual risks (65%) - in other words, is the risk increasing, stable or decreasing - and how each risk links to strategy (56%).
• Although the majority of companies do not categorise principal/material risks as part of their annual report, a significant number of businesses (43%) do organise their risks under a few key headings (e.g. financial, operational, strategic etc.).
• Just 16% of companies mention their appetite for each risk in their annual reporting and even fewer (5%) refer to opportunities in the risk section.
• In terms of emerging risks, 35% of companies list these specifically in the risk section of their annual report, although a much larger proportion will acknowledge that they conduct horizon scanning for threats and opportunities to the business.

These figures are based on data in the Risk Reporting Comparison Tool, as of February 2023.

b. What are the top principal and emerging risks companies currently report?

Unsurprisingly, the leading principal/material risks reported by companies vary by sector. For example, while Cyber Security and Digital Transformation are top risks for computer software companies, businesses in other industries are focusing more on other kinds of threats and opportunities. 

Here are a few trends based on a cross-sector analysis of companies across all industries based on data from our Risk Reporting Comparison Tool :

• Talent was the most reported risk category in 2022 and 2023, with the number of mentions increasing year on year.
• Climate Change and Environment and Sustainability account for over 7% of principal/material risks reported in company annual reports. 
• Cyber Security is the second-most reported risk category, accounting for 6.49% of principal/material risks reported in 2023 (compared to 6.13% in 2022).

As for emerging risks, Regulation remains the most mentioned emerging risk , accounting for almost 9% of the emerging risks mentioned in external reports. 

Going into 2024, we've noticed a significant rise in geopolitical emerging risks, with trade disputes, East-West divide, Russia-Ukraine war, East-West divide being cited by companies as examples of those risks.

c. What do companies include in TCFD disclosures?

The purpose and content of annual reports continue to evolve as companies adapt to changing regulations and investor demands.

In April 2022, it became a requirement for FTSE-listed businesses in the UK to include a TCFD disclosure in their annual report. It seems likely that the requirement will soon be imposed on listed businesses in other markets, which raises the question: what should you include in your TCFD disclosure?

Based on data from our TCFD Reporting Comparison Tool , trends are starting to emerge:

• The most common aspects of a TCFD disclosure are risks (and opportunities), targets and scenarios, all of which are covered in over 75% of the reports we have analysed.
• While the different climate-related risks are essentially split into two categories - physical and transition - there is a wide variety of scenarios and targets that businesses are reporting against. For example, many companies have a short-term emissions target to 2025, though some organisations also have set goals (e.g. net-zero emissions) up to 2030, 2040 and even 2050.

4. How do you maintain relevant and effective risk reporting?

A. ensure the risk reporting process is fit for purpose.

In order to validate your risk reporting approach and identify areas for improvement, it's worth considering how (and where) you can build in opportunities for feedback into your risk report. This is especially important when it comes to engaging the board - is there a communication channel in place for them to ask the risk team questions if they are confused, or provide a healthy amount of challenge if they disagree with aspects of the risk report?

Ultimately, the only way you can be sure that your risk reporting process is fit for purpose is to understand business leaders' response to it. Below we have highlighted some key questions a risk team may want to ask themselves before delivering their latest risk report. 

b. Monitor the effectiveness of risk reports

Given the process-driven nature of risk reporting, it's easy to understand how this activity can become a repetitive exercise that disengages people around the business - especially leaders to whom risk reports are presented. For this reason, it's important to observe how effective your latest risk report is, in terms of provoking action and contributing to decision making.

The simplest way to test whether your risk report is actually having a meaningful impact on the business is to include key follow-on actions and monitor whether the organisation is putting these into motion from the top-down. If not, and in the absence of any communication as to why, it's evident that risk reporting has become a token exercise that senior leaders are all too willing to ignore.”

Risk Leadership Network member

Of course, these actions may be a result of disengagement, lack of awareness or lack of motivation at the business unit level - in this case, it's important for the risk team to work together with risk owners and champions to cultivate the right kind of culture.

One way to gauge how risk reports resonate with senior leads is to push for a more active role in presenting this information . While handing an executive and/or member of the board a document might not get much of a response, presenting your risk report in person will enable you to engage directly with the intended audience and discover what does, and does not, resonate with them.

This is a popular option: according to our Risk reporting to the ARC and board benchmark, 80% of businesses state that their most senior risk resources presents both the board and ARC report entirely face-to-face or with some element of face-to-face interaction.

c. Update your risk reporting template

If you want the board, ARC and other leaders around the business to continue engaging with your risk reports, it's vital to keep reporting fresh and add new layers of insight over time. You don't want to overwhelm the business by presenting a vastly expanded risk report with too much detail - however, incremental shifts in reporting may be greeted with a warmer response.

Risk leaders across the network are taking steps to update and advance their risk reporting process by incorporating elements such as appetite and culture if these are not already being reported on separately.

Interestingly, less than 50% of the companies in our Risk reporting to the ARC and board benchmark have risk appetite as a standalone section or agenda item in their report, suggesting that there is an opportunity for companies to add this particular lens to their risk reporting process. 

According to one of our members who does include appetite in their report, they feature a colour-coded dashboard that links risk appetite to the business' key risk indicators.

If parts of this dashboard have turned red, this means that certain risks are starting to push either the upper or lower limit of risk appetite, constituting a threat to the business that must be addressed. This is designed to trigger action from senior leaders.

On the matter of culture, risk leaders note that persistent reporting on risk culture provides a record of an organisation's work in this area, signalling how the business has already evolved and ways for it to develop further. By at least including a reference to culture in your risk reporting, you may be able to prompt better discussion about the topic with the wider business. 

More on risk reporting at Risk Leadership Network

Risk Leadership Network empowers risk leaders to implement better risk practice by facilitating practical knowledge sharing between peers. Through bespoke and tailored network assistance, we facilitate the specific collaborations that enable our members to solve challenges quickly. 

This guide is an overview of some of the key lessons shared by risk leaders in our network on risk reporting. There are far more case studies, templates, tools and bespoke opportunities to collaborate with practising risk leaders with membership to Risk Leadership Network . Meanwhile, here are all the resources and opportunities to get involved mentioned in this article.

General resources/opportunities to get involved:

Internal risk reporting:

External risk reporting:

Related posts you may be interested in

Reporting risks in smarter ways - our Risk Reporting Comparison Tool

Communicating the status of material risks: three common approaches and three alternatives

Reporting risk in a smart way: risk reporting comparison tool, get new posts by email.

Risk Management Report Template

Identify and describe the risks involved, estimate the impact of each risk, categorize the risks.

• 1 Technical Risks
• 2 Financial Risks
• 3 Operational Risks
• 4 Legal Risks
• 5 Market Risks

Approval: Categorization of Risks

• Categorize the risks Will be submitted

Determine the likelihood of occurrence of each risk

• 1 Very High

Conduct a risk assessment

Develop risk mitigation strategies, implementation of risk mitigation strategies, approval: risk mitigation strategies.

• Develop risk mitigation strategies Will be submitted
• Implementation of risk mitigation strategies Will be submitted

Monitor and control risks on a regular basis

Update the risk register, conduct a risk review meeting, approval: risk review meeting.

• Conduct a risk review meeting Will be submitted

Prepare a draft of the risk management report

Review the draft, approval: draft review.

• Review the draft Will be submitted

Finalize the risk management report

Approval: final risk management report.

• Finalize the risk management report Will be submitted

Distribute the finalized report to all stakeholders

Schedule a meeting to discuss the report, take control of your workflows today., more templates like this.

The Essentials of Effective Project Risk Assessments

By Kate Eby | September 19, 2022

• Share on Facebook
• Share on LinkedIn

Link copied

Performing risk assessments is vital to a project’s success. We’ve gathered tips from experts on doing effective risk assessments and compiled a free, downloadable risk assessment starter kit. 

Included on this page, you’ll find details on the five primary elements of risk , a comprehensive step-by-step process for assessing risk , tips on creating a risk assessment report , and editable templates and checklists to help you perform your own risk assessments.

What Is a Project Risk Assessment?

A project risk assessment is a formal effort to identify and analyze risks that a project faces. First, teams identify all possible project risks. Next, they determine the likelihood and potential impact of each risk.

During a project risk assessment, teams analyze both positive and negative risks. Negative risks are events that can derail a project or significantly hurt its chances of success. Negative risks become more dangerous when teams haven’t identified them or created a plan to deal with them.

A project risk assessment also looks at positive risks. Also called opportunities, positive risks are events that stand to benefit the project or organization. Your project team should assess those risks so they can seize on opportunities when they arise.

Your team will want to perform a project risk assessment before the project begins. They should also continually monitor for risks and update the assessment throughout the life of the project.

Some experts use the term project risk analysis to describe a project risk assessment. However, a risk analysis typically refers to the more detailed analysis of a single risk within your broader risk assessment. For expert tips and information, see this comprehensive guide to performing a project risk analysis. 

Project risk assessments are an important part of project risk management. Learn more from experts about best practices in this article on project risk management . For even more tips and resources, see this guide to creating a project risk management plan .

How Do You Assess Risk in a Project?

Teams begin project risk assessments by brainstorming possible project risks. Avoid missing important risks by reviewing events from similar past projects. Finally, analyze each risk to understand its time frame, probability, factors, and impact.  

Your team should also gather input from stakeholders and others who might have thoughts on possible risks. 

In general terms, consider these five important elements when analyzing risks:

• Risk Event: Identify circumstances or events that might have an impact on your project. 
• Risk Time Frame: Determine when these events are most likely to happen. This might mean when they happen in the lifecycle of a project or during a sales season or calendar year. 
• Probability: Estimate the likelihood of an event happening. 
• Impact: Determine the impact on the project and your organization if the event happens. 
• Factors: Determine the events that might happen before a risk event or that might trigger the event.

Project Risk Assessment Tools

Project leaders can use various tools and methodologies to help measure risks. One option is a failure mode and effects analysis. Other options include a finite element analysis or a factor analysis and information risk.

These are some common risk assessment tools:

• Process Steps: Identify all steps in a process.
• Potential Problems: Identify what could go wrong with each step.
• Problem Sources: Identify the causes of the problem.
• Potential Consequences: Identify the consequences of the problem or failure.
• Solutions: Identify ways to prevent the problem from happening.
• Finite Element Analysis (FEA): This is a computerized method for simulating and analyzing the forces on a structure and the ways that a structure could break. The method can account for many, sometimes thousands, of elements. Computer analysis then determines how each of those elements works and how often the elements won’t work. The analysis for each element is then added together to determine all possible failures and the rate of failure for the entire product.
• Factor Analysis of Information Risk (FAIR): This framework helps teams analyze risks to information data or cybersecurity risk.

How to Conduct a Project Risk Assessment

The project manager and team members will want to continually perform risk assessments for a project. Doing good risk assessments involves a number of steps. These steps include identifying all possible risks and assessing the probability of each.

Most importantly, team members must fully explore and assess all possible risks, including risks that at first might not be obvious.

“The best thing that a risk assessment process can do for any project, over time, is to be a way of bringing unrecognized assumptions to light,” says Mike Wills , a certified mentor and coach and an assistant professor at Embry-Riddle Aeronautical University’s College of Business. “We carry so many assumptions without realizing how they constrain our thinking.”

Steps in a Project Risk Assessment

Experts recommend several important steps in an effective project risk assessment. These steps include identifying potential risks, assessing their possible impact, and formulating a plan to prevent or respond to those risks.

Here are 10 important steps in a project risk assessment:

Step 1: Identify Potential Risks

Bring your team together to identify all potential risks to your project. Here are some common ways to help identify risks, with tips from experts:

• Review Documents: Review all documents associated with the project.
• Consider Industry-Specific Risks: Use risk prompt lists for your industry. Risk prompt lists are broad categories of risks, such as environmental or legal, that can occur in a project.
• Revisit Previous Projects: Use checklists from similar projects your organization has done in the past. 

• “What I like to do for specific types of projects is put together a checklist, a taxonomy of old risks that you've identified in other projects from lessons learned,” says Wendy Romeu, President and CEO of Alluvionic . “Say you have a software development program. You would pull up your template that includes all the risks that you realized in other projects and go through that list of questions. Then you would ask: ‘Do these risks apply to our project?’ That's kind of a starting point.” “You do that with your core project team,” Romeu says, “and it gets their juices flowing.” Learn more about properly assessing lessons learned at the end of a project in this comprehensive guide to project management lessons learned .
• Consult Experts: Conduct interviews with experts within and, in some cases, outside your organization.
• Brainstorm: Brainstorm ideas with your team. “The best scenario, which doesn't usually happen, is the whole team comes together and identifies the risks,” says Romeu.
• Stick to Major Risks: Don’t try to identify an unrealistic or unwieldy number of risks. “You want to identify possible risks, but you want to keep the numbers manageable,” says Wills. “The more risks you identify, the longer you spend analyzing them. And the longer you’re in analysis, the fewer decisions you make.”
• Look for Positive Risks: Identify both positive risks and negative ones. It’s easy to forget that risks aren’t all negative. There can be unexpected positive events as well. Some people call these opportunities , but in a risk assessment, experts call them positive risks. 

• “A risk is a future event that has a likelihood of occurrence and an impact,” says Alan Zucker, founding principal of Project Management Essentials , who has more than two decades of experience managing projects in Fortune 100 companies. “Risks can both be opportunities — good things — and threats. Most people, when they think about risk assessment, they always think about the negatives. I really try to stress on people to think about the opportunities as well.” Opportunities, or positive risks, might include your team doing great work on a project and a client wanting the team to do more work. Positive risks might include a project moving forward more quickly than planned or costing less money than planned. You’ll want to know how to respond in those situations, Zucker says. Learn more about project risk identification and find more tips from experts in this guide to project risk identification .

Step 2: Determine the Probability of Each Risk

After your team has identified possible risks, you will want to determine the probability of each risk happening. Your team can make educated guesses using some of the same methods it used to identify those risks.

Determine the probability of each identified risk with these tactics:

• Brainstorm with your team.
• Interview experts.
• Review similar past projects.
• Review other projects in the same industry.

Step 3: Determine the Impact of Each Risk

Your team will then determine the impact of each risk should it occur. Would the risk stop the project entirely or stop the development of a product? Or would the risk occurring have a relatively minor impact?

Assessing impact is important because if it’s a positive risk, Romeu says, “You want to make sure you’re doing the things to make it happen. Whereas if it's a high risk and a negative situation, you want to do the things to make sure it doesn't happen.”

There are two ways to measure impact: qualitative and quantitative. “Are we going to do just a qualitative risk assessment, where we're talking about the likelihood and the probability or the urgency of that risk?” asks Zucker. “Or are we going to do a quantitative risk assessment, where we're putting a dollar figure or a time figure to those risks?”

Most often, a team will analyze and measure risk based on qualitative impact. The team will analyze risk based on a qualitative description of what could happen, such as a project being delayed or failing. The team may judge that impact as significant but won’t put a dollar figure on it.

A quantitative risk assessment, on the other hand, estimates the impact in numbers, often measured in dollars or profits lost, should a risk happen. “Typically, for most projects, we don’t do a quantitative risk assessment,” Zucker says. “It’s usually when we’re doing engineering projects  or big, federal projects. That’s where we're doing the quantitative.”

Step 4: Determine the Risk Score of Each Event

Once your team assesses possible risks, along with the risk probability and impact, it’s time to determine a risk score for each potential event. This score allows your organization to understand the risks that need the most attention.

Often, teams will use a simple risk matrix to determine that risk score. Your team will assign a score based on the probability of each risk event. It will then assign a second score based on the impact that event would have on the organization. Those two figures multiplied will give you each event or risk a risk score.

Zucker says he prefers to assign the numbers 1, 5, and 10 — for low, medium, and high — to both the likelihood of an event happening and its impact. In that scenario, an event with a low likelihood of happening (level of 1) and low impact (level of 1) would have a total risk score of 1 (1 multiplied by 1). An event with a high likelihood of happening (level of 10) and a large impact (level of 10) would have a total risk score of 100.

Zucker says he prefers using those numbers because a scale as small as one to three doesn't convey the importance of high-probability and high-impact risks. “A nine doesn't feel that bad,” he says. “But if it's 100, it's like, ‘Whoa, I really need to worry about that thing.’”

While these risk matrices use numbers, they are not really quantitative. Your teams are making qualitative judgments on events and assigning a rough score. In some cases, however, teams can determine a quantitative risk score.

Your team might determine, based on past projects or other information, that an event has a 10 percent chance of happening. For example, if that event will diminish your manufacturing plant’s production capacity by 50 percent for one month, your team might determine that it will cost your company $400,000. In that case, the risk would have a risk score of $40,000.

At the same time, another event might have a 40 percent chance of happening. Your team might determine the cost to the business would be $10,000. In that case, the risk score is $4,000.

“Just simple counts start to give you a quantifiable way of looking at risk,” says Wills. “A risk that is going to delay 10 percent of your production capacity is a different kind of risk than one that will delay 50 percent of it. Because you have a number, you can gather real operational data for a week or two and see how things support the argument. You can start to compare apples to apples, not apples to fish.”

Wills adds, “Humans, being very optimistic and terrible at predicting the future, will say, ‘Oh, I don't think it'll happen very often.’ Quantitative techniques help to get you away from this gambler fallacy kind of approach. They can make or break your argument to a stakeholder that says, ‘I've looked at this, and I can explain mechanically, count by the numbers like an accountant, what's going on and what might go wrong.’”

Step 5: Understand Your Risk Tolerance

As your team considers risks, it must understand the organization’s risk tolerance. Your team should know what kinds of risks that organizational leaders and stakeholders are willing to take to see a project through.

Understanding that tolerance will also help your team decide how and where to invest time and resources in order to prevent certain negative events.

Step 6: Decide How to Prioritize Risks

Once your team has determined the risk score for each risk, it will see which potential risks need the most attention. These are risks that are high impact and that your organization will want to work hard to prevent.

“You want to attack the ones that are high impact and high likelihood first,” says Romeu. 

“Some projects are just so vital to what you do and how you do it that you cannot tolerate the risk of derailment or major failure,” says Wills. “So you're willing to spend money, time, and effort to contain that risk. On other projects, you're taking a flier. You're willing to lose a little money, lose a little effort.”

“You have to decide, based on your project, based on your organization, the markets you're in, is that an ‘oh my gosh, it's gonna keep me up every night’ kind of strategic risk? Or is it one you can deal with?” he says.

Step 7: Develop Risk Response Strategies

Once your team has assessed all possible risks and ranked them by importance, you will want to dive deeper into risk response strategies. That plan should include ways to respond to both positive and negative risks.

These are the main strategies for responding to threats or negative risks:

• Mitigate: These are actions you will take to reduce the likelihood of a risk event happening or that will reduce the impact if it does happen. “For example, if you’re building a datacenter, we might have backup power generators to mitigate the likelihood or the impact of a power loss,” says Zucker. You can learn more, including more tips from experts, about project risk mitigation .
• Avoid: If a certain action, new product, or new service carries an unacceptably high risk, you might want to avoid it entirely. 
• Transfer: The most common way that organizations transfer risk is by buying insurance. A common example is fire insurance for a building. Another is cybersecurity insurance that would cover your company in the event of a data breach. An additional option is to transfer certain risks to other companies that can do the work and assume its risks for your company. “It could be if you didn't want to have the risk of running a datacenter anymore, you transfer that risk to Jeff Bezos (Amazon Web Services) or to Google or whoever,” Zucker says.

These are the main strategies for responding to opportunities or positive risks:

• Share: Your company might partner with another company to work together on achieving an opportunity, and then share in the benefits.
• Exploit: Your company and team work hard to make sure an event happens because it will benefit your company.
• Enhance: Your company works to improve the likelihood of something happening, with the understanding that it might not happen.

These are the main strategies for responding to both threats and opportunities, or negative and positive risks:

• Accept: Your company simply accepts that a risk might happen but continues on because the benefits of the action are significant. “You're not ignoring the risks, but you're saying, ‘I can't do anything practical about them,’” says Wills. “So they're there. But I'm not going to spend gray matter driving myself crazy thinking about them.”
• Escalate: This is when a project manager sees a risk as exceptionally high, impactful, and beyond their purview. The project manager should then escalate information about the risk to company leaders. They can then help decide what needs to happen. “Some project managers seem almost fearful about communicating risks to organization leaders,” Romeu says. “It drives me nuts. It's about communicating at the right level to the right people. At the executive level, it’s about communicating what risks are happening and what the impact of those risks are. If they happen, everybody knows what the plan is. And people aren't taken by surprise.”

Step 8: Monitor Your Risk Plans

Your team will want to understand how viable your organization’s risk plans are. That means you might want to monitor how they might work or how to test them.

A common example might be all-hands desktop exercises on a disaster plan. For example, how will a hospital respond to a power failure or earthquake? It’s like a fire drill, Zucker says. “Did we have a plan? Do people know what to do when the risk event occurs?”

Step 9: Perform Risk Assessments Continually

Your team will want to continually assess risks to the project. This step should happen throughout your project, from project planning to execution to closeout. 

Zucker explains that the biggest mistake teams tend to make with project risk assessment: “People think it's a one-and-done event. They say, ‘I’ve put together my risk register, we’ve filed it into the documents that we needed to file, and I'm not worrying about it.’ I think that is probably the most common issue: that people don't keep it up. They don't think about it.”

Not thinking about how risks change and evolve throughout a project means project leaders won’t be ready for something when it happens. That’s why doing continual risk assessment as a primary part of risk management is vital, says Wills.

“Risk management is a process that should start before you start doing that activity. As you have that second dream about doing that project, start thinking about risk management,” he says. “And when you have completely retired that thing — you've shut down the business, you've pensioned everybody off, you’re clipping your coupons and working on your backstroke — that's when you're done with risk management. It's just a living, breathing, ongoing thing.”

Experts say project managers must learn to develop a sense for always assessing and monitoring risk. “As a PM, you should, in every single meeting you have, listen for risks,” Romeu says. “A technical person might say, ‘Well, this is going to be difficult because of X or Y or Z.’ That's a risk. They don't understand that's a risk, but as a PM, you should be aware of that.”

Step 10: Identify Lessons Learned

After your project is finished, your team should come together to identify the lessons learned during the project. Create a lessons learned document for future use. Include information about project risks in the discussion and the final document.

By keeping track of risks in a lessons learned document, you allow future leaders of similar projects to learn from your successes and failures. As a result, they can better understand the risks that could affect their project.

“Those lessons learned should feed back into the system — back into that original risk checklist,” Romeu says. “So the next software development project knows to look at these risks that you found.”

How to Write a Project Risk Assessment Report

Teams will often track risks in an online document that is accessible to all team members and organization leaders. Sometimes, a project manager will also create a separate project risk assessment report for top leaders or stakeholders.

Here are some tips for creating that report:

• Find an Appropriate Template for Your Organization, Industry, and Project: You can find a number of templates that will help guide you in creating a risk assessment report. Find a project risk assessment report template in our project risk assessment starter kit.
• Consider Your Audience: As you create the report, remember your audience. For example, a report for a technical team will be more detailed than a report for the CEO of your company. Some more detailed reports for project team members might include a full list of risks, which would be 100 or more. “But don't show executives that list; they will lose their mind,” says Romeu.

Project Risk Assessment Starter Kit

Download Project Risk Assessment Starter Kit

This starter kit includes a checklist on assessing possible project risks, a risk register template, a template for a risk impact matrix, a quantitative risk impact matrix, a project risk assessment report template, and a project risk response table. The kit will help your team better understand how to assess and continually monitor risks to a project.

In this kit, you’ll find: 

• A risk assessment checklist PDF document and Microsoft Word to help you identify potential risks for your project. The checklist included in the starter kit is based on a document from Alluvionic Project Management Services.
• A project risk register template for Microsoft Excel to help you identify, analyze, and track project risks.
• A project risk impact assessment matrix for Microsoft Excel to assess the probability and impact of various risks.
• A quantitative project risk impact matrix for Microsoft Excel to quantify the probability and impact of various risks. 
• A project risk assessment report template for Microsoft Excel to help you communicate your risk assessment findings and risk mitigation plans to company leadership.
• A project risk response diagram PDF document and Microsoft Word to better understand how to respond to various positive and negative risks.

Expertly Assess and Manage Project Risks with Real-Time Work Management in Smartsheet 

Empower your people to go above and beyond with a flexible platform designed to match the needs of your team — and adapt as those needs change. 

The Smartsheet platform makes it easy to plan, capture, manage, and report on work from anywhere, helping your team be more effective and get more done. Report on key metrics and get real-time visibility into work as it happens with roll-up reports, dashboards, and automated workflows built to keep your team connected and informed. 

When teams have clarity into the work getting done, there’s no telling how much more they can accomplish in the same amount of time.  Try Smartsheet for free, today.

Discover why over 90% of Fortune 100 companies trust Smartsheet to get work done.

• Unito home /
• Risk Reporting: A Definition, Tips, and Free Templates

From negotiating on salary to investing in the stock market, risk is an inherent part of the business world. You know that risk. You’ve dealt with it. But did you know you can easily communicate that to everyone? When dealing with risks that affect an entire company, you’ll need to share information about them with people in charge. Risk reports are a tool for doing that — and if you need a little support, you’ve come to the right place.

You can write a great report, even if you’d never heard of it before today. In this article, you’ll learn what they are, why you should write one, and which type is best for you. You’ll also get free templates to help you get started.

What is risk reporting? 

Risks are everywhere. If an organization wants to survive, they need to do their best to manage them — and that means knowing what they’re up against. Risk reports communicate that knowledge to leaders and stakeholders, equipping them with the information they need to make better decisions. 

A risk report doesn’t just identify risk; it also describes its potential consequences, how it’s currently managed, and whether these efforts are sufficient. 

This is important information that could affect a company’s health, its profits, or its ability to reach its goals. That’s why these reports matter, and why they need to be clear, concise, and accessible. 

Why report on risk?

Wherever they are on the corporate ladder, everyone needs to be aware of risks that could affect their projects, responsibilities, and goals.

At the leadership level, risk reports help executives and directors think strategically and make big-picture decisions about the future of their organization. Managers benefit because they can settle on tactical ways to work towards those objectives. They can then share that information with their teams, to help them understand why they’re working in a specific way, or as a prompt for new ideas.

From the C-Suite to individual contributors, risk reports give people the tools to make better decisions and see how they can contribute . Once they understand the risks they’re dealing with, they can make choices from a place of knowledge, rather than intuition or preference. 

Types of risk report

From small annoyances to existential threats, there’s risk at every level of business operations. 

Since risks can affect single projects, whole teams, or the entire company, there are different ways to document them. They cover all kinds of risks , such as financial, strategic, and operational risks.

Project risk reports 

A report on risks affecting one individual project. Examples of risks covered in these reports include rising equipment costs or a change in zoning laws that might hold back construction. 

People working on the project might log risks as they come up, which could then be compiled into a weekly or monthly write-up by a project manager. Risks in a project report would usually be specific, immediate, and tangible. Think “we can’t find enough concession staff,” not “post-pandemic labor shortages.”

Program risk

If multiple projects make up one larger program, it might make more sense to report on their risks together. For example, a school might report on all the risks to its literacy program, such as a lack of funding or parental support, instead of creating one report for each classroom’s reading workshop. 

If the risks affecting each project are similar, it could be a better use of resources to create one report that sums up threats to the program as a whole. This report could be created by gathering information from each project leader, then compiling key findings into a single document. 

In the financial industry, “portfolio risk” describes the combined risk of all investments in a portfolio. But other types of businesses make portfolio risk reports, too. In that context, a “portfolio” is all an organization’s projects and programs. 

This kind of report makes it easy to see if there are any common themes among risks affecting different areas of a business, or if they interact with each other across programs. A portfolio risk report might reveal that many different projects are having trouble finding staff, for instance. That could reveal that labor shortages aren’t an isolated problem, prompting leaders and stakeholders to consider them in a more proactive, holistic way. 

Business risk reports

Risks outlined in these reports could affect a business’s ability to operate normally, or even exist at all. A business risk report might include cover core functions like staffing, critical systems for payroll or communication, or even the premises in which the business is housed. 

These are business-wide challenges that are not specific to any one project or program, and likely wouldn’t be captured in a portfolio risk report. This report might also include emerging risks, like disruptive trends in the marketplace or among competitors, and external ones like natural disasters. 

What makes a good risk report? 

Now that you understand what it does, here’s what goes into writing one.

Here’s a breakdown of what to include for each risk: 

• A description of the risk
• Data or evidence that proves its existence (with an external link if appropriate)
• The risk’s potential impact on business goals and objectives
• How the risk is currently being managed, and whether those efforts are adequate 
• Suggestions for, or questions about, a future plan of action 

To make your report as useful as possible, follow these simple writing tips. 

• Be concise: Include too much information, and you’ll overwhelm your reader, leaving them confused about why the risk matters and how they should react. 
• Format your report so it’s easy to read: Choose a clear title, and sub-title all sections or columns. If your report is on the longer side, include a table of contents and start with an executive summary. 
• Make it timely: Non-urgent risks get ignored. Be specific when you’re describing the risk — when could these impacts come to pass? When do you need to take action?

Still feeling stuck? Try out our risk report templates for Trello , Notion , and Google Docs . 

Risky business

If you’ve made it this far, you’re well-prepared to tackle the wide world of risk reports. While there are a million dangers out there, the goal of a risk report is always the same — to share information about possible threats in a clear and engaging way. 

With the steps in this article and maybe a template or two, your reports will surely help your boss avoid all kinds of potential disasters.

The 4-Step Performance Management System (Plus Extra Tips)

Here you’ll learn everything you need to know about driving your team forward and ensuring they reach objectives through performance management.

What Is a Project Management Consultant?

When you don’t have an in-house project manager, your team is used to managing projects themselves. But sometimes you need an expert. That’s when you bring in a project management consultant.

Related articles

Unlock the Power of Sync (Ebook)

Data integration isn’t a luxury, but most existing platforms haven’t stepped up to the plate in a meaningful way. In this ebook, you’ll learn how a 2-way sync can change the game for your organization.

Asana vs. Jira: Which Is the Best Project Management Software?

Not sure which tool you should choose? Here’s our full breakdown of how each tool handles task management, how much they cost, and what they integrate with.

How To Set Up a ClickUp-Jira Integration (2 Methods)

Need to integrate ClickUp with Jira? Here’s a guide to two different methods for doing that.

Project Management, Project Planning, Templates and Advice

• #1 Mind Mapping Tool
• Collaborate Anywhere
• Stunning Presentations
• Simple Project Management
• Innovative Project Planning
• Creative Problem Solving

How to Create a Constructive Enterprise Risk Management Report?

Enterprise Risk Management (ERM) has been in the limelight for some years now; but entrepreneurs have started perceiving ERM seriously only after the blighting economic crisis.

Decision making has never been easy for organization boards. If anything goes wrong, they take the full wrath of the public and stakeholders. That is why top-level executives begin to rely on ERM. Evidence-based decision making has helped them confront many hurdles and interrogations.

From the massive amounts of accumulated risk data, smart Risk Managers filter the right ERM information for their reports so as to make clear and definite choices.

As a senior manager, or Board member you need to ask yourself, does the Risk Management team check on the quality of risk reports? Are the risk management approaches (identify, assess, mitigate and monitor risks) functioning appropriately? Are the resulting decisions aligned with the organization’s objectives? Do ERM reports aid you in improving business performance? Have the reports helped you in mitigating risks or did they fail you? These are questions you need to ask before depending on your ERM reports completely.

1. Communicate using the ‘risk’ language

A common risk language should be used across the organization to avoid any sort of miscommunication, misinterpretation or misunderstanding. Every entity of an organization should understand risks and risk terminologies.

This can be achieved by conducting enterprise-wide Risk Awareness training courses and programs.  

2. Data quality

Data quality is a matter of serious importance for every organization. It determines how informed a strategic decision you can make.

Among the major challenges of enterprises is data inaccuracy and inadequacy. They can invite immense perils, leading to immense losses. It is painful for organizations to lose information in spite of investing in high-cost IT systems, just because data inaccuracy could not be addressed. Inferior data quality is also one of the factors that pushed companies into the recent financial crisis.

Getting your data right is important even if you have to invest in expensive technology.

That said, accurate data is just not enough. It has to be integrated well all across the organization to deliver consolidated reports. Risks can be inter-linked, such that if one risk occurs in one area of the business, it can trigger other risks across the organization.

3. Clear and holistic presentation

When managers look into the ERM report, they should get a clear picture of risks and threats at first glance.

The name, subject and purpose of the report must be stated clearly. Title the fields of the report precisely, define the field titles if required, and specify the technique used to carry out un-automated calculations and actions.

4. Focus towards critical aspects of the reports

5. produce reports relevant to decision making.

Often, the effort and resources spent on generating reports are simply wasted, as they are not relevant for decision making.

The object of a report is to provide key risk data to the management and to generate remedial action where required..

6. Compile the quantitative and qualitative data into one report

7. on-time delivery of reports.

Timing matters a lot!

Late reports cripple the effectiveness of decision making. Report analysis is done differently in every organization. Some look into daily reports, some do it on a weekly basis and most of them carry out a monthly or quarterly review of the reports. Depending on the schedule, reports should be produced in real-time for the best results.

8. Constant review of the reporting system and report structure

Organizations are continuously evolving. Report delivery and structure should also be developed with respect to the changes in the organization.

Conduct regular checks on risk taxonomy, risk indicators, performance indicators, risk profiles and control measures, as they are susceptible to change, and reflect the changes on risk reports. Increasing the length of the risk report doesn’t matter, it is crisp and precise content that makes the difference.

9. Transparency in risk ownership

Every risk must have a risk owner who is responsible for securing data integrity of the risk report. At the same time, an effective risk report serves the interests and obligations of risk owner s. So it is advisable to have clear designations for them.

Remember, a constructive ERM report has a powerful influence on business decisions and acts as the true essence of risk management .

About The Author:- Mohammed Nasser Barakat Consultancy Director at CAREweb Corporate Governance Consultancy offering Governance, Risk & Compliance (GRC) software used by the well known global business organizations. Nasser is Certified Control and Risk Self Assessment Practitioner (CCSA) and has 8 years experience in Internal audit solutions, Enterprise Risk Management and consultancy.

Further reading on Risk Management:

• Risk Assessment
• Business Risk
• Construction Risk Management
• Risk Management Glossary
• Risk Management Guidelines
• Risk Identification
• NHS Risk Register
• Risk Register template
• Risk Management Report
• Risk Responses
• Prince2 Risk Register
• Prince2 Risk Management Strategy

The Ultimate Primer for Effective Risk Reporting

A mechanism for ensuring leadership, business managers, and other stakeholders make risk-informed decisions and fulfill oversight duties.

At the end of the day, the ERM process should be regarded as a cycle or feedback loop…meaning, there’s never a definitive end point.

It’s like the four seasons of the year – there’s never an end point, just a continuous loop throughout the year. Fall moves to winter, winter to spring, spring to summer, back around to fall, and the cycle continues as it has done for eons.

I’ve discussed other points along the ERM loop like risk identification , assessment , and analysis , plus process development , in prior articles.

In this article, I’m going to dive into the last point in this loop or cycle – risk reporting .

Before going any farther, I want to explain that this primer will not necessarily get into how you should prepare risk reports in your organization. As you’ll see in the upcoming sections, there are a lot of organization and individual-specific factors that go into effective risk reporting.

While there will be some examples below, this article will focus on elements of a solid risk report and considerations based on who your report(s) is intended for.

Without further ado, I want to start by providing you with a definition…

What is risk reporting and why is it important?

Since risk reporting can vary widely from one organization to the next, an exact definition is hard to pin down. However, the COSO ERM Framework (2017) says this about risk reporting:

Reporting supports personnel at all levels to understand the relationships between risk, culture, and performance and to improve decision-making in strategy- and objective-setting, governance, and day-to-day operations.

And as Norman Marks explains in his book World-Class Risk Management (…a source I’ll be referring to more in this article), the management of risks should be an essential part of the day-to-day management and decision-making of an organization. However, it’s important that management and the board “take stock” every so often. That way, so the Board and senior management knows the organization is on track to achieve its objectives.

Besides taking stock, risk reporting is also important from a legal perspective. In times past, a Board didn’t necessarily have to know about a risk, but today, Boards cannot claim they were simply unaware of a risk that ended up becoming a big problem. Board members have an obligation to understand the risks facing an organization and ensure that management is addressing them in the appropriate manner.

Despite the importance of risk reporting, the level of satisfaction with “…the nature and extent of internal reporting of key risk indicators that might be useful for monitoring emerging risks by senior executives” is rather low, according to the 2018 State of Risk Oversight report from NC State University.  Over 40% of respondents claim they are “not at all” or “minimally” satisfied with the quality of reporting they receive from their risk personnel.

Why is this?

Two main reasons (don’t worry – I will discuss these in more detail later):

1.     The report doesn’t speak to the right audience.

By not understanding the background of the intended recipients or their knowledge of ERM, risk reports are either overwhelming (too detailed) or so high-level that they do not provide any real information.

2.     The report is a documentation exercise with no insights .

A report simply providing a list of risks without any real-time insights and perspectives on achieving critical objectives essentially means the risk report is a pretty picture that documents what people already know. Lists of risks are also out-of-date rather quickly since every decision either modifies existing risks or creates new ones.

Risk reporting that simply lists risks is one of several ways that ERM can fall into the dreaded “check-the-box” trap . Board members and executives will eventually begin questioning the value of ERM in this situation.

A true value-add risk report will provide real-time insights and perspectives on risks to objectives. However, having timely information can be challenging in a formal setting, so be cautious about how much time it takes to gather, compile, analyze, and report the information. Organizations with more robust ERM processes use risk reporting as a springboard to further discussions on strategy, mitigation, and more.

General risk reporting tips

Earlier, I briefly mentioned how the needs of a risk report will vary based on the audience. However, there are a few general risk reporting tips to ensure your risk reports are actionable and easy to consume. These tips include:

• Report Structure – However you develop risk reports in your organization, they must be intuitive first and foremost. You shouldn’t have to teach the audience how to read and take action on the report. If you do, the report is too complex and/or too confusing. Also consider the background of the end users – how much do they know about enterprise risk management practices? Do they have more a business, technical, or legal background?
• Risk Terminology – One reason many organizations struggle with risk reporting has to do with the language used in the reports. As I explain here , it’s important for ERM professionals to use language consistent with the enterprise instead of technical terms that only a few will understand. Most users of risk reports will not understand the nuances of risk scoring and other measurements, so this needs to be taken into account.
• Reports need to be actionable – One of the common complaints of risk reporting is that they simply provide a list of risks without any further analysis. As explained by Norman Marks, a list of risks is useful when managing risks, but what users of the report need, especially decision-makers, is to understand risk and its impact on objectives in a cumulative way, not one-by-one. Think more about the root cause(s) of the risk, the effects on business objectives, how pervasive throughout the organization, if there is any room to take more risk, and whether there are any opportunities for the organization if this risk occurs.

Note: Risk aggregation is an advanced way of understanding how multiple risks cumulatively affect objectives, but since most practices likely involve advanced computer modeling, risk aggregation should not be a priority until you have nailed down the risk reporting process for your organization.

These general tips on risk reporting apply regardless of the audience. In the end, it boils down to clarity…any text or visual elements in risk reports have to clear enough for the user to understand them without having to think too much, and then being able to make decisions quickly based on that information.

4 Risk Reporting Audiences – What Reports Should Include

The core factor in how risk reports take shape depends on who the end user is. A risk report for a Board-level committee is going to look much different than one to a risk owner.

For example, risk reporting for the Board will be more “big picture” and focus on risks to the organization achieving its objectives. The structure and detail of risk reports will gradually become more granular or focused on specific risks the further you go down the organizational ladder. And risk reports for regulatory agencies have a host of considerations separate from internal consumers.

Continue reading to learn more about these four audiences and what they need to get from any risk reports.

Board and Board-level Risk Committee

In short, the Board or a Board-level risk committee needs a performance-based report that focuses on achieving objectives. The responsibilities of the board or board-level risk committee are frequently delegated to the Audit Committee.

What is the Board looking for from a risk report? Assurance that the CEO and other executive managers understand risks to objectives and are taking appropriate action to address these risks.

Why? Ensures the Board has the information it needs to understand risks to achieving objectives and fulfill its oversight responsibilities.

What? This report will be high-level and should prompt further discussion on how to proceed, whether that involves mitigation action(s) or a change in strategy.

Most organizations prepare a full report at least annually, but this timeframe means the information needs to be updated right before this report. (Otherwise, information that is 6 months old is useless.)

Respondents to a survey from NC State had a common thread in what their reports included. The bulk of information contained in reports was text-based with graphic/visual elements, such as charts or heat maps playing a supporting role. Visual elements play a role in framing critical issues and showing the level of exposure to top risks.

Here are a couple of examples of heat maps from a prior project. Although I’m providing this example, there are limitations to heat maps I want to discuss in a future post…

The vast majority of respondents also explain that they only report on the top 10 to 15 risks to the enterprise in their Board-level presentations.

I can’t stress this enough: these reports to the Board should be general in nature and only include top risks.

In some cases, the Board may request a follow-up or “deep dive” on any risks of particular concern quarterly or even monthly if the risk is significant enough. This responsibility really rests with business functions in the enterprise if risk is truly embedded throughout the organization . When IT, Marketing, Finance, Legal, or HR executives present to the Board, they should be taking the lead on reporting on key risks and their assessment of those risks.

On the other hand, Board-level risk and/or audit committees will look for full reports from the risk management team, since in many cases, these are the forums where detailed discussions on the path forward will occur. A committee like this will also be performing the oversight function for risk management.

Let’s look at Southwest Airlines for an example. Risk reports for the Board at Southwest have 4 levels of information:

• Proactively identify the biggest risks
• Outline any action plans for these risks (past, present, and future)
• List “accepted” risks that are outside the organization’s control
• Outline the impact these big risks could have on achieving objectives

Senior Management

Executives like the CEO and others will have many of the same risk report requirements as the Board. However, in this case, reports will need to go into a bit more detail, but not so much that executives reading them will be overwhelmed.

In fact, executives rely on ERM staff to vet risks with risk owners and prioritize them according to available info. ERM staff will then provide executives a short list of risks and provide guidance on decisions that need to be made. Components of risk information, such as category, impact/likelihood, velocity and any mitigation activities to date are discussed in these reports.

Risk reports to senior management also need to cover more than 10-15 individual, top-tier risks mentioned above. In order for management to fulfill its responsibilities, they must understand the overall level of risk to an objective. Taken one at a time, a risk may not be a big deal, but when “aggregated” together could present a huge red flag.

(It’s important to note that true “aggregation” is a very advanced topic that shouldn’t be attempted while still developing an ERM process in your organization.)

ERM can also recommend action steps for mitigating risks or modifying strategy based on observations and general knowledge.

In the end, it is management’s responsibility to ensure that appropriate controls and other risk-related activities are in place.

A risk dashboard is one tool executives in more mature ERM programs use to get the information they need to fulfill their responsibilities. Creating a risk dashboard can be done manually using Excel (or a similar tool), however, this is a primary use of risk software. ERM software , of which many options are available, will include indicators on the status of key risks, dependencies, impacts, and how they are being handled. With a quick glance, the executive will be able to see the risk owner, along with a summary chart of top risks, other key risk indicators, and more.

Visual tools like a dashboard, which can also be included on Board-level reports, are a great way for your audience to quickly comprehend data.

One word of caution though – as discussed by Norman Marks, COSO, myself, and other risk thought leaders, organizations should first focus on establishing and refining their processes before jumping into a technology solution.  A tool should not dictate the risk process at an organization. Instead, an organization should establish and refine their process for at least a year, then find a tool that supports that process. After all, the software should support the more streamlined management of risks throughout the organization.

There is another way of reporting. That is “informal” reporting. What does informal risk reporting look like? Organizations with a robust ERM process that’s embedded throughout the organization and has strong executive buy-in will seek out the perspective of risk professionals. The on-demand insights, opinions, and perspectives from the risk team is where the real value of ERM can be realized.

Risk Owners

The last internal audience for risk reporting will be the middle managers and other personnel on the front lines who actually own the risks , meaning the individual(s) responsible for monitoring and implementing any mitigation actions prescribed by upper management.

Although reports at every level will need to provide actionable information, this is especially important for reports to risk owners.

These reports will also provide the highest level of detail regarding of risk, including key risk indicators. Reports to the risk owners will focus on performance metrics, as well as provide the most up-to-date information on the assessment of all the risks under the individual’s responsibility. This may seem overwhelming to you at first, but it is your responsibility to be both succinct and accurate in reports. Remember to use a combination of text and visual elements.

An example of a good visual element for risk owner reports is a radar chart (available in Excel), which compares risk assessment results to risk tolerance levels.

A key difference is this report is this: instead of using the report to develop or modify strategy, risk owners use information in their reports to plan and budget the day-to-day operations of the organization.

As is the case with Board and senior executive level reports, the format will need to be tailored to the professional background and level of ERM knowledge the end user has.

Regulatory Agencies

The last risk reporting audience to mention is any relevant regulatory agencies that require organizations to report on risks. Publicly-traded corporations in the U.S. are required by the Securities and Exchange Commission (SEC) to report top risks. Another example of mandated risk reporting includes the state-level Own Risk Solvency Assessment (ORSA) for U.S. insurance companies or Solvency II reporting in the European Union.

As a former insurance regulator in my home state of Florida, I can attest that any risk reports for a regulator must balance the company’s need to satisfy the regulatory requirement and the regulator’s need to understand the company’s risks. Of course, the insurance company must disclose risks without getting too detailed, which can result in a higher level of scrutiny by the regulators.

At the present time, it’s also unclear how well regulators really understand enterprise risks and can therefore digest information and ask in-depth questions regarding the report.

The SEC’s report, known as the 10-k, isn’t looking for a list risks with detailed assessment information but rather a narrative of the big risks to the organization.

In this case, it’s best to look at others sending reports like this one from Walmart to understand what to include in a 10-k report if your company is required to submit one.

In conclusion…

I want to reiterate how risk reporting is really organization-specific. The contents of a report and how it is formatted depends on a variety of factors, including the needs of the users, the professional background and skill sets of the audience and other individual-specific factors. Understanding this about the users of risk reports is critical to ensuring the most helpful reports for facilitating further discussion on risks get produced.

Don’t feel pressured to include certain elements, especially if the organization is not ready for them or if the risk process doesn’t support those elements yet.

And last but not least, you may have guessed this by now… Risk reporting is very fluid . Don’t think for a moment that the way you prepare risk reports will be the same each time.

Just remember that the process and format for risk reporting in your organization is a constantly evolving process.

Risk reporting is a quite in-depth topic, but this primer should provide a good foundation for what you need to consider when developing reports in your organization.

Do Board members and executives in your organization find risk reports helpful in addressing risks to strategic objectives?

Do they provide the guidance you, as the risk professional, need to provide them with the right information in a way that’s helpful to them?

I’m interested to hear your thoughts and experiences on this important topic…simply comment below or join the conversation on LinkedIn to share your perspective or question(s).

And if you’re struggling to develop concise and actionable risk reports for your organization or a regulatory agency, visit my consulting website (Strategic Decision Solutions) to learn more about how I help organizations overcome challenges and ensure long-term success.

• Carol Williams
• December 10, 2018
• ERM Processes

Receive Our Weekly Blog Updates

To our readers:

This blog was launched to provide strategy and risk practitioners with a go-to resource to better guide their efforts within their companies. Thank you for bringing me and my team along to be part of your journey towards better risk management, strategic planning and execution, and overall decision-making. Happy reading!

Find more SDS Insights

Improving insurance carrier performance, decision-making, and value through creative, transformative risk and strategy solutions.

Copyright © 2024 ERM Insights by Carol; d/b/a Strategic Decision Solutions. Privacy Policy .

• Twitter icon
• Facebook icon
• LinkedIn icon

7 Steps to Write a Risk Management Plan For Your Next Project (With Free Template!)

🎁 Bonus Material: Free Risk Management Template

5 Steps to Find Your Definition of Done (With Examples and Workflows)

3 Steps to Minimize Workplace Distraction And Take Back Control of your Focus

The Essential Guide to Writing a Project Communication Plan: What It Is and Why You (Actually) Need One

Working with planio, see how our customers use planio.

• Contact sales

Start free trial

How to Make a Risk Management Plan (Template Included)

You identify them, record them, monitor them and plan for them: risks are an inherent part of every project. Some project risks are bound to become problem areas—like executing a project over the holidays and having to plan the project timeline around them. But there are many risks within any given project that, without risk assessment and risk mitigation strategies, can come as unwelcome surprises to you and your project management team.

That’s where a risk management plan comes in—to help mitigate risks before they become problems. But first, what is project risk management ?

What Is Risk Management?

Risk management is an arm of project management that deals with managing potential project risks. Managing your risks is arguably one of the most important aspects of project management.

The risk management process has these main steps:

• Risk Identification: The first step to manage project risks is to identify them. You’ll need to use data sources such as information from past projects or subject matter experts’ opinions to estimate all the potential risks that can impact your project.
• Risk Assessment: Once you have identified your project risks, you’ll need to prioritize them by looking at their likelihood and level of impact.
• Risk Mitigation: Now it’s time to create a contingency plan with risk mitigation actions to manage your project risks. You also need to define which team members will be risk owners, responsible for monitoring and controlling risks.
• Risk Monitoring: Risks must be monitored throughout the project life cycle so that they can be controlled.

If one risk that’s passed your threshold has its conditions met, it can put your entire project plan in jeopardy. There isn’t usually just one risk per project, either; there are many risk categories that require assessment and discussion with your stakeholders.

That’s why risk management needs to be both a proactive and reactive process that is constant throughout the project life cycle. Now let’s define what a risk management plan is.

What Is a Risk Management Plan?

A risk management plan defines how your project’s risk management process will be executed. That includes the budget , tools and approaches that will be used to perform risk identification, assessment, mitigation and monitoring activities.

Get your free

Risk Management Plan Template

Use this free Risk Management Plan Template for Word to manage your projects better.

A risk management plan usually includes:

• Methodology: Define the tools and approaches that will be used to perform risk management activities such as risk assessment, risk analysis and risk mitigation strategies.
• Risk Register: A risk register is a chart where you can document all the risk identification information of your project.
• Risk Breakdown Structure: It’s a chart that allows you to identify risk categories and the hierarchical structure of project risks.
• Risk Assessment Matrix: A risk assessment matrix allows you to analyze the likelihood and the impact of project risks so you can prioritize them.
• Risk Response Plan: A risk response plan is a project management document that explains the risk mitigation strategies that will be employed to manage your project risks.
• Roles and responsibilities: The risk management team members have responsibilities as risk owners. They need to monitor project risks and supervise their risk response actions.
• Budget: Have a section where you identify the funds required to perform your risk management activities.
• Timing: Include a section to define the schedule for the risk management activities.

How to Make a Risk Management Plan

For every web design and development project, construction project or product design, there will be risks. That’s truly just the nature of project management. But that’s also why it’s always best to get ahead of them as much as possible by developing a risk management plan. The steps to make a risk management plan are outlined below.

1. Risk Identification

Risk identification occurs at the beginning of the project planning phase, as well as throughout the project life cycle. While many risks are considered “known risks,” others might require additional research to discover.

You can create a risk breakdown structure to identify all your project risks and classify them into risk categories. You can do this by interviewing all project stakeholders and industry experts. Many project risks can be divided up into risk categories, like technical or organizational, and listed out by specific sub-categories like technology, interfaces, performance, logistics, budget, etc. Additionally, create a risk register that you can share with everyone you interviewed for a centralized location of all known risks revealed during the identification phase.

You can conveniently create a risk register for your project using online project management software. For example, use the list view on ProjectManager to capture all project risks, add what level of priority they are and assign a team member to own identify and resolve them. Better than to-do list apps, you can attach files, tags and monitor progress. Track the percentage complete and even view your risks from the project menu. Keep risks from derailing your project by signing up for a free trial of ProjectManager.

2. Risk Assessment

In this next phase, you’ll review the qualitative and quantitative impact of the risk—like the likelihood of the risk occurring versus the impact it would have on your project—and map that out into a risk assessment matrix

First, you’ll do this by assigning the risk likelihood a score from low probability to high probability. Then, you’ll map out your risk impact from low to medium to high and assign each a score. This will give you an idea of how likely the risk is to impact the success of the project, as well as how urgent the response will need to be.

To make it efficient for all risk management team members and project stakeholders to understand the risk assessment matrix, assign an overall risk score by multiplying your impact level score with your risk probability score.

3. Create a Risk Response Plan

A risk response is the action plan that is taken to mitigate project risks when they occur. The risk response plan includes the risk mitigation strategies that you’ll execute to mitigate the impact of risks in your project. Doing this usually comes with a price—at the expense of your time, or your budget. So you’ll want to allocate resources, time and money for your risk management needs prior to creating your risk management plan.

4. Assign Risk Owners

Additionally, you’ll also want to assign a risk owner to each project risk. Those risk owners become accountable for monitoring the risks that are assigned to them and supervising the execution of the risk response if needed.

Related: Risk Tracking Template

When you create your risk register and risk assessment matrix, list out the risk owners, that way no one is confused as to who will need to implement the risk response strategies once the project risks occur, and each risk owner can take immediate action.

Be sure to record what the exact risk response is for each project risk with a risk register and have your risk response plan it approved by all stakeholders before implementation. That way you can have a record of the issue and the resolution to review once the entire project is finalized.

5. Understand Your Triggers

This can happen with or without a risk already having impacted your project—especially during project milestones as a means of reviewing project progress. If they have, consider reclassifying those existing risks.

Even if those triggers haven’t been met, it’s best to come up with a backup plan as the project progresses—maybe the conditions for a certain risk won’t exist after a certain point has been reached in the project.

6. Make a Backup Plan

Consider your risk register and risk assessment matrix a living document. Your project risks can change in classification at any point during your project, and because of that, it’s important you come up with a contingency plan as part of your process.

Contingency planning includes discovering new risks during project milestones and reevaluating existing risks to see if any conditions for those risks have been met. Any reclassification of a risk means adjusting your contingency plan just a little bit.

7. Measure Your Risk Threshold

Measuring your risk threshold is all about discovering which risk is too high and consulting with your project stakeholders to consider whether or not it’s worth it to continue the project—worth it whether in time, money or scope .

Here’s how the risk threshold is typically determined: consider your risks that have a score of “very high”, or more than a few “high” scores, and consult with your leadership team and project stakeholders to determine if the project itself may be at risk of failure. Project risks that require additional consultation are risks that have passed the risk threshold.

To keep a close eye on risk as they raise issues in your project, use project management software. ProjectManager has real-time dashboards that are embedded in our tool, unlike other software where you have to build them yourself. We automatically calculate the health of your project, checking if you’re on time or running behind. Get a high-level view of how much you’re spending, progress and more. The quicker you identify risk, the faster you can resolve it.

Free Risk Management Plan Template

This free risk management plan template will help you prepare your team for any risks inherent in your project. This Word document includes sections for your risk management methodology, risk register, risk breakdown structure and more. It’s so thorough, you’re sure to be ready for whatever comes your way. Download your template today.

Best Practices for Maintaining Your Risk Management Plan

Risk management plans only fail in a few ways: incrementally because of insufficient budget, via modeling errors or by ignoring your risks outright.

Your risk management plan is one that is constantly evolving throughout the course of the project life cycle, from beginning to end. So the best practices are to focus on the monitoring phase of the risk management plan. Continue to evaluate and reevaluate your risks and their scores, and address risks at every project milestone.

Project dashboards and other risk tracking features can be a lifesaver when it comes to maintaining your risk management plan. Watch the video below to see just how important project management dashboards, live data and project reports can be when it comes to keeping your projects on track and on budget.

In addition to your routine risk monitoring, at each milestone, conduct another round of interviews with the same checklist you used at the beginning of the project, and re-interview project stakeholders, risk management team members, customers (if applicable) and industry experts.

Record their answers, adjust your risk register and risk assessment matrix if necessary, and report all relevant updates of your risk management plan to key project stakeholders. This process and level of transparency will help you to identify any new risks to be assessed and will let you know if any previous risks have expired.

How ProjectManager Can Help With Your Risk Management Plan

A risk management plan is only as good as the risk management features you have to implement and track them. ProjectManager is online project management software that lets you view risks directly in the project menu. You can tag risks as open or closed and even make a risk matrix directly in the software. You get visibility into risks and can track them in real time, sharing and viewing the risk history.

Tracking & Monitor Risks in Real Time

Managing risk is only the start. You must also monitor risk and track it from the point that you first identified it. Real-time dashboards give you a high-level view of slippage, workload, cost and more. Customizable reports can be shared with stakeholders and filtered to show only what they need to see. Risk tracking has never been easier.

Risks are bound to happen no matter the project. But if you have the right tools to better navigate the risk management planning process, you can better mitigate errors. ProjectManager is online project management software that updates in real time, giving you all the latest information on your risks, issues and changes. Start a free 30-day trial and start managing your risks better.

Deliver your projects on time and on budget

Start planning your projects.

• PRO Courses Guides New Tech Help Pro Expert Videos About wikiHow Pro Upgrade Sign In
• EDIT Edit this Article
• EXPLORE Tech Help Pro About Us Random Article Quizzes Request a New Article Community Dashboard This Or That Game Popular Categories Arts and Entertainment Artwork Books Movies Computers and Electronics Computers Phone Skills Technology Hacks Health Men's Health Mental Health Women's Health Relationships Dating Love Relationship Issues Hobbies and Crafts Crafts Drawing Games Education & Communication Communication Skills Personal Development Studying Personal Care and Style Fashion Hair Care Personal Hygiene Youth Personal Care School Stuff Dating All Categories Arts and Entertainment Finance and Business Home and Garden Relationship Quizzes Cars & Other Vehicles Food and Entertaining Personal Care and Style Sports and Fitness Computers and Electronics Health Pets and Animals Travel Education & Communication Hobbies and Crafts Philosophy and Religion Work World Family Life Holidays and Traditions Relationships Youth
• Browse Articles
• Learn Something New
• Quizzes Hot
• This Or That Game
• Train Your Brain
• Explore More
• Support wikiHow
• About wikiHow
• Log in / Sign up
• Finance and Business
• Risk Management

How to Write a Risk Management Policy

Last Updated: March 25, 2024 Approved

This article was co-authored by Ksenia Derouin . Ksenia Derouin is a Business Strategy Specialist, OBM, and Artist based in Grand Rapids, Michigan. With over ten years of professional experience, Ksenia works with wellness and social impact sector solopreneurs and organizations to support their business strategy, operations, marketing, and program development. Her mission is to support business owners in building thriving businesses and creating impact so that they can achieve a sense of purpose, career fulfillment, and financial independence. wikiHow marks an article as reader-approved once it receives enough positive feedback. In this case, several readers have written to tell us that this article was helpful to them, earning it our reader-approved status. This article has been viewed 92,205 times.

A risk management policy is a helpful way to identify, reduce, and prevent potential risks. Knowing how to write a risk management policy is a central part of planning your organization's strategic objectives. We'll walk you through all the steps of creating a risk management plan to help protect your business.

• Consider the context of your work within the different transactions or processes. Include long-term strategic objectives and decisions, operational or day-to-day activities, financial management and controls, intellectual and information technology actions and knowledge, and compliance/regulatory issues and policy decisions.
• Write down all the things that could potentially go wrong and then make detailed assessments of these risks. Divide this information into sections to address each individually.

• Write down how they may occur and potential methods of prevention, additional steps that could be taken to prevent them, and how those risks are evaluated and assessed regularly.

• Consult past records to determine how frequently incidents have happened, and how they were handled, including processes that worked and those where there were areas of improvement.

• Be sure to outline a step-by-step expectation for how each risk will be avoided, how it will be handled if it does occur, and how it will be recorded.

• The internal and external audiences need different information; internal audiences need to know the greatest risks, who is accountable for what, and how the process will be monitored. External audiences need to know risk management is a part of the organization's culture and how the process and policy has been laid out.

• Creating a risk assessment form for use after an incident can be a useful tool to examine whether more precautions should have been taken. This allows all the data to be recorded right after the occurrence, and for the same information to be gathered each time.

• Risk management planning and evaluation should be a continuous, evolving process that integrates seamlessly into a company or organization's culture.

Expert Q&A

• Be sure to identify a key department or person who is responsible for assessing and monitoring each risk that has been identified to increase accountability. Thanks Helpful 1 Not Helpful 0
• Be sure that all of your plans to avoid risks maintain compliance with the law and whatever regulating agencies apply to your field of work. Thanks Helpful 1 Not Helpful 1
• All staff should be involved in creating the risk management plan. Front-line workers may have a better sense of the range of risks than higher-level managers. However, some organizations designate one person to be a risk management officer that is the lead on risk management policies and evaluation. Thanks Helpful 0 Not Helpful 1

• Be sure to utilize the writing process as a collaborative effort and do not allow it to be a blaming or finger-pointing session. Be sure to outline from the start that it is a positive, preventative process and not a punitive one stemming from how something in the past was handled. Thanks Helpful 1 Not Helpful 0
• After identifying risks within the organization, revisit insurance coverage amounts. Discuss with others involved with the risk management policy process and adjust coverage accordingly, if deemed necessary. Thanks Helpful 1 Not Helpful 0
• Identifying risks and hazards shifts some responsibility to managers. After identifying risks, managers must then be willing to provide trainings, equipment, and oversight to equip staff with the ways and means to avoid those risks. Thanks Helpful 1 Not Helpful 0

You Might Also Like

Expert Interview

Thanks for reading our article! If you’d like to learn more about improving your business, check out our in-depth interview with Ksenia Derouin .

• http://www.mesa.edu.au/archives/Risk_Management_Policy.pdf
• https://www.diycommitteeguide.org/how-to-develop-a-risk-management-strategy/

About This Article

• Send fan mail to authors

Reader Success Stories

Oct 3, 2017

Did this article help you?

Emily Kiptui

Nov 2, 2017

Kathleen O.

Jun 3, 2019

Featured Articles

Trending Articles

Watch Articles

• Terms of Use
• Privacy Policy
• Do Not Sell or Share My Info
• Not Selling Info

wikiHow Tech Help Pro:

Develop the tech skills you need for work and life