C6.4 Reporting

Orange Book [4]; COSO principle 20 [2]

The fourth component requires that the governing body receive, for each principal risk, one page carrying the appetite position, the tolerance status, the indicators with their thresholds and trend, the events of the period, the actions under way with dates and the assurance received, and that the report join risk with culture and performance rather than present risk alone. The page is the principal-risk report of the public-sector guidance [4]; the joining of risk, culture and performance is principle 20 of the governance framework, which asks that the board see the three together because a risk read apart from the performance it threatens is a risk read without its denominator [2].

The component reconciles the board's time with the register's size. A register of four hundred rows cannot be read by a board and should not be; a page per principal risk can, and it is complete in a way a heat map is not, because it carries the appetite the risk is read against, the measurement that says where it stands and the opinion that says whether the measurement can be believed. The culture and performance elements come from C0.2 and C1.2: a survey item on whether staff report near misses, and the performance measure the objective is tracked by, sit on the same page as the exposure, so that the board can see whether the risk is being managed by people who say what they see.