What a risk assessment should tell your board

It should show your biggest exposures, how well they are controlled and what to fix first.

1 min read

Start with exposure

A board needs to know which risks could stop the strategy. A long list of every risk in the business does not help. Ten risks, ranked by their effect on objectives, give directors something they can discuss.

Show how well each risk is controlled

A rating on its own says little. The board should see which controls matter for each top risk, whether anyone has tested them and what the results were. Untested controls should be reported as untested.

End with priorities

Findings need an order. The assessment should say what to fix first, who owns it and when it will be done. That gives the board a way to track progress at the next meeting.

Keep reading

More guides

After the refineries: how South Africa’s fuel business makes money going into 2027South Africa now imports more than half its fuel, runs two refineries and loses its Mozambican gas supply after 2028. Who the players are and where margin and exposure sit.What South African fuel boards must have on the register before 2027The ten strategic risks for South African fuel businesses going into 2027: what each one is, why it is on the register now, the early warnings and who should own it.Days of cover, licences, gas: the controls that move the ratingFor each of the ten oil and gas risks in South Africa: the control that moves the rating, the gap most commonly observed and the evidence a board should ask for.Why risk registers go staleA risk register goes stale when nobody owns the actions in it.ISO 31000 or COSO ERM?ISO 31000 sets out principles and a process. COSO ERM ties risk to strategy and performance. Many organisations draw on both.Writing a risk appetite statement people can useA risk appetite statement only works if it sets limits people can act on.

Common questions

Before you book

What is the key point?

It should show your biggest exposures, how well they are controlled and what to fix first.

Start with exposure: what does this mean?

Show how well each risk is controlled: what does this mean?

End with priorities: what does this mean?

Findings need an order. The assessment should say what to fix first, who owns it and when it will be done. That gives the board a way to track progress at the next meeting.

Start with a free assessment

Book with our team. A review of where your risk management stands today and a recommended next step.

Request a Free Assessment