CRISC Certified in Risk and Information Systems ControlRisk Response and ReportingHard
A financial institution is preparing its annual risk report for the board of directors. The report includes key risk indicators (KRIs), control effectiveness metrics, and a summary of residual risks. The board members express concern that the report often presents a fragmented view, with different departments reporting on their risks using inconsistent methodologies and terminology, making it difficult to gain a holistic understanding of the organization's overall risk posture. Which characteristic of effective risk reporting is primarily lacking?
- AAccuracy
- BConsistency
- CTimeliness
- DCompleteness
Show answer & explanationAnswer & explanation
Correct answer: B. Consistency
The core issue is that 'different departments reporting on their risks using inconsistent methodologies and terminology.' This directly indicates a lack of consistency, which is crucial for enabling the board to compare risks across departments and gain a unified, holistic view of the risk posture.
Why the other options are wrong
- A. Accuracy refers to the correctness of the data, which is not the primary concern; the concern is the disparate presentation.
- C. Timeliness refers to the report being delivered when needed, which is not stated as the problem.
- D. Completeness refers to including all necessary information, but the issue here is how the information is presented, not necessarily missing data.
Effective Risk Reporting Characteristics
Effective risk reporting provides relevant, accurate, timely, consistent, and clear information to stakeholders, enabling informed decision-making regarding risk management.
- Must be consistent across departments/time.
- Should be tailored to the audience.
- Enables holistic risk understanding.
Memory trick: TACC-C: Timely, Accurate, Complete, Clear, Consistent.