A large retail company is preparing its annual risk report for the audit committee. The report includes a summary of the top 10 risks, their current residual risk levels, and the status of mitigation efforts. To ensure the report provides comprehensive and actionable information, what critical element should the risk practitioner also ensure is clearly articulated for each risk?
- AIdentification of the risk owner responsible for managing the risk.
- BDetailed technical specifications of all implemented controls.
- CA comprehensive list of all minor incidents related to the risk.
- DThe original qualitative risk assessment scores.
Show answer & explanationAnswer & explanation
Correct answer: A. Identification of the risk owner responsible for managing the risk.
For a risk report to be actionable and foster accountability, clearly identifying the risk owner for each risk is critical. The risk owner is responsible for managing the risk and ensuring that appropriate responses are implemented and monitored. Without a clearly assigned owner, accountability for risk management can become diffused, leading to inaction or neglect. Technical specifications (A) are too detailed for a high-level report, original qualitative scores (B) are less relevant than current residual risk, and a list of minor incidents (D) might be too granular for a summary report to the audit committee.
Why the other options are wrong
- B. Detailed technical specifications are typically too granular for an audit committee report, which focuses on strategic and oversight levels.
- C. A comprehensive list of all minor incidents might overwhelm the report and obscure the key messages for the audit committee.
- D. While useful during assessment, the current residual risk level is more pertinent for ongoing reporting than the original qualitative scores.
Risk Owner
An individual or entity accountable for the management of a specific risk, including its identification, assessment, response, and monitoring.
- Responsible for decision-making regarding the risk.
- Ensures appropriate resources are allocated.
- Reports on the status and effectiveness of risk responses.
Memory trick: Report Clearly for Actionable Oversight.