Risk Reporting
What is Risk Reporting?
The communication of risk information to stakeholders through reports that summarize risk levels, trends, incidents, and the status of mitigation activities.
Terms that appear alongside risk reporting
Each of these is named in at least one of the same controls as risk reporting. The number is how many controls name both.
- governance 10 shared controls
- compliance 8 shared controls
- audit 5 shared controls
- risk committee 5 shared controls
- risk appetite 5 shared controls
- risk assessment 4 shared controls
- resilience 4 shared controls
- operational risk 4 shared controls
Frameworks that govern risk reporting
What the standards actually require on risk reporting
Requirements naming risk reporting across 6 standards, quoted from the control text.
Risk data aggregation capabilities and risk reporting practices must sit under strong governance consistent with the Committee's other principles (SRP36 now points to the Corporate governance principles for banks, July 2015).
bcbs-239::P1 · Principle 1: governance of risk data aggregation and risk reporting →The principles apply to systemically important banks at both group and solo level, to all risk management data, to key internal models including Pillar 1 and Pillar 2 capital models and value-at-risk, and to outsourced processes (SRP36.4 to SRP36.8).
basel-iii-international-banking-framework::SRP36 · Meet the risk data aggregation and risk reporting principles (systemically important banks) →Providers must manage the people responsible for security appropriately, in particular by establishing and regularly reviewing a security policy that includes incident management at varying severities, a standard way of categorising incidents, channels for rep...
uk-telecommunications-security-act-2021::r10 · reg.10 Govern security from board level: policy, incident categorisation, risk reporting, post-incident review and insider risk →Management develops an IT risk reporting process that assembles and reports IT risk information in a timely, complete, transparent and decision-relevant way, with periodic risk-based reports to senior management, the board and stakeholders who have the authori...
ffiec-it-examination-handbook::MGT-III.D.7 · III.D.7 Reporting (Management) →The project specifies, builds or acquires the security solutions for the designed mechanisms, applying secure practices to all development and specifying every security configuration parameter in the implementation representation (code, products, network diagr...
canada-itsg-33-it-security-risk-management::A2-3.7.3 · 3.7.3 Specify, develop and test security solutions →Cyber risk reporting is presented and discussed at the independent risk management meetings.
ffiec-cybersecurity-assessment-tool-cat::D1.TC.Cu.Int.3 · D1.TC.Cu.Int.3 Culture (Intermediate 3) →Questions people ask about risk reporting
What is Risk Reporting?
Why is Risk Reporting important for compliance?
Which compliance frameworks address Risk Reporting?
Where can I learn more about Risk Reporting?
See how Risk Reporting applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.