Kezia Farnham

Senior Manager

11 best practices for effective ERM reporting

In a post-COVID world, risks are like dominos; an unmitigated risk in one business area can trigger a cascade of impacts throughout the supply chain. That’s why enterprise risk management in 2022 isn’t just about preventing bad things from happening. It’s about turning potential risks into business opportunities. Organizations can do this through effective ERM reporting.

With ERM, or enterprise risk management, organizations attempt to identify events that are likely to occur. But it’s through ERM reporting that businesses evaluate their risk management methods to uncover what’s working, what’s not working and how to resolve any potential lapses in risk management.

Effective ERM risk reporting can help organizations turn their risks into a competitive advantage. Businesses must know what it takes to create a good ERM risk report. Here’s how to get started.

What Is an ERM Report?

An ERM report informs day-to-day decision-making by helping boards identify the risks facing their organizations. It also outlines the risk management methods in place to mitigate them.

Good ERM reports detail lapses in coverage or execution of risk management methods and possible instances of noncompliance. While this is important from a strategy perspective, it’s also a legal matter. Boards have a legal responsibility to understand and act on the organization's risks.

4 Key Audiences for Risk Reporting

Though all risk reports should feature real-time insights, the structure and contents of the report may vary based on the audience. The board, for example, needs to see the bigger picture of risk impacting the organization, whereas risk owners may need reports that help them drill into daily risk management activities. Tailoring risk reporting to each audience is vital to evaluating ERM reporting risk.

1. Board of Directors and Risk Committee: The board of directors ensures the company meets its annual objectives. The risk report should have a similar focus, detailing how potential risks could get in the way of set goals. Boards can then use this report to take action or adapt their strategy, ideally before the risk can impact the bottom line.
2. Senior Management: Senior management includes executives as well as the CEO, all of whom need more detail than the board. A risk report for senior management often involves reporting up; they want a list of risks and accompanying mediation plans from their ERM staff. This helps senior management ensure that the proper management strategies are in place for the risks in the report, which can feature as many as 15 possible issues.
3. Risk Owners: Risk owners are the ERM staff on the front line, including middle managers. These individuals act on the mitigation recommendations from senior management and the board. Reports for risk owners require a high level of detail on each risk, including performance metrics and assessments.
4. Regulators: Regulatory agencies are the primary external audience for risk reports. ERM reporting for regulators requires a careful balance; they must help the regulator understand the risks and assure that the organization meets regulatory requirements without providing so much detail that it will attract further review.

11 Best Practices of a Good ERM Report

While it’s true that ERM reports should adapt based on the current risks and the audience for the report, good risk reports have some best practices in common. In creating an ERM reporting framework, organizations should consider the following:

1. Set Measurable Objectives: The report should be tailored to the organization’s objectives. What are the risks that might prevent the organization from achieving those objectives? This is the basis for a good ERM report. 
2. Clearly Define the Report: Establish a report structure that clearly defines everything from the recipients to the names of input fields and the calculations required to evaluate each risk. Defining the structure of the report should always come before design. 
3. Continuously Evaluate Report Structures: Risks are always evolving, so the report should, too. Organizations should always consider whether they need to include more risks in the report or additional fields to deliver the right information about each risk’s management. 
4. Create a Consistent ERM Language: The board of directors may understand and communicate risk differently than the rest of the ERM team. Ensure employees at all levels use the same ERM language to reduce miscommunication surrounding the report. 
5. Utilize Both Qualitative and Quantitative Information: Good ERM reports effectively balance hard numbers and anecdotal data to create a clearer picture of the risk, leading to better decision-making. 
6. Ensure Data Is Reliable: For ERM reporting to create a competitive edge, the data must be high quality. Validate all risk sources to ensure reporting is based on high-quality, reliable information. Organizations that integrate ERM enterprise-wide are more likely to have access to reliable data. 
7. Outline Key Takeaways: Reports can be long, but senior management and the board of directors don’t always have time to read every page. Highlight key takeaways so they can easily find and review the action items that matter most.
8. Deliver Reports On Time: Whether organizations deliver reports once a month or once a year, the report should always be on-time according to that timetable. ERM teams should also prepare the report immediately before they deliver it since a report that’s six months old will no longer be useful to the board.
9. Integrate ERM Reporting: Risks don’t happen in a vacuum. All teams should be involved in ERM reporting so that the organization doesn’t duplicate efforts or miss out on a vital part of mitigating potential risks.
10. Make Reports Actionable: Good ERM reports should empower senior management and the board to take action. Recommended actions and strategies should accompany each risk, so the board has all the information they need to move forward.
11. Facilitate Effective Decision Making: All ERM reports should do one thing: allow the board to make better decisions. These reports should clarify the organization's potential risks and make it easy for the CEO and the board to take revenue-saving, and even revenue-driving, action. 

Achieve ERM Maturity

Today’s risk landscape is ever-evolving, whether that’s risks related to digitization, remote work or even the volatile nature of today’s economy. To build an ERM reporting system that enhances organizational performance, organizations must first advance the maturity of their ERM.

While each step towards maturity takes planning, the pay-off means creating an ERM framework that not only catches risks before they impact the business but also turns that risk into an opportunity. Download the guide to performance-enhancing ERM from Diligent to learn how.