Question

A risk analyst prepares a monthly risk report that is distributed unchanged to the board of directors, the IT operations team, and business unit managers. The board complains that the report contains excessive technical detail and makes it difficult to grasp the organization's overall risk posture, while operations staff say it lacks the specifics they need to act. What is the analyst's BEST course of action?

Accepted Answer

Tailor the content, aggregation level, and visualization of the report to the decision-making needs of each stakeholder audience

Answer

Continue distributing a single standardized report to ensure all stakeholders receive identical, consistent information

Answer

Increase the technical detail throughout the report so operations staff have sufficient information to remediate risks

Answer

Reduce the reporting frequency to quarterly so the board is not overwhelmed by frequent technical updates