Risk Response and Reporting · Topic 9 of 9
Risk Monitoring, Reporting and Emerging Risks
CRISC monitoring and reporting: continuous monitoring, heat maps, scorecards and dashboards for each audience, and spotting and reporting emerging risks.
- 5 min
- Match monitoring frequency to the risk; automate where data allows.
- Heat maps show likelihood and impact; scorecards compare to targets; dashboards track metrics.
- Tailor reports to the audience and state the decision required.
What it is
Risk and control monitoring keeps track of whether risks stay within appetite and controls keep working. Reporting delivers that information to the people who need it, in a form that helps them decide.
Emerging risks are new or changing risks that are not yet well understood, such as a new technology, threat or regulation. They need their own process because normal assessments, which rely on past data, often miss them.
How it works
Monitoring techniques
| Technique | How it works | Best for |
|---|---|---|
| KRI and KCI tracking | Metrics compared with thresholds | Ongoing exposure and control health |
| Continuous controls monitoring | Automated checks on system data, often daily or real time | High-volume, data-rich controls such as access and payments |
| Control self-assessment | Control owners assess their own controls | Ownership and coverage across many units |
| Periodic risk reviews | Owners and practitioner review register entries | Keeping ratings and actions current |
| Independent testing and audit | Second or third line tests controls | Assurance on key controls |
| Event-driven review | Reassessment after incidents, changes or new threats | Responding to change |
Monitoring frequency should match the risk: critical risks and fast-moving threats need near-continuous monitoring, stable low risks can be reviewed less often.
Reporting techniques
| Technique | What it shows | Audience |
|---|---|---|
| Heat map | Risks plotted by likelihood and impact, coloured by severity | Board, executives |
| Scorecard | Status of metrics against targets, often red, amber, green | Executives, risk committee |
| Dashboard | Live or frequent view of KRIs, KCIs and trends | Managers, operations, risk team |
| Risk register extract | Detailed list of risks, owners and actions | Risk owners, practitioners |
| Trend charts | Change over time | All audiences |
| Narrative report | Context, analysis and recommendations | Board and committees |
A heat map is easy to read but can hide detail: two risks in the same cell may differ greatly, and it shows a snapshot rather than a trend. Pair it with trend arrows or commentary.
Tailoring to the audience
| Audience | Needs |
|---|---|
| Board | Top risks against appetite, trends, major breaches of tolerance, decisions required |
| Executive management | Risks by business area, treatment progress, resource needs |
| Risk and control owners | Detailed status of their risks, KRIs, KCIs and actions |
| Regulators | Required reports in prescribed formats and timeframes |
Reports should be accurate, timely, concise, and written in business terms. The purpose is risk-based decision making, so each report should make clear what decision or action is needed. Escalation of urgent issues should not wait for the next scheduled report.
Identifying emerging risks
| Method | Example |
|---|---|
| Horizon scanning | Reviewing research, industry reports and regulatory consultations |
| Environmental scanning (PESTLE) | Political, economic, social, technological, legal and environmental change |
| Threat intelligence | New attack techniques or actors targeting the sector |
| Expert workshops | Asking specialists and business leaders what could change |
| Internal signals | Shadow IT, new business initiatives, unusual incidents |
The job practice asks the practitioner to evaluate emerging technologies and changes for threats, vulnerabilities and opportunities. Emerging risk is not only downside; failing to adopt a technology competitors use can be a strategic risk.
Reporting emerging risks
Emerging risks are often kept on a watch list with an owner, a description, possible impact, signals to watch and a review date. Because data is limited, analysis relies on scenarios and expert judgement. When a risk becomes better understood, it moves into the main risk register and normal assessment.
A worked example
A practitioner's quarterly board report shows a heat map with eight top risks. One risk, third-party outage, sits in the same amber cell as last quarter, so the board sees no change. The KRI trend, though, shows vendor SLA breaches doubling.
The practitioner adds a trend arrow, a short narrative explaining the cause (a key vendor's financial trouble) and a requested decision: approve funding for an alternative supplier. A separate emerging risk section notes that a new operational resilience regulation is under consultation and may require changes to third-party contracts.
How the exam asks about this
- "Which reporting method is MOST useful for the board?" A concise summary of top risks against appetite, with trends and decisions needed, often as a heat map with commentary.
- "What is the MAIN limitation of a heat map?" It shows a point in time and can hide differences between risks in the same cell.
- "What should the practitioner do with a newly identified emerging risk that has little data?" Record it on a watch list with an owner, analyse it using scenarios and expert judgement, and monitor it.
What to remember for the exam
- Match monitoring frequency to the risk; automate where data allows.
- Heat maps show likelihood and impact; scorecards compare to targets; dashboards track metrics.
- Tailor reports to the audience and state the decision required.
- Emerging risks need horizon scanning, scenarios and expert judgement.
- Emerging change can bring opportunities as well as threats.
More detail does not make a better board report. When asked for the BEST way to report to senior management, choose the option that is concise, in business terms and linked to appetite.
Common mistakes
Sending the same report to everyone. Boards need summary and decisions; owners need detail.
Relying on a heat map alone. Without trends and commentary it hides change and context.
Waiting for data on emerging risks. By the time loss data exists, the risk has already arrived.
Check yourself
Why should risk reports be tailored to their audience?
Different stakeholders make different decisions, so the board needs concise top risks against appetite while owners need detailed status of their risks and actions.
What is continuous controls monitoring?
Automated, frequent checking of system data to confirm controls are operating, used where controls produce reliable electronic data.
How are emerging risks usually analysed when data is scarce?
With scenarios and expert judgement, tracked on a watch list until they are understood well enough for normal assessment.
Topic 9 of 9 in Risk Response and Reporting
Test yourself on Risk Response and Reporting
The full ISACA CRISC question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.