Directors care about risk because if things go wrong, the consequences can be dramatic and long-lasting. Just think about the impact of the Australian census website crashing on census night, and the fallout from VW's emission failure.
All organisations share some risks in common, such as people, safety, financial, and reputation, but some risks, such as cyber risk, are more industry-specific. A very broad definition is that risk is the 'effect of uncertainty on objectives'.
When writers are writing about risk within a board paper, they will often consult with risk experts, who help them develop complex heat maps or matrices. What they sometimes forget is that they are writing to a diverse board who are not all risk experts.
Nor will everyone relate to information presented visually. Writers need to be able to write about risk concisely in plain language. They don't need to repeat all the information in the visual in words, but they do need to provide some high-level commentary. What is this risk, why does it matter and what are we doing about it?
It sounds obvious to say that risks must be honestly and transparently dealt with, but too often that is not the case. Some risk statements I've read in board papers sound more like marketing statements, or are so vague they are useless.
If a risk is a serious concern it must be flagged in the summary. Not much detail needs to be provided there, but it ensures that directors will read the paper thinking about that particular risk and how it will be monitored and managed.
Many templates have a separate 'risk' heading to make writers focus on risk. However, this heading can be problematic if writers take a 'silo' approach to risk and don't integrate the discussion of risks into their reasoning for the proposal.
One way of dealing with this is to use cross-referencing, or alternatively to use this section to demonstrate how the risks relate to the organisation's risk framework.
We all know that some people like the visuals, and other people prefer words. I am a words person and don't find risk matrices easy to read even when they use colours to alert me to the magnitude of certain risks.
In a board paper, I expect a writer to pick out one or two key risks, explain why they matter, and how they will be dealt with. I sometimes fear that the large amount of information provided in a matrix camouflages important concerns.
Writing about risk is complex, but sometimes I think writers overcomplicate matters and forget that common sense and basic questions are often the best place to start.
There's nothing wrong with the 'What if' question as a starting point.
Risk appetite (also called 'risk attitude'): the amount and type of risk that an organisation is prepared to take in order to meet its strategic objectives.
Risk management framework: set of components that provide the foundations and organisational arrangements for designing, implementing, monitoring, reviewing and continually improving risk management.
Risk management policy: outlines an organisation's commitment to risk management and clarifies its general direction or intention.
Governance Institute of Australia, Risk management for directors: A handbook. It is available on the Governance Institute's website.