What's in a risk report

Both risk reports from the Report Builder are wide PDF pages with a table of risks. This page explains what each part shows, so you can read a report or explain it to others.

On every page

• At the top: your organisation’s logo and a title made of your organisation’s name and the report type, for example “Kalahari Springs Municipality: Risk Register Report”.
• At the bottom: your organisation’s name, the date, and the page number, for example “Page 2 of 5”.

The Risk Register Report

The introduction page

When Include Introduction Page is switched on, the report starts with a page headed Introduction. It says how many risks the report contains and how many key risk areas (risk categories) they fall under, for example “The 12 identified risks are grouped under the following 4 key risk areas.” Then it:

• lists the Key Risk Areas, each with its description;
• explains that each risk has a description, an impact, a risk owner with oversight responsibility, and a monitoring frequency;
• explains likelihood and impact, each on a Scale of 1 to 5;
• shows a table of the scale, from 5 = Very High down to 1 = Very Low, with the risk score range and the significance that goes with each row.

The register

The register itself is headed Risk Register. It starts on a new page. Risks are grouped first by department, under a row such as DEPARTMENT: FINANCE, and then by category, under a row such as Category: Financial Risk.

The IPSAS Readiness Risk Report

This report has no introduction page, even if Include Introduction Page is switched on. Its table is headed “Accrual basis IPSAS readiness risk register”. Unless you are the CEO, your department’s name follows in brackets. Risks are grouped by category only.

It includes only risks tagged as IPSAS readiness risks. See IPSAS readiness risks.

The columns

Both reports use the same columns.

Column	What it shows
Risk Code	The risk’s code, as shown in the risk register.
Risk Description	The risk’s description.
Risk Status	The risk’s status, such as New or In Progress.
Impact (1-5)	The impact score and its name, for example “4 (High)”.
Likelihood (1-5)	The likelihood score and its name.
Risk Score (1-10)	The risk’s score, shaded by its significance. It can have decimals. See How risk scores work.
Significance	A word for how serious the score is, in capitals and shaded (see below).
Financial Exposure	The possible loss if the risk happens, in N$.
Affected Departments	The departments the risk would affect.
Implications	What happens to the organisation if the risk happens.
Controls	The description of each of the risk’s controls.
Mitigation Deadline	The risk’s Mitigate by date.
Oversight Responsibility	The risk’s owner (the person who recorded it) in bold, then its responsible people.

Significance

The Significance column turns the risk score into one of five words. The score cell and the significance cell are shaded with the same colour, from green for the least serious to deep red for the most serious.

Risk score	Significance	Shading
Up to 2	NEGLIGIBLE	Light green
Over 2, up to 4	MINOR	Pale yellow
Over 4, up to 6	MODERATE	Orange
Over 6, up to 8	SIGNIFICANT	Light red
Over 8, up to 10	SEVERE	Deep red

Let wel

On screen, VirgilTrack describes risk levels as Low, Moderate, High and Critical. The reports use the five words above instead. The score is the same in both.

Related

• Make a risk report
• How risk scores work
• The risk register