<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-board-level-risk-reporting
description: >-
  Develop executive and board-level risk reports that translate technical security risks into business impact language with KRIs, trend analysis, and strategic recommendations.
domain: cybersecurity
subdomain: governance-risk-compliance
tags:
  - board-reporting
  - executive-risk
  - kri
  - risk-dashboard
  - business-risk
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Performing Board-Level Risk Reporting

## Overview

Boards and executives need security risk communicated in business terms — financial impact, operational disruption, regulatory exposure. This technique covers building board-ready risk reports with KRI dashboards, trend analysis, and strategic recommendations that drive investment decisions.

Mode: `[MODE: ARCHITECT]` — Executive risk communication and board reporting.

## Prerequisites

| Requirement | Details |
|---|---|
| Risk register | Populated with current risks |
| KRI definitions | Key risk indicators defined |
| Python 3.10+ | For agent tooling |

## Workflow

### 1. Board Report Structure

```
Quarterly Security Risk Report:
├── Executive Summary (1 page)
│   ├── Overall risk posture: GREEN/AMBER/RED
│   ├── Material changes since last report
│   └── Key decisions requested from board
├── Risk Dashboard (1-2 pages)
│   ├── Top 5 risks with trend arrows
│   ├── KRI traffic light indicators
│   ├── Risk heat map (current vs. previous)
│   └── Treatment plan progress
├── Threat Landscape (1 page)
│   ├── Industry-specific threats
│   ├── Regulatory changes
│   └── Peer benchmarking
├── Investment Recommendations (1 page)
│   ├── Budget requests tied to risk reduction
│   ├── ROI of proposed controls
│   └── Cost of inaction scenarios
└── Appendix
    ├── Detailed risk register
    ├── Control maturity scores
    └── Compliance status by framework
```

### 2. KRI Dashboard Design

```
Board KRI examples:
├── Operational KRIs:
│   ├── Mean time to detect (MTTD): <4 hours
│   ├── Mean time to respond (MTTR): <24 hours
│   ├── Patch compliance rate: >95%
│   └── Security training completion: >90%
├── Risk KRIs:
│   ├── Open critical/high risks: trend ↑↓
│   ├── Overdue risk reviews: <5%
│   ├── Third-party risk score: >80/100
│   └── Exception count: trend ↑↓
└── Compliance KRIs:
    ├── Audit findings open: count + age
    ├── Regulatory changes pending: count
    ├── Framework compliance score: %
    └── Evidence collection timeliness: >95%
```

### 3. Business Impact Translation

```
Technical → Business language:
├── "SQL injection vulnerability" →
│   "Customer data breach risk — $2.4M estimated impact"
├── "Unpatched servers" →
│   "Operational disruption risk — 72hr recovery time"
├── "No MFA on admin accounts" →
│   "Regulatory non-compliance — $500K fine exposure"
└── "Third-party API insecure" →
│   "Supply chain attack vector — revenue impact $1.8M"
```

## Verification

- [ ] Process documented and approved
- [ ] Stakeholders identified and engaged
- [ ] Tooling configured and automated where possible
- [ ] Outputs reviewed and validated
- [ ] Reporting integrated into GRC program
- [ ] Periodic review schedule established
