When reporting risk assessment results to senior management, the most important information to include to enable risk-based decision making is the potential losses compared to treatment cost. This information helps to quantify the impact and likelihood of the risks, and to evaluate the cost and benefit of the risk responses. This information also helps to prioritize and allocate resources for the risk management program, and to align the risk management program with the enterprise’s objectives, strategy, and risk appetite. The other options are not as important as the potential losses compared to treatment cost, as they provide different types of information for the risk management process:
Risk action plans and associated owners are the documents that specify the actions to be taken to address the identified risks, the resources required, the timelines, the owners, and the expected outcomes. This information helps to implement and monitor the risk management program, and to assign the authority and accountability for the risk management activities.
Recent audit and self-assessment results are the outcomes of the independent and objective examination of the risk management program, such as by internal or external auditors, or by the risk owners or practitioners themselves. This information helps to provide assurance and feedback on the effectiveness and efficiency of the risk management program, and to identify the gaps or weaknesses that need to be addressed.
A list of assets exposed to the highest risk are the resources that have the most value for the enterprise, such as hardware, software, data, or services, and that are affected by or contribute to the highest risks. This information helps to identify and protect the critical assets of theenterprise, and to reduce the exposure and impact of the risks to the assets. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 2, Section 2.3.1.1, pp. 58-59.
