Risk Disclosure in Writing

Risk disclosure in board writing is not a legal formality. It is the mechanism through which boards fulfill their fiduciary duty to govern. A board that approves a decision without adequate written disclosure of material risks has not governed — it has rubber-stamped. The writer of board materials is therefore a participant in the governance process, not just a communication professional. The quality of the risk section determines the quality of the board's ability to govern.

1. Identify risks by category Organize risk disclosure around recognized categories: financial risk, operational risk, legal and regulatory risk, reputational risk, and strategic risk. The categorization helps board members with specific oversight responsibilities locate the risks relevant to their role. A board member who chairs the audit committee should be able to scan the risk section and immediately locate financial and legal risks. Category structure makes this possible.
2. Quantify where you can, qualify where you cannot Risk that can be quantified should be quantified: probability ranges, financial exposure, regulatory penalty ranges. Risk that cannot be quantified should be qualified with a severity rating and a rationale: "This risk is assessed as low probability but high severity because..." Avoid the neither-quantified-nor-qualified risk statement that reads as boilerplate: "reputational damage could occur." Every risk statement should give the board something to evaluate.
3. State the mitigants honestly The mitigant section is where management credibility is made or lost. Board members with experience know that most risks cannot be fully mitigated. A mitigant section that resolves every risk with confident language will be read as wishful thinking. State the mitigant specifically, state its limitation honestly, and state what residual risk remains after the mitigant is applied. The board's job is to decide whether the residual risk is acceptable. Give them what they need to make that assessment.