Risk Strategy

Board-Ready Risk Reporting: An Editable Executive Deck

An editable executive risk deck with a blank template, completed illustrative example and guidance on decisions, evidence, authority and follow-up.

By Eric Kennedy · Originally published Thu Jun 25 2026 · Updated Fri Sep 25 2026 · 9 min read

A board risk report should make it easy to see which exposures need attention, what management is doing, and where directors need to challenge an assumption or make a decision. Keep the executive view short enough to discuss. Preserve the evidence, limitations and operating detail in the pre-read or appendix.

The difficult part is deciding what belongs in that summary. A stable risk can still be material. An action marked complete may not have reduced the exposure. A funding request can look attractive only because its most important assumption has disappeared from the slide.

This guide includes an editable executive risk deck and a completed example. The template starts with the decision, retains an enterprise view, and follows one exposure through its assumptions, financial consequence and follow-up.

Download the executive risk reporting deck

Both PowerPoint files contain seven editable slides with native text, tables, a risk-chain diagram and a milestone timeline. The completed example also includes an editable financial chart. The blank deck uses input prompts rather than invented chart data. Presenter notes explain how to complete each slide and what to check before it reaches the board. There is no email gate.

Download the blank executive deck (PowerPoint)

Download the completed illustrative deck (PowerPoint)

View the blank deck PDF · View the illustrative deck PDF

Download the complete deck kit (ZIP), including both PowerPoint files, both PDFs and a quick-start guide.

Start with the completed example, then work in a copy of the blank deck. Replace every bracketed prompt, confirm your organization's actual approval authority, and name the people accountable. Keep the assumptions and uncertainty that could change a decision. Seven slides are a starting structure, not a prescribed board agenda; add material evidence when the subject requires it.

What the seven slides are for

1. Executive summary: the decision or oversight question, management's recommendation, the deadline and current approval status.
2. Enterprise risk overview: selected exposures tied to objectives, direction, accountable owners, evidence and the next step. Identify material omissions or common dependencies.
3. Risk chain and changed assumptions: trace the trigger, transmission, constraint and financial outcome, then state the previous basis, new evidence and uncertainty.
4. Financial exposure and assumptions: the calculation, period, units and exclusions. Keep response expense separate from the consequence it is meant to address.
5. Response options: feasible alternatives on the same basis, with costs, conditions and a recommendation.
6. Milestones and escalation: evidence and decision deadlines, the next review, and operational triggers with an exact boundary, recipient and response time.
7. Decisions and actions: named owners, dates, evidence needed and the next review. Distinguish a proposal from an approval and an implemented response.

Use the Agenda Test to choose what earns discussion: what changed, what could break the plan, what needs a decision. A risk may warrant oversight even when no formal resolution is needed. Directors can challenge the evidence, request further analysis or require management to revisit an assumption.

Keep the enterprise view, then explain the decision

A board needs enough context to know whether the selected item is the right one to discuss. The overview should show the significant exposures and their movement, while the deeper pages explain the item requiring attention.

Direction and magnitude are separate judgments. “Stable” does not mean small or acceptable. “Uncertain” can mean evidence is missing, not that an exposure is moderate. If a recovery test is stale, say so rather than leaving the old green rating untouched.

A concise report also needs somewhere for material supporting information to live. Removing a detail from the summary should not make it unavailable to directors. Keep the relevant register, analyses, test results and prior commitments accessible in the pre-read.

The same discipline applies to risk ownership. Name the executive accountable for coordinating the response and escalating constraints. Then identify the people who will perform specific actions. A risk owner and an action owner are not always the same person.

Worked example: a conditional funding request

Illustrative scenario. Every company, figure, date, threshold and role in this example is constructed. It does not describe a KRG client engagement.

A manufacturer with $200 million in annual revenue is preparing its report as of September 25, 2026. A supplier reports a four-week delay. That puts $12 million of October orders at risk because a substitute cannot be qualified before the shipments are due.

The KRG Risk Chain is visible: the trigger is the supplier delay; transmission runs through interrupted assembly and late shipment; the constraint is the time needed to qualify a substitute; the financial outcome is October contribution at risk.

The overview also includes two qualitative exposures. R-02, system recovery, is uncertain because the evidence is stale; the CIO must schedule a new test and report results before changing the assessment. R-03, finance coverage, is stable because backup coverage remains in place; the CFO must reassess if the trained backup becomes unavailable. Neither label means the risk is low. These selected examples do not represent a complete risk inventory.

The financial comparison in detail

For R-01, supply, Finance assumes a 30 percent contribution margin. Procurement believes an expedited allocation could protect $8 million of October shipments, but written confirmation is still pending.

These figures are conditional exposure estimates, not expected losses or proven savings. No probabilities have been assigned. Delayed shipments may move contribution between periods rather than eliminate it. Finance still needs to check cancellations, margin, cost behavior and cash timing. Revenue and contribution should not be added together as separate losses.

The request and its conditions

Management asks for an expense cap of $250,000 by September 28. In this example only, management's delegated authority ends at $100,000, so the request requires board approval. Approval is pending as of the reporting date.

The recommendation is to release spending only after written supplier allocation and a feasible production schedule are confirmed. Confidence is medium because that evidence remains open. Operations expects recovery, while Finance requires confirmation. Showing $1.2 million as the current verified exposure would get ahead of the facts.

Keeping the current plan requires no expedite expense but leaves up to $3.6 million of October contribution at risk in the scenario. Expediting could leave $1.2 million at risk, excluding the response expense, if the conditions hold. Qualifying a substitute cannot protect October; its cost and scope need a later decision. An unpriced alternative should remain explicitly unpriced.

What happens after the meeting

The COO owns the exposure. By September 28, the Procurement Director must secure written allocation and map it to orders, the CFO must review margin and cash timing, and the Operations Director must confirm the production and freight schedule. The Corporate Secretary records the decision and its conditions. These actions remain open or pending in the example.

Procurement checks daily. If written commitment is absent by September 28 at noon Central, Procurement informs the COO and CFO that day, before the decision deadline. If the response forecast leaves more than $1.2 million of October contribution exposed, the COO and CFO review the plan and notify the board chair within one business day. If proposed expense exceeds $250,000, the CFO seeks renewed approval before an additional commitment.

The next COO review is October 2, or earlier when a trigger is met. Verify actual shipments before reporting that the response worked. These are constructed decision conditions, not a company-wide risk appetite policy.

For a way to develop this evidence before drafting slides, use the risk workshop playbook. Its blank scenario sheet and decision record feed the same example.

Reporting supports oversight; it does not prove compliance

The report needs an operating process behind it: people who surface information, directors who consider it, and follow-through when something needs attention.

In the Delaware Supreme Court's June 19, 2019 Marchand v. Barnhill decision, the court reversed dismissal of an oversight claim concerning alleged failures in board-level food-safety monitoring. It addressed the need for a good-faith effort to establish reasonable board-level monitoring and reporting. This was a pleading-stage decision, not a final finding of director liability.

That case does not prescribe this deck or establish one legal rule for every board. Duties depend on the entity, jurisdiction and circumstances. A reporting template cannot demonstrate legal compliance by itself; legal questions belong with counsel.

HM Treasury's Orange Book also calls for regular, balanced reporting on principal risks and the effectiveness of risk management. Its scope is UK government organizations. It is useful guidance to consider, not a requirement imposed on KRG's mid-market audience.

Keep a recognizable format and a responsive cadence

A recurring structure helps directors compare changes and follow earlier commitments. Agree the regular review cycle with the board or committee, then define what requires an earlier escalation. A quarterly meeting should never become a reason to hold a material development until quarter-end.

The one-page view above illustrates the summary concept. Use the editable deck when the decision needs room for evidence, alternatives and conditions. Neither format should force a significant risk into an unreadable box.

The counterpoint is that some matters need a longer paper, a specialist briefing or a separate meeting. Mission-critical safety, regulatory issues and a major transaction may require depth that a standard template cannot supply. Concision is useful only while the information remains sufficient for oversight.

Put the template to work

Take the next decision your board needs to consider and complete the blank summary slide first. If you cannot state the request, authority, conditions and deadline, gather that information before polishing the rest of the deck. Review the presenter notes and replace all illustrative assumptions before use.

If the exercise exposes gaps in the underlying reporting process, the scorecard provides a starting assessment of your current board reporting.

Take the Board-Ready Scorecard