Enterprise Risk Management

How to Interview Executives for an ERM Risk Assessment

A practical method for one-to-one executive risk interviews: preparation, a 30-minute agenda, six questions, evidence capture and keeping disagreement visible.

By Eric Kennedy · Tue Nov 03 2026 · 9 min read

For an executive risk interview, bring the business plan, ask where it could fail, and leave with an evidence request and a decision to inform. A list of concerns is only the starting point.

The deliverable is a short record of the commitment at risk, the assumptions behind it, the evidence still needed and the decision deadline. The method below is designed for one-to-one conversations during an enterprise risk assessment. It gives you six questions and a suggested agenda you can use in the next interview.

Prepare around a decision, not an org chart

Start by naming the decision the interviews will inform and the time horizon. "Refresh the risk register" is too loose. "Inform next year's operating plan and capital priorities" tells the executive what kind of risk matters and how far ahead to look.

Send a short note in advance: the purpose, the decision, the horizon, and one page of pre-read, usually the current plan commitments or last cycle's top exposures. Ask them to come with one commitment they worry about. Share the main questions if they will help the executive bring relevant records. In the meeting, follow the evidence rather than reading the script.

Choose interviewees by objectives and dependencies, not seniority alone. If the plan depends on a supplier transition, the person who owns that transition belongs on the list even if they sit two levels below the executive team. After the executive round, schedule short validation conversations with the operators who run the processes executives described. Ask them to show the records or work that would confirm whether the response is operating.

Be specific about confidentiality. Explain who will see the notes, how comments will be attributed in the summary, and that matters involving possible legal, regulatory or conduct issues will be routed through existing escalation and reporting channels. Do not promise absolute confidentiality. State the limits before asking for sensitive information. Do not record without asking first, and accept a no.

A 30-minute risk interview

Use this suggested working agenda as a starting point, not a staffing or performance benchmark. Some interviews will need longer, and a follow-up is better than a rushed close.

• 5 min, Objective: Confirm the commitments this executive is accountable for and the decision the interview informs.
• 15 min, Uncertainty and response: Explore what could stop those commitments holding, what is being done today, and what shows it works.
• 5 min, Evidence gaps: Agree what records or information would confirm or challenge what was said, and who holds them.
• 5 min, Read-back and follow-up: Summarize what you heard in their words, confirm the meaning, and name the follow-up items, owners and dates.

Use two people where you can, one asking and one capturing. The note taker should record the executive's own words for anything material, and separate what was stated as fact from what was offered as opinion. That distinction is hard to recover afterward.

Six questions and how to follow them up

These are prompts, not a questionnaire. If the first answer opens a real issue, stay with it.

1. "Which commitment is hardest to deliver?" Start with their plan, not a risk category. Follow up with: why that one, what has changed since it was set, and what happens to other commitments if it slips.

2. "What has to remain true for that commitment to hold?" This surfaces assumptions: a hire, a customer approval, a system date, a price. Ask which of those assumptions they have tested and which they are taking on trust.

3. "Where would the first sign of trouble appear?" You are looking for an observable signal and the person who would see it first. If the answer is "in the quarterly results," ask what would show up earlier and who watches it.

4. "What response is operating today, and what shows it works?" Separate the response that exists from the one that is planned. Then ask what evidence would confirm it is working. "The team is on it" is a description, not evidence.

5. "Who sees this differently, and what would resolve the difference?" Use the answer to identify another perspective to hear and evidence to request.

6. "What decision needs this information, and by when?" Tie the risk back to a date and a decision-maker. If nobody needs the information for a decision, it may still be worth recording, but it should not crowd out the items that do.

Two topics are easy to miss. Ask about upside: where could the plan do better than expected, and what would the business need to be ready for it? And ask about inaction: what happens if nothing changes for two or three years? Fold these into the conversation rather than adding a second script.

Throughout, push for one concrete example. If an executive says "cyber" or "talent," ask for a specific system, role or week when it would hurt. Avoid leading questions such as "Is the supplier transition your biggest worry?" Ask what worries them and let them name it.

When two executives disagree

ILLUSTRATIVE SCENARIO

This is a constructed example, not a KRG client engagement or result. The CFO says a customer launch is on plan. In a separate interview, the operations lead says qualification evidence for the launch is incomplete.

The tempting move is to score both views and average them, or let the more senior voice win. Neither helps the person deciding the launch. Instead, break the disagreement into its parts:

• Fact to verify: The qualification record has not been supplied. That is a fact about the evidence, not a finding that qualification failed. The record may exist.
• Assumption: The plan assumes approval arrives before launch.
• Judgment: The CFO judges that the schedule buffer is sufficient. The operations lead has not agreed.
• Decision: Retain the launch date or change the sequence.

Keep the disagreement visible. Agree an evidence owner and due date for the qualification record, and name who makes the decision once it arrives.

The interviews alone do not establish which assessment is sound. Report the disputed assumption and evidence gap alongside the launch status. If resolving the issue requires several functions in one room, use the enterprise risk workshop guide and its editable playbook to structure that follow-up.

Turning notes into a usable synthesis

Before consolidating the notes, decide what the summary must preserve.

Keep a material minority view. If one executive raises an exposure nobody else mentions, that may be because they are the only one close enough to see it. Use the attribution rules explained at the start. A role can identify someone just as clearly as a name, especially in a small executive team.

Merge items only when they share the same underlying cause and exposure. Three executives who say "supply chain" may be describing three different problems. Combining them makes the summary shorter and less accurate.

Report disputed assumptions as their own items, as in the scenario above. A decision-maker needs to see where leaders disagree, not a consensus that was produced by the summary.

For each material statement, identify the supporting evidence or an unresolved evidence request. "Response in place" should be followed by what would confirm it and who will supply it.

Use the read-back to confirm meaning, not to approve content. An executive can correct how you understood them. They should not be able to remove an inconvenient evidence gap or another leader's view.

And if an interview surfaces something urgent, such as a possible compliance breach or an imminent operational failure, route it through existing escalation now. It does not wait for the annual summary.

If interviews will feed audit planning, see How to Connect ERM to Your Internal Audit Plan for how assessed risks inform audit priorities.

Where interviews fall short

Interviews are expensive in executive time, and they are selective. You hear from the people you chose, filtered through what they are willing to say to you. Politics shape answers, and a well-prepared executive can steer a 30-minute conversation.

Use them for depth with the people whose commitments and judgments matter most. Use a survey when you need breadth across many managers. Use operational records, data and testing when you need to verify a claim. An interview tells you what someone believes and why. It is not audit assurance, and it should not be reported as if it were.

Keep the process light. Start with a clear purpose note, useful questions and disciplined notes. Add process only where it solves a specific problem, such as inconsistent attribution or missed follow-up.

Evidence behind the method

NC State's 2023 interview with HCA Healthcare's David Hughes describes conversations organized around strategic and financial objectives, current responses and their sufficiency, with attention to longer-term risks. Its 2011 archived account describes individual interviews with a questioner and note taker, timed before planning. These are practitioner accounts from a large healthcare organization, not evidence that interviews outperform surveys or a mid-market benchmark.

The UK government's Orange Book, updated July 29, 2026, supports using enquiry and evidence, considering different views, protecting information appropriately and explaining evidence limitations. See sections C3 to C5 and D5. It is UK public-sector guidance, not a private-company legal requirement. The agenda and questions here are proposed working methods, not requirements of that guidance.

Once interviews identify the decisions that matter, the next question is whether your current risk reporting makes those decisions clear to the people who have to make them. The Board-Ready Risk Reporting Scorecard is a quick way to check.

Take the Risk Reporting Scorecard