How to communicate risk to your board

Boards judge good risk communication on four things: completeness, credibility, actionability, and balance. The board is not judging whether you understand the risks — it is judging whether you communicate them clearly enough for it to act. Two different things. The second is rarely trained.

Why it is four things, not one

Risk communication is not a single skill. It is four skills working together. You can be strong on completeness — every material risk included — and weak on actionability, because there is no plan against each one. Or strong on balance, showing both upside and downside, but weak on credibility, because the ratings are too optimistic.

This is why the assessment cannot be reduced to one number or one question. The board looks at each dimension separately — and it is the combination that determines whether you come across as a credible sounding board, or as someone who presents well but has gaps underneath.

The good news: the four dimensions can be improved separately. You can shift 5 to 8 points on one of them without touching the others. You don't have to fix everything at once.

Completeness — are all material risks included?

A risk that isn't mentioned is a risk the board cannot act on. The first question a director typically asks themselves — usually without saying it out loud — is: "what are we not being told?" If a director hears about a customer dispute or supplier issue from a source other than the CEO, credibility takes a hit — no matter how good the rest of the material is.

The four dimensions in practice:

• Completeness: Are the top five risks included? Including the awkward ones?
• Credibility: Does the description match what you actually believe? Are the ratings honest?
• Actionability: What is being done about each risk? Who owns it? When is the plan reviewed?
• Balance: Are both upside and downside shown? Or only the side that supports your recommendation?

Credibility — the dimension that most often slips

Credibility drops when the CEO smooths things over. Classic example: a risk the CEO labels "moderate", but describes as an existential threat. The board sees the mismatch. It quickly adjusts the rating in its own head — and notes that the CEO isn't being straight about the level.

The rule is simple: better to rate a risk too high than too low. Too high reads as prudence. Too low reads as playing it down.

Actionability — risk without a plan is just information

Every material risk should be presented with three things:

1. What is the consequence if it happens? A concrete number, not "material impact".
2. What is the likelihood? Low / medium / high — or a percentage.
3. What is the plan? Who owns it, when is it reviewed, and at what point does it escalate to the board?

A risk without a plan is a risk the board cannot approve. Then it either rejects the risk, reframes it, or has to add the plan during the meeting itself.

Balance — show the upside too

Many CEOs present risk defensively: only what could go wrong. That gives a skewed picture. If you're working on a major new contract, show both the risk of losing it and the gain if you win it — and what it would take. The board cannot judge how much risk the company is prepared to take without seeing both sides.

Example: from weak to strong risk wording

Same risk, two ways of writing it. The wording shifts the score — without changing the underlying risk at all.

Weak version (8 out of 25):

"Customer risk: We have a large customer. Likelihood of loss: low. Plan: good relationship."

What's missing: No numbers. No owner. No threshold. No comparison. The board has no view on the size, the warning signals, or who is following up.

Strong version (22 out of 25):

"Customer risk: Top customer A represents 28% of revenue (above the stated limit of 25%). The contract expires Q4 2026. Likelihood of non-renewal: medium (the customer has retendered twice before). Consequence if lost: €720K EBITDA impact in 2027. Owner: Sales Director Lars Nielsen. Plan: monthly relationship review, alternative contract draft in Q1 2026, active diversification towards three new key accounts. Escalates to the board if the customer has not confirmed start of negotiation by 1 July 2026."

The difference is not the length — it's the concreteness. Three numbers (28%, €720K, July 2026), one named owner, and one clear escalation point shift the risk from "something we're watching" to "something the board can act on".

Common traps you can avoid

Four phrases that pull the score down every time:

• "We've got it under control." The board can't verify that. Show how, instead.
• "The risk is moderate." Moderate compared to what? Use ranges, not adjectives.
• "Plan: stay alert." Staying alert is not an action. Write the actual action.
• "Management is following up." Which person? When? How often? Without names, it isn't a plan.

The honest test

Ask yourself three questions before sending the material:

1. Is there a risk I've chosen not to mention because it's uncomfortable?
2. Are the ratings more optimistic than they should be?
3. Is there a plan for each material risk — or just a statement?

If you can honestly answer no to all three, your risk communication is ready.