Domain 2 of the CRISC exam focuses on risk response and reporting, and within that, the sub-topic of risk assessment outputs and reporting is where theory meets real-world action. This concept solves the problem of how raw risk data gets turned into clear, actionable information that non-technical leaders can use to make decisions. For someone studying CRISC, understanding this process is essential because the exam will test not just what these outputs are, but how they support the entire risk management lifecycle.
Jump to a section
A simple way to picture Risk Assessment Outputs and Reporting
What do you do after a home inspector has crawled through your attic, poked at the foundation, and tested every tap in the house? You don't just want a vague 'it seems okay' — you need a written report that tells you exactly what is wrong, how serious each problem is, and what it will cost to fix. That report is the output of the inspection, and it drives every decision you make about buying or renovating the house.
In the world of information systems, a risk assessment works the same way. You don't just identify risks — you produce formal outputs that document each risk, its likelihood and impact, and the recommended response. These outputs become the basis for executive decisions about budgets, priorities, and security investments. Just as a home inspection report might tell you that a cracked foundation is a 'critical' issue requiring immediate repair while a sticky window is 'low' priority, a risk assessment report rates and prioritises risks so that decision-makers know where to focus their money and effort.
The specific outputs include a risk register (the master list of all identified risks, their scores, and ownership), risk heat maps (colour-coded charts that visually show high-priority risks), and risk treatment plans (action plans for addressing each risk). Without these documented outputs, stakeholders cannot make informed decisions — they are flying blind, just as you would be if the home inspector just nodded and said 'you have some issues' without giving you the written report.
Risk assessment outputs are the formal documents and visual tools that capture the results of a risk assessment. They translate complex technical findings into a language that business leaders, board members, and stakeholders can understand and act upon. Without these outputs, risk assessment is just an academic exercise — it has no practical value.
The primary output is the risk register. A risk register is a living document, usually a spreadsheet or database, that lists every identified risk. For each risk, it records: a unique identifier, a description of the risk, its likelihood (how probable it is to occur), its impact (the potential damage if it does occur), the inherent risk level (risk before any controls), the residual risk level (risk after controls), the risk owner (the person responsible for managing it), and the planned risk response (avoid, accept, mitigate, or transfer). The risk register is the single source of truth for the organisation's risk posture.
Next is the risk heat map. This is a visual representation of the risk register. It uses a grid where one axis represents likelihood and the other represents impact. Each risk is plotted as a point on the grid, colour-coded: green for low risk, yellow for moderate, orange for high, and red for critical. A heat map allows executives to instantly see where the most dangerous risks sit. It is a communication tool, not a detailed analysis tool — it answers the question 'where should we look first?'
Then there is the risk assessment report. This is a narrative document that summarises the entire risk assessment process. It includes:
The scope of the assessment (which systems, processes, or departments were evaluated)
The methodology used (how risks were identified, analysed, and evaluated)
The key findings (a summary of the most significant risks)
The detailed results (often referencing the risk register and heat map)
Recommendations for treatment and remediation
An executive summary for senior leadership
The risk treatment plan documents the specific actions that will be taken to address each risk. For each risk that is not accepted, the treatment plan outlines: the chosen response (e.g., implement a firewall, train staff, buy insurance), the timeline for implementation, the budget required, and the owner responsible. This plan turns the assessment into action.
Why do these outputs matter? They replace informal, anecdotal decision-making with structured, data-driven governance. In a small business, a manager might say 'I think our customer data is pretty safe' based on gut feeling. In a regulated organisation, that is not acceptable. The risk register, heat map, report, and treatment plan provide an auditable trail that demonstrates due diligence. Regulators, auditors, and board members require this documentation to verify that the organisation is managing risk properly.
The process typically follows a cycle: assessment produces outputs, outputs inform decisions, decisions lead to actions, and then the next assessment updates the outputs. This makes risk management a continuous improvement loop, not a one-time event.
Identify and Catalogue Risks
During the risk assessment, the risk manager identifies all potential threats to the organisation's information systems. Each risk is documented in a risk register with a unique ID, description, and its initial likelihood and impact ratings. This step captures the raw data that all subsequent outputs will draw from.
Analyse and Score Risks
The risk manager evaluates each identified risk to determine its inherent risk score (likelihood multiplied by impact). This analysis might use quantitative methods (numeric values based on financial impact) or qualitative methods (descriptive scales like 'high', 'medium', 'low'). The scores are recorded in the risk register.
Create the Risk Heat Map
Using the scores from the risk register, the risk manager plots each risk on a heat map grid. Risks with high likelihood and high impact land in the red zone, while low-scoring risks land in the green. The heat map is a visual tool designed to communicate priorities to decision-makers at a glance.
Write the Risk Assessment Report
The risk manager compiles a formal report that summarises the assessment process, scope, methodology, key findings, and recommendations. The report includes an executive summary written in non-technical language for the board and senior management, plus detailed appendices (the register and heat map).
Develop the Risk Treatment Plan
Based on the findings in the report, the risk manager designs a treatment plan for each risk that will be mitigated, transferred, or avoided. The plan specifies the action, deadline, budget, and owner. This document turns the assessment outputs into actionable steps that the organisation can execute.
Present Outputs to Stakeholders and Update Continuously
The risk manager presents the report, heat map, and treatment plan to the appropriate stakeholders (board, management, audit committee). After approval, the outputs are treated as living documents. As controls are implemented, the risk register is updated with new residual scores, the heat map is recoloured, and the treatment plan status is tracked.
Meet Priya, the IT risk manager at a mid-sized e-commerce company called ShopNow. ShopNow processes credit card payments for 200,000 customers and stores personal data including names, addresses, and purchase histories. The company is not in a heavily regulated industry, but it wants to prepare for an upcoming PCI DSS (Payment Card Industry Data Security Standard) audit.
Priya conducts a risk assessment focused on the payment processing system. She interviews the development team, reviews system configurations, and analyses recent security logs. She identifies several risks:
The payment server is running an outdated operating system that has known vulnerabilities (critical).
Customer data is encrypted during transmission but not when stored at rest (high).
Employees can access the customer database using shared logins instead of individual accounts (medium).
The backup system has not been tested in six months (low).
Priya documents each risk in the risk register. For each, she assigns a likelihood (from 1 to 5) and an impact (also 1 to 5). The outdated OS scores 5 for likelihood (it is actively exploited in the wild) and 5 for impact (a breach could expose all customer data and invite fines). That gives an inherent risk score of 25 (5x5), which is critical. The backup testing scores 2 for likelihood and 2 for impact, yielding a score of 4, which is low.
She plots these on a risk heat map. The critical risks appear in the red zone in the top-right corner. The low risks sit in the green bottom-left. She presents this heat map to the executive team during a quarterly risk review meeting. The CEO, who has no technical background, immediately sees that the old server is a burning platform that needs funding now.
Priya then writes the risk assessment report. She includes an executive summary that states in plain language: 'Our payment server poses an urgent risk. If exploited, it could result in a data breach costing an estimated £1.2 million in fines, legal fees, and customer compensation. We recommend allocating £50,000 to replace the server within 30 days.' She attaches the risk register and heat map as appendices.
The board approves the budget. Priya creates a risk treatment plan with specific action items:
Purchase and configure a new server (deadline: 2 weeks)
Migrate data and applications (deadline: 4 weeks)
Update encryption for data at rest (deadline: 6 weeks)
Implement individual user accounts and access controls (deadline: 8 weeks)
Test the backup system and schedule quarterly tests (deadline: 10 weeks)
Each action has an owner and a status column. Priya updates the risk register every month to reflect progress: as controls are implemented, the residual risk scores drop. The heat map changes colour over time. Six months later, the outdated server risk has moved from red to yellow because the new server is in place. The once-critical risk is now tolerable.
Without these outputs, the board would not have understood the urgency, and the money might have been spent on a new office coffee machine instead of security. The documented outputs also satisfy the PCI DSS auditor, who reviews the risk register and treatment plan to confirm that ShopNow is proactively managing risks.
CRISC loves to test your understanding of the purpose and content of risk assessment outputs. You will not be asked to memorise formats, but you will need to know what each output contains and why it exists.
Key exam topics:
The difference between a risk register, risk heat map, risk assessment report, and risk treatment plan. The exam will present a scenario and ask which document the risk manager should use. For example: 'Which output would you present to the board to quickly communicate the most significant risks?' The answer is the risk heat map, because it is visual and designed for non-technical audiences.
The order of operations: risk assessment outputs are created after the risk analysis phase but before the risk response phase. The outputs inform the response. A trap question might describe a scenario where the risk manager documents responses before completing the assessment — that is wrong.
The components of a risk register: you must know that it includes inherent risk, residual risk, risk owner, and risk response. The exam loves to list incomplete options that omit one of these elements.
The purpose of documenting the risk assessment methodology: this is to ensure repeatability and auditability. A common trap is an answer that says the methodology is documented to impress regulators — the correct reason is to allow the assessment to be reproduced by a different assessor.
The role of the executive summary in the risk assessment report: it summarises findings for senior leadership who do not read the full report. The exam may test that the executive summary should be written in non-technical language.
Residual risk reporting: the exam will assess that residual risk must be reported to management so they can decide whether to accept it. Some candidates mistakenly think residual risk is reported only to the risk owner — the correct answer is to management.
Common trap patterns:
Confusing the risk register with the risk assessment report. The register is a detailed list; the report is a narrative summary. The exam may say 'the risk register includes an executive summary' — that is false.
Thinking that risk treatment plans are part of the risk register. They are separate documents, though they reference each other.
Assuming all risks must be mitigated. The exam emphasises that some risks are accepted, and the risk register should document that acceptance with the approving owner.
Key definitions to memorise:
Inherent risk: the level of risk before any controls are applied.
Residual risk: the level of risk after controls are implemented.
Risk register: the central repository of all identified risks.
Risk heat map: a visual tool for prioritising risks.
Risk treatment plan: the action plan for responding to risks.
The risk register is the central repository that captures every identified risk, along with its likelihood, impact, inherent and residual scores, risk owner, and planned response.
Risk heat maps visually plot risks on a likelihood-versus-impact grid, using colour coding to help non-technical leaders quickly identify the highest priorities.
The risk assessment report is a narrative document that summarises the entire assessment for senior management, including scope, methodology, findings, and recommendations.
Risk treatment plans are separate documents that outline specific actions, timelines, budgets, and owners for each risk that is not accepted.
All risk assessment outputs must be written in language appropriate for their audience: technical detail in the register, visual simplicity in the heat map, and business terms in the executive summary.
Risk assessment outputs are living documents that must be reviewed and updated regularly as threats change, controls are implemented, and new information emerges.
Documenting the methodology used in the assessment ensures that the process is repeatable and can be audited by regulators or external reviewers.
Residual risk after controls are implemented must be reported to management, who then decide whether to accept that remaining level of risk or require further treatment.
These come up on the exam all the time. Here's how to tell them apart.
Risk Register
A detailed, itemised list of every identified risk with scores, owners, and status.
Used by risk managers and operational teams for day-to-day tracking and updates.
Contains technical details such as likelihood and impact ratings for each risk.
Risk Assessment Report
A narrative document summarising the entire assessment, including scope and conclusions.
Used by senior management and the board for strategic decision-making.
Written in business language with an executive summary that omits granular technical data.
Inherent Risk
The level of risk before any controls are applied.
Calculated during the initial assessment phase before mitigation is considered.
Represents the raw exposure the organisation faces from a threat.
Residual Risk
The level of risk remaining after controls are implemented.
Calculated after the risk treatment plan is executed and controls are in place.
Represents the actual exposure the organisation lives with, which management must accept or treat further.
Risk Treatment Plan
A detailed action plan with specific tasks, deadlines, budgets, and owners.
Created after the risk assessment outputs are finalised.
Focused on implementation: what will be done, by whom, and by when.
Risk Response Strategy
The high-level decision of how to handle a risk: avoid, accept, mitigate, or transfer.
Decided during the risk evaluation phase before detailed planning.
Focused on strategy: which option to choose for each risk category.
Risk Heat Map
A visual tool that plots risks on a colour-coded grid for communication.
Used primarily for presentation to non-technical stakeholders.
Does not replace detailed scoring; it is a summary view.
Risk Scoring Matrix
A defined table or formula that assigns numeric or qualitative values to likelihood and impact.
Used by risk analysts during the assessment to assign scores to each risk.
The underlying tool that generates the data used to create the heat map.
Acceptable Risk
A risk level that the organisation has formally decided to accept without further action.
Documented in the risk register with an approving owner's sign-off.
Represents a conscious decision that the potential impact is within the organisation's appetite.
Tolerable Risk
A risk level that is higher than acceptable but still below the threshold that requires immediate mitigation.
Often monitored with periodic review but not actively treated unless conditions change.
Represents a zone where the organisation can operate with caution and ongoing awareness.
Mistake
The risk register and the risk assessment report are the same thing.
Correct
The risk register is a detailed list of every identified risk with scores and ownership, while the risk assessment report is a narrative document that summarises the assessment process, key findings, and recommendations. They serve different purposes and are used by different audiences.
Beginners often think 'documentation is just one big file' and conflate two distinct outputs because both come from the same activity.
Mistake
Once a risk is documented in the risk register, it is fixed and never changes.
Correct
The risk register is a living document that is updated continuously as new risks emerge, controls are implemented, and the environment changes. Residual risk scores are recalculated after each control is deployed.
People new to risk management often view documentation as static, like a final exam paper, rather than a dynamic tool that evolves with the organisation.
Mistake
The risk assessment report is written primarily for technical teams like IT security.
Correct
The primary audience for the risk assessment report is senior management and the board. It must be written in business language, not technical jargon, so that executives can make informed decisions about resource allocation.
Beginners assume that since the assessment is technical, the report must also be technical. In reality, its value is in translating tech findings into business terms.
Mistake
Risk heat maps are used to calculate risk scores precisely.
Correct
Risk heat maps are used for visual communication and prioritisation, not precise calculation. The actual scoring happens in the risk register using defined likelihood and impact scales. The heat map is just a representation.
Because heat maps look mathematical with their grids and colours, beginners think they are calculation tools rather than presentation tools.
Mistake
The risk treatment plan is created before the risk assessment is complete.
Correct
The risk treatment plan is created after the risk assessment outputs (the risk register, heat map, and report) are finalised. It depends on the assessment to identify which risks need treatment and what priority they hold.
Newcomers confuse the sequence because they want to jump straight to 'fixing things' without completing the analysis first. The exam tests process order heavily.
Mistake
Only critical risks need to be documented in the risk register.
Correct
All identified risks, regardless of severity, should be documented in the risk register. Low risks may be accepted, but they still need an entry to show that they were considered and a conscious decision was made.
Beginners assume documentation is only for important things, but risk management requires evidence that every risk was evaluated — even the ones that seem trivial.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A risk register is a detailed list of every identified risk with scores, owners, and responses. A risk assessment report is a narrative document that summarises the entire assessment, including scope, methodology, conclusions, and recommendations for an executive audience.
The primary audience is senior management and board members who need a quick, visual understanding of the organisation's most significant risks. It is designed for non-technical decision-makers, not for detailed analysis.
Yes, every identified risk — even low-priority ones that are accepted — should be documented. This demonstrates due diligence and ensures that no risk was overlooked or dismissed without conscious decision.
Risk assessment outputs should be updated continuously or at least quarterly, depending on the organisation's risk management policy. They are living documents that change as new risks emerge, controls are deployed, and the business environment evolves.
While the risk register may include a column for the planned response, the full details of the treatment plan (timeline, budget, specific actions, owner) are typically documented in a separate treatment plan document for clarity and accountability.
Residual risk is the level of risk that remains after controls are applied. Management must see it so they can decide whether to accept that remaining risk or invest in additional controls. It is a key output of the risk assessment process.
Documenting the methodology ensures that the assessment is repeatable and can be audited. It also helps stakeholders understand how risks were identified and scored, building trust in the results.
You've finished Risk Assessment Outputs and Reporting. Continue through the CRISC study guide to build a complete picture of the exam.
Done with this chapter?