Enterprise risk reporting: exposure and action

Enterprise risk reporting puts assessed exposure, recorded losses, and overdue actions beside one another so management can decide where to intervene. Build each measure from its own approved export and use the same reporting date. A possible future loss, a booked loss, and an unfinished action answer different questions.

Start with approved register exports

Use the risk register your organization has already assessed and approved. This is a reporting exercise: it summarizes existing judgments rather than generating risk scores or certifying controls.

The IRS enterprise risk management guidance provides a useful public example: business-unit registers are aggregated for an enterprise perspective, with responsibilities for monitoring and reporting. That guidance governs the IRS; a company should apply its own approved definitions and responsibilities.

Collect three exports:

Keep risk IDs stable. A risk can have several actions or loss events; that does not create several copies of its assessed exposure. Summarize each export independently before placing its results alongside the others.

For a wider reporting package, use management reporting to decide where the risk summary belongs. Keep the detailed register available for questions about individual items.

Fix the cutoff and assessment basis

Consider Cedar Ridge Distribution, an illustrative US company, reporting at September 30, 2026. Its approved register contains the following stand-alone residual downside estimates for the same forward assessment horizon. Management has reviewed the scenarios for overlap and permits their subtotal as an inventory of assessed exposures, not an estimate of an aggregate loss outcome.

The loss register contains these September events:

The exposure subtotal is 350,000 + 250,000 + 150,000 = $750,000. Recorded losses are 18,000 + 6,000 = $24,000. Do not subtract one from the other: the assessments concern possible future outcomes, while these losses concern September events.

Where exposures share a supplier or customer dependency, show that relationship before presenting totals. Partner book concentration explains a specific concentration question; it should remain a separate analysis rather than becoming a new risk score here.

Count unfinished and overdue responses

For this report, an action is overdue when its due date is before September 30 and it remains open at that cutoff. An action due on September 30 is due today, not overdue. The status values below describe the historical snapshot, not whatever the live register says later.

In Excel, place this action table in A1:E7, with real dates in D and the cutoff in H1. Put a unit name in H3. These formulas count open actions and overdue open actions:

=COUNTIFS($C$2:$C$7,H3,$E$2:$E$7,"Open")
=COUNTIFS($C$2:$C$7,H3,$E$2:$E$7,"Open",$D$2:$D$7,"<"&$H$1)

Blank due dates need a separate exception list. Never turn them into an old date or quietly treat them as on time.

For the exposure table on a sheet named Risks, with unit in B and exposure in C, use:

=SUMIFS(Risks!$C$2:$C$4,Risks!$B$2:$B$4,H3)

Microsoft documents SUMIFS as adding amounts that meet specified criteria. Use the same approach on the loss table, selecting the event period before summing. Covirage is not affiliated with Microsoft.

Reconcile the business-unit report

Overdue actions are 2 / 5 = 40.0% of open actions, rounded to one decimal place. Use the count of open actions as the denominator; including the closed action would answer a different question.

The exposure column must tie to the approved risk register. Losses must tie to the scoped loss register and its supporting ledger references. Open actions must equal all action rows less closed rows: 6 - 1 = 5. The overdue list must contain A01 and A04 only.

Distribution has the largest assessed exposure, but Service has the same overdue count. Ask each owner what prevents completion before reallocating resources. For audit-originated remediation, the audit committee reporting dashboard adds distinct finding counts and verified closure status.

Where it goes wrong

• Repeating exposure for each action. Joining the registers at action level multiplies risk amounts. Aggregate each source first.
• Mixing assessment bases. Gross and residual exposure, different horizons, or different currencies cannot share an unexplained total.
• Treating low losses as low risk. A quiet month does not validate a forward assessment or prove controls effective.
• Rewriting history. A later completion or revised deadline must not change the frozen September snapshot.
• Leaving owners or dates blank. Report missing fields as exceptions so unfinished work does not disappear.

Review your risk exports in Covirage

Bring a sample of your own approved risk register, loss export, and action workbook. Covirage maps the columns, and its tools compute and check the unit summaries; the external AI model explains the results with every figure traced to its rows. Create a free Covirage account, then set up your business and bring your files.

See Covirage for compliance teams for the supporting reporting context.