A risk register tells a board what management is watching. It does not, by itself, tell directors what they may need to decide. A material risk becomes decision-ready only when the report shows the condition, the boundary for action and the response already assigned.
That judgment becomes governable only when three questions have answers: Who owns the response? Who checked the evidence? What happens when the boundary is crossed?
That distinction is easy to lose because a mature risk process already produces substantial information. Gates Industrial Corporation, for example, describes an enterprise risk management program that includes risk assessments, a maintained risk register, ongoing management dialogue, quarterly reviews of mitigation actions and periodic reports to the Audit Committee and Board. The disclosure presents a responsible process. It does not reveal the internal quality of any individual decision, and an outside reader should not infer a deficiency.
It does reveal the point at which reporting must change form. Management needs a record that helps teams identify, monitor and mitigate risk. Directors need a record that helps them judge whether exposure remains acceptable and whether the response is working. The two records can share the same evidence, but they do not serve the same purpose.
I have watched boards respond to that gap by requesting more operating detail. The extra reporting creates activity without resolving the decision. The better move is to define the judgment the board owns and require only the evidence needed to make it.
The gap appears when the board has to act
Consider a hypothetical supplier risk. The board packet says that disruption at a key supplier remains a high risk and that mitigation is in progress. The statement is concise. It may also be accurate. Yet it leaves a director with three unresolved questions: How exposed is the company now? What change would make the exposure unacceptable? What will management do if that change occurs?
Suppose the operating team adds that 68 percent of production depends on a single source. That is more useful because it replaces a broad condition with an observable fact. The number still does not tell the Board whether 68 percent is within the company’s tolerance. A director cannot determine whether the report describes a watched condition or an escalation.
Now suppose management states that escalation occurs when single-source exposure exceeds 60 percent or when qualified inventory falls below 45 days. The board can finally see the decision boundary. If the current exposure is 68 percent, the first threshold has been crossed. The conversation can move from whether a risk exists to whether the approved response is sufficient.
The same record identifies the chief operating officer as the executive with authority to activate an alternate-sourcing plan. It notes that a function outside the sourcing team checked the inventory and supplier-qualification evidence. It states that crossing either boundary triggers the contingency plan and a board update within ten business days.
Those figures are illustrative, not Gates data. Their value lies in showing how the character of the report changes. “High risk, mitigation in progress” asks the board to accept management’s conclusion. The expanded record lets directors examine the observation, challenge the threshold and determine whether the promised response matches the company’s strategy and risk appetite.
Better reporting does not mean more reporting
The strongest objection is that directors should not be pulled into operating detail. Management runs the business. A board that tries to reconstruct every risk assessment will lose strategic altitude, slow decisions and blur accountability. A concise risk register protects the distinction between oversight and management.
That objection is right about the danger and wrong about the remedy. Strategic altitude does not come from removing the facts that make a decision possible. It comes from selecting only the facts that matter to the decision.
Touch Stone’s Governance Boundary Principle provides the line: the board governs and management manages. A decision record preserves that boundary because directors judge the exposure, threshold and response while management retains authority over execution.
The National Institute of Standards and Technology describes risk registers as documentation that supports later prioritization, communication, response and monitoring. A 2025 Government Accountability Office report draws a related distinction: a risk register describes and tracks risks and mitigation, while a risk report organizes information so decision makers can manage and communicate risk consistently. Neither authority requires Touch Stone’s five-part standard. Both support the underlying distinction: the register tracks the risk; the report equips the decision.
The Board does not need every operational measure behind supplier qualification. It needs the observed exposure, the decision boundary and enough validation to know that the material claim is not self-graded. The greater the consequence and uncertainty, the more independent the check should be. An internal control, a second-line function, internal audit, legal review or an external specialist may be appropriate. The board does not need maximum assurance on every entry. It needs a check independent enough for the decision in front of it.
That discipline can make the board packet shorter. A heat map often compresses risk into color, direction and status. Those symbols save space, but they can also create false closure when the decision rule remains implicit. A one-page record that makes the relevant observation and response visible may require less meeting time than a polished summary that directors must decode through questions.
One risk is enough to test the method
A company does not need to redesign its enterprise risk system to learn whether the board report is decision-ready. It can begin with one material risk scheduled for the next board or committee meeting.
The current register entry should remain visible. The reporting team can then assess it against the five fields, adding or clarifying what is absent. Each summary judgment should be paired with the facts that support it. The tolerance or escalation boundary should be stated in the direction that triggers action. The record should name the executive with both responsibility and authority, identify the validating source and state what is already authorized if the boundary is crossed.
The chair can test the revised page with two questions. Can a director determine from this page whether the risk is inside or outside the stated boundary? Can a director determine what happens next without relying on an unwritten understanding?
If either answer is no, the report may still be informative. It is not yet ready for the decision the Board may face.
This test does not prove that management selected the right threshold. It makes the threshold governable. Directors can challenge whether it reflects strategy, risk appetite, performance objectives and operating reality. That is the connection the Committee of Sponsoring Organizations of the Treadway Commission makes when it links enterprise risk management with strategy and performance.
The test also makes disagreement more productive. One director may believe the threshold is too tolerant. Another may challenge whether the validating function is sufficiently separate. Management may show that a contingency looks sound on paper but cannot be activated within the stated period. Each disagreement addresses the actual judgment rather than the vocabulary used to describe the risk.
The board record should preserve the judgment
The test of the record comes after the meeting. A register can show that management identified and monitored an exposure. A decision record can show what directors were asked to judge, what evidence they considered, where the boundary stood and what response they authorized.
That record protects the distinction between management and oversight. Management remains responsible for identifying and managing exposure. Independent functions test what requires testing. The board evaluates the boundary, the response and their connection to strategy.
The result is not more board involvement in operations. It is a clearer account of the judgment only the board can make.
For help applying this approach to a real organizational decision or workflow, explore Work With Us.