How often do you publish a formal risk report
Most risk reports are not only collated from historic "unclean" data, they are also only published monthly, that is 28 days too late; by the time these reach the users, the information is not only outdated, it's useless in support of better decisions etc. Frightening to think some have a quarterly risk report, or as a friend commented recently, an ANNUAL risk report!
How often do you publish a risk report in your organisation? ...... and "What are you going to do about it?"