Agree the risk model before the visual layout
Likelihood and impact scales need descriptions people can apply consistently. A finance lead and an IT manager may both choose 'high' for entirely different reasons. Use business impact ranges or descriptive criteria appropriate to the organisation, and document the assumptions.
Separate inherent risk, current controls and residual risk. Do not deduct a score merely because a policy exists. Ask whether the control is implemented, tested and effective for the scenario being assessed.
Build the evidence chain
Every summary should trace to a record with an owner, source and assessment date. Automated technical feeds can improve freshness, but manual judgements remain necessary for business consequence and accepted exceptions. Show the distinction rather than pretending all values are calculated.
A missing feed should create an unknown or stale state, not reuse the previous green result indefinitely. Define a reasonable expiry for each type of evidence and surface overdue reviews.
Use drill-down to explain exceptions
Directors need an overview; risk owners need the next action. Provide a summary of material exceptions with enough context to explain why work is blocked. Keep raw vulnerability lists and sensitive architecture detail in the operational view.
Connect risks to controls, treatments and dependencies. A control can support several risks, and one unresolved supplier issue can affect several services. Duplicating it in separate records without a common owner makes follow-up unreliable.
Test the dashboard in a real review
Use a board or management meeting to test whether the dashboard changes the conversation. Can someone identify the most important unresolved decision? Can they distinguish deterioration from improved visibility? Revise the layout around those questions rather than requests for more charts.
Horizon provides an organising layer for risk, controls and evidence. Start with a maintained register and a clear review process. The platform cannot repair inconsistent scoring or assign accountability where the organisation has not agreed it.