Translate the consequence, not just the terminology
Replacing 'CVE' with 'security issue' does not create a business explanation. Describe the affected process and credible interruption: unavailable customer records, delayed production, fraudulent payment or loss of confidential data. State the dependencies that could widen the impact.
Be careful with financial estimates. Use documented business assumptions and ranges where appropriate. A precise loss figure drawn from a generic calculator can look authoritative while having very little connection to your organisation.
Show the treatment choices
A useful risk paper presents options: remove the exposed service, replace the unsupported application, restrict access, apply the vendor fix or accept a time-limited exception. Include disruption, effort and residual exposure, not just purchase cost.
Explain why the preferred action is feasible. A patch recommendation that ignores a production maintenance window will be challenged immediately. Where immediate remediation is not possible, state what reduces exposure and what evidence confirms that mitigation is working.
Keep acceptance explicit
The person accepting a material risk must have the authority to do so. Record the scope, rationale, residual exposure, review date and any conditions. An IT ticket closed as 'accepted' is not necessarily a board-approved risk decision.
Escalate changed circumstances. A newly exploited vulnerability, a failed recovery test or a supplier incident can invalidate earlier assumptions. Do not wait for the annual register review to revisit a decision that no longer matches the evidence.
Close the loop after the meeting
The next report should show what happened to the last decision: funding approved, treatment scheduled, evidence collected or action delayed. A recurring slide with no change in ownership or position is a sign that the governance process is not moving the work forward.
Horizon can keep risks, treatments, owners and evidence connected to support that follow-up. The board remains responsible for appetite and acceptance; the platform supports visibility rather than substituting for judgement.