Chapter 9 — Communication, ethics and reporting

Lesson map

Lesson 09 published. Map, example, EX041.

flowchart TD
  N0["Learning outcomes"]
  N1["9.1 Board reporting"]
  N2["9.2 Bad news"]
  N3["9.3 Ethics"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX041"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["9.1 Board reporting"]
  N2["9.2 Bad news"]
  N3["9.3 Ethics"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX041"]

[Learning outcomes]
    |
    v
[9.1 Board reporting]
    |
    v
[9.2 Bad news]
    |
    v
[9.3 Ethics]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX041]

Learning outcomes

You will (1) write governance reports for executives and boards; (2) communicate bad news honestly; (3) handle pressure ethically.

9.1 Board reporting

Lena drafts Marston's quarterly security report to the board. It opens with decisions needed, then top risks against appetite, significant findings and their status, incidents and lessons, and supplier risk. It uses plain language and keeps to four pages. Each risk shows a trend and an owner. She learns that board reports should support oversight: directors need to know what is going wrong and what they are being asked to decide. A director who reads only the first page should still know which decisions are being asked of the board.

9.2 Bad news

The report must include the vendor management weakness. An executive suggests describing it as an improvement opportunity rather than a weakness. Lena explains that the board needs an accurate picture, and that softening language could mislead directors who have legal duties of oversight. She agrees to present the issue together with the remediation plan and progress. She learns that honest framing with a plan maintains trust better than euphemism. Presenting the vendor management weakness with its remediation plan lets the board judge progress rather than only learn of a problem.

9.3 Ethics

Later, a manager asks Lena to delay logging a finding until after the regulator's visit. She declines, explaining that the finding must be recorded when identified and that delaying it would mislead the regulator. She offers to help the manager prepare a remediation plan to present alongside it. She learns that professional ethics in GRC often means resisting small pressures to shape the record, and that offering help makes refusal easier to accept. Logging the finding when identified also protects the manager, since a later discovery of the delay would damage trust with the regulator.

Worked example

Lena writes a decision-focused board report, presents a weakness honestly with a plan and declines to delay logging a finding.

Synthetic case. The scenarios are synthetic.

Errors and limits

Honest reports can strain relationships. Boards vary in engagement.

Exercises

• EX041 — Report opening. What does Lena's board report open with?
  Show marking criteria

  Rubric: 3 = decisions needed;; 2 = decisions;; 1 = risks;; 0 = none.
• EX042 — Softening risk. Why not call the weakness an improvement opportunity?
  Show marking criteria

  Rubric: 3 = it could mislead directors with oversight duties;; 2 = honesty;; 1 = vague;; 0 = none.
• EX043 — Honest framing. How did Lena present the weakness?
  Show marking criteria

  Rubric: 3 = with the remediation plan and progress;; 2 = plan;; 1 = vague;; 0 = none.
• EX044 — Delay request. What did a manager ask Lena to do?
  Show marking criteria

  Rubric: 3 = delay logging a finding until after the regulator's visit;; 2 = delay;; 1 = vague;; 0 = none.
• EX045 — Refusal help. What did Lena offer instead?
  Show marking criteria

  Rubric: 3 = help preparing a remediation plan;; 2 = help;; 1 = vague;; 0 = none.

Synthesis

Honest, decision-focused reporting and resistance to pressure sustain trust in GRC.

Continue studying — chapter 09 of 12

← Chapter 08 (draft) · Course chapter index · Chapter 10 (draft) →