Steer
Risk report
An insurer, a client or an auditor will ask what your IT risks are. So should you. The risk report answers in plain language: what’s protected, what’s open and what it costs to close.
The open risks, in words you can act on.
Every firm carries IT risks: a server past its life, a backup never restored, an account without a second factor, a provider contract with no exit. Most are known to someone and written down nowhere your management reads. The risk report is one short document for the people who decide: each open risk in plain language, what it would mean for your firm, what closing it costs, and our recommendation. You decide which to close, which to carry and which to insure, and the decision goes on record with an owner and a date. Where we also run your IT, the report is written from the evidence file: your firm as it is, not as a questionnaire imagines it.
How it’s written
From the evidence file to your table.
The report doesn’t start from a template. It starts from what protects your firm today and what doesn’t yet.
-
What’s protected, as it is
Devices, sign-in, admin access, backups, data location: what the evidence file shows is in place, stated so that a reader without an IT background can follow it.
-
What’s open, and what it means
Each gap named, with what it would mean for your firm in plain words: a day without files, a mailbox sending in your name, an archive you can’t prove. Never alarmist; what would happen next, not how bad it could get.
-
What closing it costs
For each open risk, the realistic options and what each costs, so a risk is never discussed without its price next to it.
-
Our recommendation
What we would close first, what can wait and what we’d carry knowingly, and why. A recommendation, not a sales list.
-
Your decision, on record
Close, carry or insure: each decision is written down with its owner and date. A risk you choose to carry is a decision too, and the report says so.
-
Updated, not rewritten
The report is reviewed in your steering meeting: what was closed, what’s new, what changed. Every version is kept, so you can show how a risk was handled over time.
On record
On the decision paper.
- The risks in plain language, each with what it would mean for your firm
- The options to close each one, and what they cost
- What you decided: close, carry or insure, with an owner and a date
- What was closed since the last report, and what’s new
The page you hand your insurer, your auditor or a major client when they ask how you manage IT risk.
What usually goes wrong without it.
-
Risks known to IT, unknown to management
The engineer knows the server is past its life. Management hears about it the day it fails. A risk nobody reported was never decided, only suffered.
-
A report in technical language
A list of vulnerabilities by their catalogue numbers tells the people who decide nothing about what to decide. The report has to say what a risk means for the firm.
-
Written for the questionnaire, not for the firm
A risk report produced to satisfy an insurer’s form describes the form. One written from the evidence file describes your firm, and it still satisfies the form.
Also under Steer
- IT roadmap A 12- to 24-month plan tied to your projects, people and growth, reviewed regularly.
- Budget and costs What you spend, what it buys and where to save or invest, with licences sized to reality.
- Vendor and contract reviews A second opinion on software, telecoms and support contracts before you sign or renew.
- IT planning for deals What a merger, carve-out or new entity means for IT, planned before the legal date.
- The incident rehearsal Your incident plan walked through with leadership before it’s needed: who decides, who tells whom.
Questions we get
Is this the report our cyber insurer asks for?
It answers the questions insurers ask, in your firm’s own facts, and it goes into your evidence file next to the questionnaire itself. Whether it meets a particular insurer’s requirements is for you and your broker to judge; we supply the facts and the record.
How long is the report?
Short enough to be read before the meeting, not filed after it: the open risks, their cost and the recommendation. The detail behind each line stays in the evidence file.
What if we decide not to close a risk?
Then the report says so. Carrying a risk knowingly is a legitimate decision, and the record shows it was made deliberately, by whom and when, instead of by neglect.
Can you write a risk report if someone else runs our IT?
Yes, from a review of your IT with your in-house person or your provider. It will be less precise than one written from an evidence file we keep ourselves, and we’ll say where.
Start
What are your open IT risks today?
In a first call we go through what you already know is open, what you’d want on one page for your management, and what a first risk report would show.
- No first level
- No surprises
- Pilot before you buy