The management report (add-on)
One report across every risk area, measured against your global risk appetite: entities assessed, risks above appetite, exposure and plan cost. Part of the Enterprise Risk Management add-on.
Give the board a risk picture it can act on
One management report across every risk area: how many entities have been assessed, how many risks sit above appetite, what the exposure is now and once the open plans are done, and what those plans cost. Export it with your own comment on it, so the figures reach the board with your reading of them attached.
Unlimited users • Free onboarding and support • No commitment
.jpeg)
.jpg)
.jpg)
.jpg)
-1.png)
.jpeg)
.jpg)
Risk reporting to the board Meridian's board material stopped being assembled by hand
Lars Bang is COO at Meridian Nordic and the executive sponsor for compliance. Maria Holm runs the risk areas across the group, GDPR, NIS2 and information security, each with its own scale and its own appetite. The numbers used to be collected out of three separate workbooks the week before a board meeting, and the person presenting them was rarely the person who made them. Now one management report brings the areas together against a single global risk appetite, Maria exports it with her own comment on it, and Lars takes one artefact into the meeting.
-
One report across every risk area, measured against a single global risk appetite.
-
Financial exposure now, exposure once the open mitigation plans are done, and what those plans cost.
-
A breakdown by area, so the meeting goes to the two areas under pressure instead of touring all of them.
-
The export carries the risk owner's own comment, so the figures arrive with the framing attached.
Risk reporting to the board The board doesn't get the matrix
Risk assessment produces a lot of working material: entities, scenarios, consequence and probability, a justification on each. Almost none of it belongs in a board meeting.
-
A spreadsheet per risk area, each living its own life, and nothing that adds them up in the room.
-
The matrix is the right tool for the person doing the assessment and the wrong one for the person approving the spend.
-
Material assembled by hand the week before is already behind the moment something is reassessed.
Risk reporting to the board One report across every risk area
Where several risk areas are in play, the management report brings the numbers together and measures them against one global risk appetite, which is how many risks in total may exceed appetite before management has to act.
-
How many entities have been assessed, which answers whether the work is being done at all.
-
How many risks currently sit above appetite, across areas that each run on their own scale.
-
A breakdown by area and a trend over time, so the picture has a direction and not just a level.
Risk reporting to the board The comment is the part that travels
A report that leaves the platform as bare figures gets explained in a separate email, and then the email and the figures live apart. Here the person exporting the report inserts a comment as part of the export.
-
The framing sits on the figures themselves, written by the person who understands them.
-
What the board receives is exposure, plan cost, breakdown and trend, plus a reading of them, in one place.
-
The report is exported when it is needed, so the figures are the current picture and not last month's copy.
Risk reporting to the board Exposure, and what it costs to bring it down
Three financial figures run through the module, and the report puts them next to each other. That is the trade-off a board is actually asked to approve.
-
Risk exposure on the assessment: the estimated loss if the risk materialises.
-
Expected exposure after mitigation, set on the plan, so you can see what the plan buys.
-
The plan's own estimated cost, so the spend and the saving are compared in the same unit.
Risk reporting to the board The layer the report sits on
Beneath the management report is the governance overview, for whoever is responsible for a risk area. That is where the numbers in the report are made, and where they get worked.
-
A matrix of how many entities fall into each combination of consequence and probability, with entities over appetite, linked risks over appetite and overdue mitigation plans as key figures.
-
A switch to what the picture would look like if every mitigation plan were completed, which answers whether the plan is enough.
-
A switch to any past point in time, so "what did we know in June" is a view rather than an excavation.
Risk reporting to the board What this is not
The platform also has a Compliance Dashboard, which has been there since 2024, and it is a different object from the management report. Worth being plain about, because the two get confused.
-
The dashboard is operational: counts of activities, assets, vendors and tasks, documentation progress, a monthly task graph, incidents by severity, and only the risks scored high or very high. No appetite, no exposure, no trend against a target.
-
The management report is risk. It does not roll up framework progress, control completion, policy acknowledgements, the record of processing activities or vendor audit scores.
-
So a board risk picture comes out of the platform. A board compliance status is still assembled outside it, and we would rather tell you that now than let you find out later.
Our Customers
+400
companies
+10.000
users
+79.000
contracts
+14.000
processing activities
.legal's team has consistently demonstrated a commitment to innovation while being responsive to the needs of our mutual clients.
With .legal, we've gained a simpler and more manageable solution that better suits our needs
.legal has been the right choice for us. .legal are professional and welcoming with skilled employees.
Firstly, it means that not all the work is in one place (me), and secondly, that the understanding of GDPR is implemented throughout the organisation.
From .legal, we experience an incredibly high degree of flexibility and willingness to adapt features to our local needs.
.legal's team has consistently demonstrated a commitment to innovation while being responsive to the needs of our mutual clients.
With .legal, we've gained a simpler and more manageable solution that better suits our needs
.legal has been the right choice for us. .legal are professional and welcoming with skilled employees.
Firstly, it means that not all the work is in one place (me), and secondly, that the understanding of GDPR is implemented throughout the organisation.
From .legal, we experience an incredibly high degree of flexibility and willingness to adapt features to our local needs.
We are satisfied with the switch to .legal – it has strengthened our compliance work, made processes easier to manage and more transparent, and improved cross-team collaboration
It just works! It is so easy and user-friendly, and the overview of processing activities is brilliant.
.legal has really understood what it means to create a user-friendly and efficient solution. Privacy is an attractive product compared to price and functionality.
.legal continuously update the platform to ensure their customers always remain compliant. In our view, any other choice would be a downgrade.
The implementation of .legal has made a difference in the way we handle compliance. The system has created structure and overview, which has had concrete benefits.
We are satisfied with the switch to .legal – it has strengthened our compliance work, made processes easier to manage and more transparent, and improved cross-team collaboration
It just works! It is so easy and user-friendly, and the overview of processing activities is brilliant.
.legal has really understood what it means to create a user-friendly and efficient solution. Privacy is an attractive product compared to price and functionality.
.legal continuously update the platform to ensure their customers always remain compliant. In our view, any other choice would be a downgrade.
The implementation of .legal has made a difference in the way we handle compliance. The system has created structure and overview, which has had concrete benefits.
Use cases
Book demo
Find the job you need done
Every use case is a real piece of compliance work, told the way it actually runs in the platform. Filter by who you are, what you work with, and which frameworks you answer to.
Compliance & GRC leadCISO & IT securityDPOLegal counselExecutive & board
Energy & utilities
SMVMid-marketEnterprise & group
GDPRNIS2ISO 27001CIS18DORAePrivacyAI ActD-mærketData Act
Compliance & GRC lead
Run awareness training that reaches every colleague
Send out training and policies, chase the stragglers automatically, and prove every colleague completed it. You bring the material, we run the rails.
See awareness training
Compliance & GRC lead
Manage compliance across a group of companies
Run every company in the group from one platform, document once at group level, and still report entity by entity. Delivered by the Group Companies add-on.
See group compliance
Legal counsel
Run due diligence on your vendors
Classify a vendor on your own criteria, get the answers and documents you need with no login for them, and move the approved ones straight into contracts.
See vendor due diligence
Compliance & GRC lead
Multi-framework compliance: do the work once
Do a control once and it counts across every framework it maps to, with a simulated score on the ones you haven't started yet.
See multi-framework compliance
CISO & IT security
Get NIS2-ready without starting from scratch
Build on the ISO 27001 work you've already done, switch NIS2 on, and let a simulated score show how far ahead you already are.
See NIS2 readiness
DPO
From twelve spreadsheets to one record of processing
Your GDPR documentation already exists, it just lives in spreadsheets. Export what you have and we structure it in .legal for you, typically inside two weeks.
See the move off spreadsheets
No use cases match that combination yet. Try removing a filter.
