A Victorian non-executive who sat three other boards this month will not reward a fourteen-page “assurance overview.” They will reward a note that says what is still open, who owns it, and what would change their mind. Residual risk is the leftover after controls you can actually demonstrate. If you cannot demonstrate the control, you do not get to subtract it.
Siteflowbase teaches a one-page shape in session four of the blueprint. It is ugly on purpose. Beauty in this genre usually means someone sanded off the leftover.
Four sentences that earn their keep
First: the obligation in plain language, with the source. Second: the control that exists today, with the artefact (folder path, log, licence copy). Third: the gap — people, system, geography, or calendar. Fourth: the decision you are asking the board to accept until a dated review. “We are comfortable” is not a decision. “We accept that subcontracted wash-bay chemicals are evidenced quarterly rather than per visit until 1 November, owner: plant manager, deputy: quality lead” is a decision.
Heat maps lie politely
Colour is not a control. If your pack still needs a traffic light, put it after the sentences, never instead of them. Directors who have been burned by a green square will go straight to the gap sentence. Write that sentence as if they will read it aloud.
Australia, seasons, and silence
Do not schedule residual-risk reviews for the week between Christmas and New Year and then act surprised when evidence is thin. Name the seasonal constraint. A board in Melbourne overseeing a Porcupine Flat operation should also name distance: who can physically produce a folder if the question arrives on a Thursday afternoon.
This is education, not a substitute for counsel on a live matter. If a leftover risk is an enforcement letter, stop writing teaching notes and call the people who go on the record.