Effective Communication

To be effective, all information exchanged, regardless of its type, should be:
 * CLEAR - KNOWN AND UNDERSTOOD BY ALL STAKEHOLDERS
 * CONCISE - INFORMATION OR COMMUNICATION SHOULD NOT INUNDATE THE RECIPIENTS. ALL GROUND RULES OF GOOD COMMUNICATION APPLY TO communication on risk. This includes the avoidance of jargon and technical terms regarding risk since the intended audiences are generally not deeply technologically skilled.
 * USEFUL - ANY COMMUNICATION ON RISK MUST BE RELEVANT. TECHNICAL INFORMATION THAT IS TOO DETAILED AND/OR IS SENT TO INAPPROPRIATE PARTIES WILL hinder, rather than enable, a clear view of risk.
 * TIMELY - FOR EACH RISK CRITICAL MOMENTS EXIST BETWEEN ITS ORIGINATION AND ITS POTENTIAL BUSINESS CONSEQUENCE. FOR EXAMPLE, A RISK MAY originate when an inadequate IT organisation is set up, and the business consequence is inefficient IT operations and service delivery. In another example, the origination point may be project failure, and the business consequence is delayed business initiatives. Communication is timely when it allows action to be taken at the appropriate moments to identify and treat the risk. It serves no useful purpose to communicate project delay a week before the deadline.
 * AIMED AT THE CORRECT TARGET AUDIENCE - INFORMATION MUST BE COMMUNICATED AT THE RIGHT LEVEL OF AGGREGATION ADAPTED FOR THE AUDIENCE and enabling informed decisions. In this process, aggregation must not hide root causes of risk. For example, a security officer needs technical IT data on intrusions and viruses to deploy solutions. An IT steering committee may not need this level of detail, but it does need aggregated information to decide on policy changes or additional budgets to treat the same risk.
 * AVAILABLE ON A NEED TO KNOW BASIS - IT RISK RELATED INFORMATION SHOULD BE KNOWN AND COMMUNICATED TO ALL PARTIES WITH A GENUINE NEED. A risk register with all documented risks is not public information and should be properly protected against internal and external parties with no need for it.