Key performance indicators (KPIs) will best support management reporting on risk, as they help to measure and monitor the effectiveness and efficiency of the risk management and control processes. KPIs are metrics or measures that provide information on the current or potentialperformance of a specific activity, process, or objective. KPIs can be classified into two types: leading and lagging. Leading KPIs are predictive indicators that provide early warning signals or trends of future performance. Lagging KPIs are outcome indicators that reflect the actual or historical performance.

KPIs help to support management reporting on risk by providing the following benefits:

They enable a data-driven and evidence-based approach to risk management and reporting, rather than relying on subjective or qualitative judgments.

They facilitate a consistent and standardized way of measuring and communicating risk performance across the organization and to the external stakeholders.

They support the alignment of risk management and control activities with the organizational strategy and objectives, and help to evaluate the achievement of the desired outcomes.

They help to identify and prioritize the areas for improvement and enhancement of the risk management and control processes, and guide the development and implementation of corrective or preventive actions.

They provide feedback and learning opportunities for the risk management and control processes, and help to foster a culture of continuous improvement and innovation.

The other options are not the best choices to support management reporting on risk. Control self-assessment (CSA) is a process that involves the participation and involvement of the staff and managers in assessing the effectiveness and efficiency of the internal controls within their areas of responsibility, but it does not provide a comprehensive or objective view of the risk performance. Risk policy requirements are the documents that define the principles, rules, and guidelines for the risk management and control processes, but they do not provide actual or potential information on the risk performance. A risk register is a tool that records and tracks the information and status of the identified risks and their responses, but it does not measure or monitor the risk performance. References = Key Performance Indicators (KPIs) for Risk Management - Resolver, IT Risk Resources | ISACA, Risk Reporting - Open Risk Manual