Corbelstone Builders Quarterly Risk Review, Q3 FY27
Risk review presentation: heat map and top ten
A risk review presentation has to show an audit and risk committee which risks moved, whether the controls are actually working, and what it is being asked to escalate. Corbelstone Builders, an invented Australian commercial builder, places its top ten risks on a three by three heat map, reports eight of ten key controls effective, and brings two escalations for the board.
Every slide, in order
The whole deck as it renders, one slide after another. Read it the way the audience would.
The structure
What each slide is doing, so you can reuse the order even with different content.
- Slide 1cover
- Names the committee, the quarter and the headline movement before any detail.
- Slide 2intro
- Summarises the quarter for committee members who read only the first page.
- Slide 3framework
- The heat map: every top ten risk placed by likelihood and impact on a three by three grid.
- Slide 4metrics
- The top ten risks with owner, rating and trend, the register the committee actually signs off.
- Slide 5metrics
- Safety incident numbers for the quarter, because in construction the people risks come first.
- Slide 6checklist
- The ten key controls tested this quarter and how each performed.
- Slide 7process
- How a risk moves from a site to the board, so the committee can see where escalations come from.
- Slide 8takeaway
- The single message for the committee this quarter.
- Slide 9closing
- Closes with the escalations and what the committee is asked to decide.
Slide by slide
Slide one names the committee, the quarter and the headline. Slide two gives four things to know: three risks up, two down, eight of ten controls working and two escalations. Slide three is the heat map. Slide four is the top ten table. Slide five reports incidents. Slide six lists the ten controls tested. Slide seven explains how a risk moves from a site to the board in four steps with time limits. Slide eight gives the one message for the quarter. Slide nine sets out the two escalations, a quarterly check on 38 key trades and board sign off for fixed price contracts above $15M, and the next review date.
How to adapt this deck
A business outside construction should replace the incidents slide with the measure its regulator watches, such as complaints for a financial services firm or data breaches for a software company. A smaller company without a committee can present the same deck to its board, but should cut the escalation process slide and add one slide on risk appetite. If the register is longer than ten, keep the heat map to the top ten and move the rest to an appendix the committee can read before the meeting.
What risk guidance says
The ASX Corporate Governance Council's principles recommend that the board or a board committee review the entity's risk management framework at least annually to satisfy itself that it continues to be sound. Safe Work Australia's model Code of Practice on managing work health and safety risks sets out the duty to identify hazards, assess risks, control them and review the controls. This deck reports on both: the register and heat map for the committee, and tested safety controls.
What makes this deck work
Heat map and table agree
Slide three places each risk on a three by three grid of likelihood and impact, and slide four lists the same ten with owner, rating and trend. R1 subcontractor insolvency sits alone in the high, high cell and is the first of the two escalations, so the committee can follow one risk across three slides.
Controls are tested, not asserted
Slide six reports ten key controls tested this quarter with evidence for each, such as 60 height permits sampled and 120 inductions checked. Two are only partly effective, and both relate to the risks that rose, which is exactly the link a committee needs to see.
Safety numbers are read honestly
Slide five shows two lost time injuries over 488,000 hours, a frequency rate of 4.1 per million hours against 6.0 last quarter, and near misses up from 31 to 46. The deck reads the rise in near misses as better reporting and says so, rather than leaving the committee to guess.
Questions people ask
What goes in a quarterly risk review presentation?
A short summary of what moved, a heat map, the top risks with owner, rating and trend, results of controls tested, incidents for the period, how risks are escalated and what the committee is asked to decide. Nine or ten slides is enough, with the full register in an appendix pack.
Should a risk heat map be 3 by 3 or 5 by 5?
A 3 by 3 grid is easier to read on a slide and enough for a top ten. A 5 by 5 suits a detailed register in a document. Whichever you choose, keep the same scale every quarter so trends mean something, and label the axes on the slide itself.
How do I show risk trends to a committee?
Add a trend column, up, same or down against the last review, to the top risks table, and summarise the movers on the opening slide. A rule such as escalating any risk that rises two quarters running gives the trend a consequence the committee can rely on.
What does testing a control mean in a risk review?
Checking a sample of evidence that the control actually operated, such as permits completed or inductions done, rather than confirming the policy exists. Report the sample size and the result for each control, and link any partly effective control to the risk it is meant to reduce.
Who should present a risk review to the committee?
The head of risk presents the overall picture, and the owner of any escalated risk should attend to answer questions. Committees trust a review more when the people managing the risk speak to it, not only the function that maintains the register.
Can the heat map grid be edited after the deck is built?
Yes. The grid is a three by three matrix element, so cell labels and the risks listed in each cell can be edited directly on the slide. The matrix element also comes in two by two and SWOT forms if a simpler grid suits a different audience.
Build your own in about a minute
The button below opens the generator with this use case already described. Change the wording to match your own, generate, then edit anything you like.
Make one like thisOther presentation examples
Post mortem presentation example: timeline, cause, fixes
A post mortem presentation has to show what happened, who was affected and why, without blaming a person, and leave the room with fixes that have owners and dates. Tallisor, an invented payments company, reviews a 47 minute card payments outage caused by one mistyped setting, traces it through five links in a failure chain, and commits to seven dated remediations.
Monthly business review deck: one page per function
A monthly business review deck has to show the leadership team in minutes where the month landed against plan, which function caused the gap, and what has to be decided before next month. Driftmere Goods, an invented Australian outdoor clothing retailer, reviews April: revenue at 94 percent of plan, new customers and cash ahead, and three decisions with costs attached.
Leadership team update deck: eight slides every week
A weekly leadership team update has to show, in under half an hour, whether the numbers moved, whether last week's decisions actually happened, and what each executive needs from the others before next Monday. Gantrywell, an invented managed detection company, runs the same eight slides every week, starting from six fixed numbers and ending on three asks with names and dates.
Want the steps in the builder? Read Add charts, maps and diagrams to slides, then Export a presentation to PowerPoint or PDF. For everything this generator can do, see the presentation maker.
Written and checked by the OneCraft team. Last checked .