Skip to main content
Policy Authority
Category: Risk Reporting and Indicators

Risk Trend

Also known as: Risk Direction
Simply put

A risk trend describes the direction in which a particular risk is moving over time, indicating whether the level of exposure is staying stable, getting worse, or improving. It is drawn from reviewing risk data across multiple points in time rather than a single snapshot. Understanding the trend helps organizations see whether their efforts to manage a risk are having the intended effect.

Formal definition

The risk trend is the direction in which an inherent risk or a residual risk is moving, commonly expressed as trending up, down, or stable. It is distinct from a point-in-time risk rating: the same risk may carry a rising inherent trend while its residual trend flattens or declines following mitigation. Risk trends are typically derived through risk trend analysis, the review of risk-related data over time to determine whether exposure is stable, worsening, or being reduced, and they may be used to inform monitoring, reporting, and forecasting activities. This entry does not cover specific quantification methods, tooling, or forecasting models.

Why it matters

A risk trend adds a temporal dimension to risk information that a single point-in-time rating cannot provide. A risk rated as high on a given date may be moving in very different directions: one high risk may be worsening while another may be improving following mitigation. Without an understanding of direction, decision-makers can misallocate attention, treating a stable or declining risk with the same urgency as one that is deteriorating. Trends help organizations judge whether the effort and resources committed to managing a risk are producing the intended effect.

The distinction between inherent and residual trends is particularly important for interpreting risk data correctly. As reflected in the Stanford enterprise risk management materials, an inherent risk may be trending up even as the residual trend flattens or declines once controls and mitigation are applied. Conflating the two can produce misleading conclusions, for example assuming a risk is under control because the residual position looks stable, while the underlying inherent exposure continues to rise and may eventually outpace existing mitigation.

Risk trends also support monitoring, reporting, and forecasting by turning periodic risk data into a picture of movement over time. Because a trend is derived from multiple observations rather than one snapshot, it can surface emerging deterioration earlier than a single assessment would, giving governance and management functions more time to respond.

Who it's relevant to

Risk managers
Risk managers use risk trends to interpret whether exposure is improving, stable, or deteriorating over time, and to distinguish movement in inherent risk from movement in residual risk after mitigation. This helps them judge whether treatment efforts are having the intended effect and where monitoring attention should be focused.
Governance bodies and boards
Boards and risk committees rely on directional information to understand not just current risk levels but where those levels are heading. Trend reporting supports oversight by highlighting risks that are worsening and warrant discussion, complementing point-in-time ratings in risk reporting.
Internal auditors and assurance functions
Assurance functions may consider risk trends when scoping and prioritizing work, using directional movement to identify areas of growing exposure. Consistent with their independence, they assess how management derives and reports trends rather than owning the underlying risk treatment activities.
Compliance and monitoring teams
Teams responsible for ongoing monitoring can use trend analysis to surface deterioration earlier than a single snapshot would, supporting timelier reporting and escalation where exposure appears to be worsening.

Inside Risk Trend

Direction of Change
The core element of a risk trend is the observed movement in a risk's level over successive assessment periods, typically expressed as increasing, decreasing, or stable relative to prior measurements.
Baseline and Comparison Points
A risk trend requires at least two points of measurement against a consistent baseline, so that changes reflect genuine movement rather than differences in assessment method or scope.
Measurement Basis
The underlying metric being tracked, which may be residual risk rating, key risk indicator values, incident frequency, or another quantitative or qualitative measure. The basis should be stated explicitly, as trends in inherent risk and residual risk can differ.
Time Horizon and Interval
The period over which movement is observed and the frequency of reassessment. Trends observed over short intervals may reflect volatility rather than a sustained directional change.
Contextual Drivers
The factors commonly cited to explain a trend, such as changes in the threat environment, control effectiveness, business activity, or external regulatory and market conditions.
Reporting Representation
The way trends are commonly communicated in risk reporting, such as directional arrows, trend lines, or heat map movement over time, typically feeding governance and oversight discussions.

Common questions

Answers to the questions practitioners most commonly ask about Risk Trend.

Does a risk trend tell you the current level of a risk?
No. A risk trend describes the direction in which a risk's assessed level is moving over time, typically improving, stable, or deteriorating, rather than the risk's absolute level at a single point. A risk can be rated high yet show an improving trend, or low yet show a deteriorating one. Trend and current level are distinct dimensions and are commonly reported alongside each other rather than substituted for one another.
Is a risk trend the same as a key risk indicator (KRI)?
No, though they are related. A KRI is a metric selected to provide information about the state of a risk, whereas a risk trend is an interpretation of movement over time, which may be derived from one or more KRIs, from periodic risk assessments, or from qualitative judgment. A single KRI reading is a data point; a trend is the pattern inferred across multiple readings or assessment cycles. Treating one KRI value as a trend can be misleading.
How is a risk trend typically determined in practice?
Trends are commonly derived by comparing risk assessments across successive reporting periods, drawing on movements in supporting indicators, changes in the control environment, and shifts in the internal or external context. Some organizations quantify trend from indicator data, while others rely on the informed judgment of risk owners. The basis for the assessment, quantitative, qualitative, or a combination, should generally be documented so the trend can be understood and challenged. This entry does not prescribe a specific methodology or tooling.
How should risk trends be presented in risk reporting?
Trends are often shown using directional symbols such as arrows, colour coding, or brief narrative alongside the current risk rating and, where relevant, the risk appetite or tolerance. Clarity about the period covered and the comparison point is important, since a trend is meaningful only relative to a defined prior state. Reporting practices vary by organization and by the audience, such as management committees versus the board or a risk committee.
How often should risk trends be reviewed?
Review frequency commonly aligns with the organization's risk reporting cycle, which may be monthly, quarterly, or tied to significant events. Higher-velocity or more material risks may warrant more frequent review. Frequency is typically set within the organization's risk management framework and governance arrangements, and it may differ across risk categories and jurisdictions.
Who is responsible for assessing and challenging risk trends across the lines of accountability?
In many organizations following the three lines model of the IIA, first line risk owners typically assess and report the trend for the risks they manage. Second line risk functions commonly provide oversight, consistency, and challenge to those assessments. Internal audit, as the third line, may provide independent assurance over the process used to determine and report trends, while maintaining its independence from the management activity it evaluates. Roles vary by organizational structure and framework adopted.

Common misconceptions

A risk trend is the same as the current risk level.
A risk level describes the assessed magnitude of a risk at a point in time, whereas a risk trend describes how that level is moving across periods. A high risk may be trending downward, and a low risk may be trending upward; the two convey different information.
An improving risk trend means the risk is under control or acceptable.
Direction of movement does not by itself indicate whether a risk sits within appetite or tolerance. A decreasing trend can still leave residual risk above the defined tolerance, and trend direction should be read alongside the absolute risk level and stated appetite.
Any change between two assessments constitutes a meaningful trend.
A single movement may reflect normal variability, revised assessment criteria, or scope changes rather than a genuine directional shift. A reliable trend generally depends on a consistent measurement basis and enough data points to distinguish signal from noise.

Best practices

Hold the measurement basis constant across periods, clearly stating whether the trend tracks inherent risk, residual risk, a key risk indicator, or incident data, so that movements reflect real change rather than methodological differences.
Report trends alongside the absolute risk level and the relevant risk appetite or tolerance, so that direction of movement is interpreted in context rather than in isolation.
Document the drivers believed to be behind an observed trend, distinguishing changes in the threat environment from changes in control effectiveness or business activity.
Use a sufficient number of data points and a defined reassessment interval to separate sustained directional movement from short-term volatility.
Flag any changes in assessment scope, criteria, or scale when presenting trends, since such changes can create apparent movement that is not a genuine change in the underlying risk.
Keep management's trend reporting distinct from independent assurance conclusions, so that a management-reported improving trend is not treated as assured control effectiveness.
Promotional banner highlighting failures found in PCI audits and how to spot the gaps