The dashboard point is the one I would push on a little. Good indicators do help, but what I usually find is that the numbers get watched and the reasoning behind them does not. A team can show me a clean set of trends and still not tell me which risk that trend was meant to control, and at that point the dashboard is reporting rather than managing.
Risk based thinking is still the weakest area I see in practice. Most organisations have a register, far fewer can show a decision that changed because of it. So the question I ask is not whether risks are documented but what was done differently as a result, and if nobody can point to a single change then the register is a document rather than a way of working.
------------------------------
Dilawar Laghari
Auditor, Consultant and Trainer
AuditWorkshop.com
------------------------------