Most executives don't need more project detail. They need less detail, organized around better questions: what changed, why does it matter, and what happens next. A lot of "status reports" fail at exactly this. They're comprehensive, current, and almost useless to a leader who has ninety seconds to decide whether to intervene.
An executive risk report is a different document with a different job. It isn't trying to document everything that happened this week. It's trying to answer a narrower question well: is this project at risk, and if so, what does leadership need to know to make a call? Below is a practical structure for building one, based on the sections that tend to actually get read.
1. Executive Summary
Two to four sentences, no more. What's the current health status, what's driving it, and what's the headline recommendation. Everything after this section is supporting detail. If a reader only gets this far, they should still walk away knowing what matters.
2. Project Health Snapshot
A single-glance view across the categories that matter most: typically budget, schedule, vendor performance, resource allocation, and compliance. This section exists so a reader can scan five status indicators in under ten seconds before deciding whether to read further.
3. Risk Score, with an explanation
A single composite number is useful, but only if it's explained. A risk score with no context is just a new red-yellow-green indicator with more decimal places. The explanation should cover what the score is built from (usually a blend of the categories in the snapshot above) and roughly what range counts as healthy, cautionary, or genuinely at-risk. There's no single industry-standard formula for this. Scoring methodology varies from one tool or organization to the next, which is why the explanation matters more than the number itself.
4. Early Warning Signals
The specific data points that triggered concern, not a summary: the actual signals. "Vendor response time increased from 2 to 9 days" is more useful to a reader than "vendor performance has declined." Specificity here is what separates a risk report from a vague status update.
5. What Changed
A short before/after comparison of the metrics that moved. This section answers the question every executive eventually asks anyway ("wait, when did this happen?") before they have to ask it out loud in a meeting.
6. Business Impact
This is the section most status reports skip entirely, and it's arguably the most important one for an executive audience. A schedule slip means nothing to a reader until it's translated into a delivery date, a budget consequence, or a downstream dependency. Business impact is where a metric becomes a decision.
7. Recommended Next Actions
Specific, not generic. "Reallocate two resources from Phase 4 prep" is a recommendation. "Continue monitoring" is not. If the report doesn't include a concrete next step, it's a status update wearing a risk report's name.
8. Indicator Detail (Budget, Schedule, Vendor, Resource, Compliance)
One section per category, each with its specific metric and a one-line explanation. This is where a reader who wants to dig into a specific category (say, a CFO who only cares about budget) can go deep without wading through the whole report. For a closer look at which specific metrics belong in each category, see How to Measure Project Health: 10 Metrics Every Executive Should Track.
9. Executive Decision Notes
A short section framed explicitly as "what a leader needs to know to make a call." It's distinct from the summary because it's written for someone about to approve or reject a recommendation, not someone getting oriented. This is also the right place to be honest about what's still uncertain, rather than presenting a projection as guaranteed.
What this looks like in practice
WIQRO built a free Sample Executive Risk Report that follows this exact structure, using an illustrative fictional project rather than real client data, specifically so the format itself is easy to evaluate on its own. It's a useful reference point regardless of what tool or process a team ends up using to build these reports.
For organizations that want a human-reviewed version of this applied to one real, active project, WIQRO's Project Health Assessment is a one-time, one-project engagement built around the same structure.
Frequently Asked Questions
How is a risk report different from a status report?
A status report typically shows what state a project is in right now, often as a red, yellow, or green indicator. A risk report explains what changed, why it matters, and what to do about it. Status reports describe. Risk reports recommend.
How often should an executive risk report be updated?
As often as the underlying project data changes in a meaningful way. Many organizations default to weekly or monthly because that's the reporting cadence, not because that's how often risk actually shifts. The underlying data, including budget, schedule, and vendor performance, often moves daily.
What is a reasonable range for a project risk score?
This varies by methodology, but a common pattern treats the score as a spectrum: higher reflects a healthier project, lower reflects a greater concentration of risk signals, and a moderate-range score usually means the project is still recoverable with prompt action rather than in active crisis.
See the full structure in a real sample report.
The free Sample Executive Risk Report walks through every section above, built around an illustrative project.
Explore WIQRO plans and pricing for teams managing one active project up to full government and enterprise portfolios.