I'm working with my IT department to update our Bank's IT risk assessment. We used Teammate to enter in all the risk rating information and I have a variety of reporting options.

My question is, should there be some written explanation of the risk assessment and methodology used? Does anyone have an example to provide? I wanted to include an explanation along with the reports.

Thanks!