Risk management is now considered a fundamentally important activity for the achievement of a company’s strategic objectives. Consequently, directors are required to take responsibility for ensuring that a risk management system is “incorporated within the company’s normal management and governance processes” (Financial Reporting Council, 2014a, p. 2). Significantly, the function of a risk management system is not limited to supporting directors in better managing the company; the process of managing risk also generates risk information that can then be made publicly available. Disseminating this risk information is considered an equally important responsibility for director as it “ensures that shareholders and other stakeholders are well-informed about the principal risks and prospects of the company” (Financial Reporting Council, 2014a, p. 1). Investors and other stakeholders need risk information to be able to assess a company’s risk profile and to understand how risks are being managed. This enables them to make riskinformed decisions and assists in holding directors to account in respect of the risk implications of strategic decisions. The importance attached to publishing risk information has resulted in many countries requiring companies to provide risk disclosures in their annual reports. For example, in the UK §۴۱۷ of the Companies Act 2006 stipulates “(t)he business review must contain … a description of the principal risks and uncertainties facing the company” and provision C.2.1 of the UK Corporate Governance Code states that in the annual report “directors should describe those (principal) risks and explain how they are being managed or mitigated” (Financial Reporting Council, 2014b).