Board reporting on RISE risk.

A seven year RISE with SAP commitment is a board level decision while the contract is being negotiated and a board level oversight problem once it is signed. Most boards see RISE only at signature, when the CIO and the CFO present a deck that explains the rationale, the cost, and the timeline. After signature, RISE drops out of board view until the next renewal cycle, six years later, when the board sees a new deck explaining a new commitment. This pattern is a governance failure that the standard reporting cadence is built to produce. A board that wants real oversight of a RISE programme needs a reporting pattern that surfaces the right information at the right cadence, without becoming theatre and without crowding out the rest of the audit committee agenda. The work of this article is to describe that pattern.

What the board actually needs to see

Board reporting on a multi year technology commitment has to answer three questions. The first question is whether the commitment is delivering the value that was approved at signature. The second question is whether new risks have emerged that change the value assessment. The third question is what management is doing in response. Reporting that answers these three questions in five pages, with named metrics and a clear narrative, sits at the right level for an audit committee. Reporting that runs to thirty pages with status colours and detailed project plans sits at the wrong level. The reporting needs to be short, structured, and substantive.

For RISE specifically, the value assessment turns on five dimensions. The cost dimension tracks the actual spend against the modelled spend at signature, with year on year variance and the cumulative position across the term. The capability dimension tracks the rollout against the planned scope, with named functionality live, in progress, and at risk. The performance dimension tracks the operational metrics, including uptime, incident response, and the named service levels. The compliance dimension tracks the regulatory and sovereignty position, with named audits completed and named findings open. The strategic dimension tracks the relationship with SAP, the renewal position, and the alternatives that remain credible if the renewal does not produce the required outcome.

The cadence the audit committee can sustain

The cadence of board reporting on RISE should match the underlying tempo of the commitment, not the calendar of the audit committee. Three reporting moments inside each contract year cover the cadence most boards can sustain.

The first moment is the annual deep review, held at the same audit committee meeting each year. This review presents the five dimension assessment in full, with year on year comparison and the cumulative position. The review takes thirty to forty minutes of committee time and produces the formal record of board oversight for the year.

The second moment is the midyear update, held six months later. This update presents a shorter version of the five dimension assessment, with focus on the metrics that have moved since the annual review. The update takes fifteen to twenty minutes of committee time and surfaces emerging issues before they harden.

The third moment is the trigger event briefing, held when a defined trigger condition is met. Trigger conditions are defined at the start of the contract and include cost variance above ten percent, a critical incident on the production environment, a regulatory finding that touches the RISE estate, a renewal proposal arriving from SAP, and a major change to the SAP product roadmap that affects the buyer's commitment. The trigger briefing is shorter, focused, and includes a recommendation from management on the response.

The cost dimension and how to report it cleanly

Cost reporting on a RISE commitment is harder than it appears. The standard accounting record shows the subscription cost as a single line. The real cost includes the subscription, the hyperscaler infrastructure consumption, the implementation partner spend, the internal programme team, the BTP usage, the integration cost, and the change in operational cost across the buyer organisation. A board report that shows only the subscription line misses the majority of the spend.

A workable cost report shows seven components. The subscription cost as contracted and as paid. The hyperscaler consumption against the modelled assumption. The implementation partner spend against the budget. The internal team cost at full loaded rates. The BTP and integration spend. The decommissioning cost on the legacy estate. The change in operational cost across the broader IT function. Each component carries the year position, the cumulative position, and the modelled position from the signature TCO. Variance over five percent on any component carries a narrative explanation.

The cost narrative is more important than the cost numbers. The numbers show where the spend sits. The narrative explains why and what is being done. A cost report that lists variances without narrative is a status update, not a board report.

The risk dimension and the register that supports it

The risk dimension of board reporting draws on the RISE risk register that the programme maintains. The register lists each named risk, the inherent score, the residual score after mitigation, the named owner, and the status of the mitigation work. The board sees the register at the annual review, in summary form at the midyear update, and in detail at any trigger event briefing that touches a register item.

For a RISE commitment, the register typically holds twenty to thirty named risks across six categories. Commercial risk covers cost overrun, uplift exposure, and renewal positioning. Operational risk covers uptime, incident response, and capacity. Compliance risk covers data sovereignty, regulatory change, and audit findings. Strategic risk covers SAP product roadmap shifts, hyperscaler dependency, and exit feasibility. Programme risk covers implementation delay, scope change, and partner performance. People risk covers internal capability, retention of key staff, and knowledge concentration.

The board report does not show all twenty to thirty risks in detail. It shows the top five risks by residual score, with the named mitigation and the timeline to closure. It shows any risk that has moved up or down by a defined threshold since the previous report. It shows any risk that has been closed or newly opened. The register itself sits behind the report and is available to any committee member who wants to inspect it.

The strategic dimension and what the board does with it

The strategic dimension of RISE reporting is the dimension that the audit committee is most often unable to act on, because the strategic posture toward SAP is set at signature and is hard to revisit cleanly mid term. The board reporting has to surface the strategic position even when the board cannot move it inside the current contract, because the renewal will arrive faster than expected and the work to reposition for the renewal starts well before the renewal window opens.

A workable strategic report covers four positions. The first position is the alternative state, with the named alternatives that remain credible if the renewal does not deliver the required commercial terms. The second position is the relationship state, with the SAP account team coverage, the regional vice president engagement, and the escalation paths that the buyer has tested. The third position is the leverage state, with the workloads, data assets, and capabilities that constrain the buyer's freedom to move at renewal. The fourth position is the renewal calendar, with the work streams scheduled across the eighteen month preparation window that runs into the next renewal.

The strategic dimension is the dimension that distinguishes board level oversight from operational reporting. Operational reporting tells the board that the programme is running. Strategic reporting tells the board what optionality the programme is preserving and what optionality it is consuming. The second question is the one that the board needs to answer.

The disciplines that keep the reporting honest

Across the engagements documented at the firm, four disciplines keep RISE board reporting honest. The first discipline is the independent review of the reporting once a year, by an external party with no commercial relationship to SAP. The independent review tests the numbers, the narrative, and the risk register against the operating reality. The second discipline is the named board member sponsor, who reads the reporting between meetings and challenges the management team on emerging issues. The third discipline is the consistent format across years, so the board sees the same shape of report at the same cadence, with year on year comparability built in. The fourth discipline is the trigger event response, with the defined briefings and the named decisions that the board makes when a trigger condition is met.

Reporting without these disciplines drifts toward narrative comfort. Reporting with them surfaces the issues that the board needs to see and creates the conditions for the board to act on them.

Conclusion: oversight is a cadence, not a moment

Board oversight of RISE is a cadence rather than a moment. A board that sees RISE only at signature and at renewal misses the six years in between, during which the commitment either delivers the value approved at signature or erodes it. A board that sees RISE through the annual deep review, the midyear update, and the trigger event briefing, with the five dimension assessment, the named risk register, and the independent annual review, holds oversight that the standard reporting pattern is built to obscure. The work is structural, the work is repeatable, and the work is the difference between governance and theatre.