The CRO of a regional mortgage lender has asked an enterprise risk manager to develop a set of policies and procedures for the firm's operational risk reporting. The manager considers appropriate policies for the governance of the firm's risk reporting framework and also assesses how the firm should structure its risk reports for different stakeholder groups and organizational functions. Which of the following would be most appropriate for the manager to recommend?