Risk reporting · RiskAtoms Academy

By the end you will be able to

1Write a risk report a board can act on, with a one-page dashboard.
2Turn risk data into a clear message: number, limit, meaning and the decision asked for.
3Set escalation routes so that a breach reaches the right people in time.
4Explain what the BCBS 239 principles ask of risk data and reports.

Why it matters

A board pack of 300 pages arrives two days before the meeting. Somewhere on page 214 is the one number that should have changed a decision. A risk report is judged by one test: did the people with power to act understand, in time, what they needed to do?

Core explanation

From data to a decision

Reporting closes the cycle (L2.4.01: The risk management cycle). Everything before it, the register, the RCSA and the KRIs, produces data. A risk report turns that data into a message for someone who must decide. Different readers need different reports:

Reader	How often	Wants to know
Risk owner and team	Daily or weekly	Every indicator and incident in their area
Executive risk committee	Monthly	Breaches, trends, overdue actions across the firm
Board risk committee	Quarterly, and when escalated	Appetite, top risks, big changes, decisions
Supervisor	As the rules set	Regulatory returns and material incidents

The board and its risk committee (L2.3.02: The board and its risk committee) set the risk appetite, so their report starts there. A good board report answers five questions, in this order:

Are we inside our risk appetite? Where not, why, and what is being done?
What has changed since last time: which top risks moved, and which way?
What went wrong: major incidents and losses, and what we learned.
What is coming: emerging risks.
What do you need to decide today?

One page first. The answers go on a dashboard: each measure with its limit, a RAG status and a trend. It reports by exception: what is green needs no time, so detail moves to an appendix. Under the dashboard, a short narrative says what the numbers mean. Here is Larkfield's appetite section this quarter:

Appetite measure	Now	Last quarter	Limit	Status
CET1 capital ratio	14.2%	14.6%	≥ 12.0%	Green
Liquidity coverage ratio	145.0%	152.0%	≥ 120.0%	Green
Operational losses this year	€9.4m	€6.1m	≤ €12.0m	Amber
Unsecured loans 30+ days in arrears	3.1%	2.9%	≤ 4.5%	Green

Say what it means. A report that says “operational risk remains elevated” gives the board nothing to do. Guess a better version of each line before you open it.

Rewrite the headline

Escalation. The quarterly report is not the only route. When a red threshold or an appetite limit is breached, an escalation route says who must be told and how fast (L2.3.06: Limits and escalation). Larkfield's rule: an appetite breach reaches the chair of the board risk committee within two working days, with a plan.

Sort itWho needs to know, and when?

Larkfield's escalation routes. Pick the right one for each event.

A KRI moves from green to amber.
A KRI turns red, still inside overall risk appetite.
Operational losses pass the annual appetite limit.
A new kind of scam is spreading at other banks but has not hit Larkfield.

BCBS 239 in one paragraph

After 2008, many banks could not quickly add up their exposure to a failing counterparty across the whole group. In 2013 the Basel Committee published 14 principles for risk data aggregation and reporting. Data must be accurate, complete, timely and adaptable, so that a new question in a crisis can be answered fast. Reports must be accurate, comprehensive, clear and useful, as frequent as the risk demands, and reach the right people.

Try it

The board risk committee gets one page. Choose what goes on it, then check and see the page you have built.

Try itBuild the board's one-page dashboard

Pick up to 6 items for the front page of Larkfield's quarterly report to the board risk committee. 0 / 6 picked.

Worked example

Larkfield's fourth-quarter board report

The CRO has two weeks to write the quarter's report. Plan each part before you open it.

Writing the report

Step 1 of 6

1
Start with the answer
“We are inside appetite on capital, liquidity and credit. Operational losses are at 78% of the year's appetite after October's payments outage. We ask you to approve one investment.”

Regulatory lens

The Basel Committee's Principles for effective risk data aggregation and risk reporting (January 2013), known as BCBS 239, applied first to global systemically important banks, which were expected to comply from January 2016; many supervisors also apply them to other large banks. The Committee's progress reports have found that most of those banks were still not fully compliant years later, because fixing data and systems is slow.

The Committee's Corporate governance principles for banks (2015) expect the board to receive regular, clear risk reports, and Solvency II requires insurers to report their own risk and solvency assessment (ORSA) to their supervisor. The supervisory side of reporting comes in Level 4: Regulation, Capital & Accounting.

Sparks

SparkThe watermelon report

Practitioners call it a watermelon: green on the outside, red inside. Every measure on the dashboard is green because the thresholds are loose or the measures miss the real problem, while the people doing the work know things are going wrong. The cure is to ask, every quarter, what the dashboard would have to show for the board to worry, and whether it could.

SparkHours, not weeks

BCBS 239 grew out of a simple question in September 2008: how much does each bank have at stake with Lehman Brothers? Many could not answer quickly, because their data sat in separate systems by business and country. The principles ask banks to be able to produce such answers fast, in a crisis, not only at quarter end.

Key takeaways

A risk report turns data into a decision: number, limit, meaning and what the reader is asked to do.
A board report starts with appetite, then changes in top risks, incidents, emerging risks and decisions.
Put a one-page dashboard first, report by exception, and show trends, not just colours.
Escalation routes make sure a breach reaches the right level in time, without waiting for the next meeting.
BCBS 239 asks for accurate, complete, timely risk data and clear, useful reports that reach the right people.

Reaction

Check what stuck

Glossary

Risk report: A regular document that tells decision makers where the firm stands against its risk appetite and what needs their attention.
Dashboard: A one-page summary of the most important risk measures, each with its limit, status and trend.
RAG status: Red, amber, green: a status colour for each measure against its thresholds.
Reporting by exception: Reporting only what is outside normal ranges, instead of everything.
Escalation: Passing a problem up to a more senior person or committee, within a set time, when a threshold is breached.
Risk data aggregation: Adding up risk data across the whole firm, by risk type, business and legal entity.
Emerging risk: A risk that is new or growing and not yet well understood or on the register.

Deep Dives & Origins

Deep Dives

Basel Committee on Banking Supervision, Principles for effective risk data aggregation and risk reporting, BIS, January 2013. Short and readable. Beginner.
Hopkin, P., Fundamentals of Risk Management, Kogan Page, for the Institute of Risk Management, chapters on risk reporting and assurance. Beginner.

Origins

Basel Committee on Banking Supervision, Principles for effective risk data aggregation and risk reporting (BCBS 239), BIS, January 2013, and its progress reports on adoption.
Basel Committee on Banking Supervision, Corporate governance principles for banks, BIS, July 2015.
International Organization for Standardization, ISO 31000:2018 Risk management: Guidelines, clause 6.7 (recording and reporting).
Directive 2009/138/EC (Solvency II), Article 45 (own risk and solvency assessment).

Watch this lesson

Video version

Prefer to watch? The same lesson as a 10-minute video will sit here, made from this page's script.