Board Reporting After a Near-Miss
A mid-sized specialty insurer has an ERM function of three analysts reporting to a Chief Risk Officer who also chairs the enterprise risk committee. Last quarter a reinsurance recoverable dispute of $42 million surfaced only when finance closed the books; the risk register listed 'reinsurance counterparty risk' as Low with an owner in the finance department who had left eight months earlier. The CRO now wants to restructure reporting so that the board risk committee sees 'emerging and crystallizing' risks, not just a static register. The CEO is wary of adding board meeting time and asks for a one-page dashboard. The CRO has 90 days and no new headcount. Two business unit heads have offered to 'own' the dashboard if it does not create audit findings against them.
1. Diagnose the root cause of the reporting failure using risk governance concepts, and explain why a one-page dashboard alone will not fix it.
Read the worked answer
The failure is not a reporting-format problem; it is a governance and ownership failure with three layers. First, ownership decay: a named risk owner who departed left the register stale, and no reassignment trigger existed. The register treated ownership as an attribute rather than an accountability with a review cadence. Second, rating drift: reinsurance recoverable risk was rated Low despite a $42m exposure, suggesting the rating reflected likelihood of default only, ignoring impact concentration and the operational risk of dispute/settlement. A proper assessment would combine probability and impact and consider the process risk (recoverable recognition and reconciliation), not just counterparty credit. Third, escalation design: the issue reached the board only through financial close, meaning no independent channel existed for finance-adjacent risks to reach the risk committee. A one-page dashboard is a display layer; without an owner-of-record rule, a reassignment trigger on departures, a defined rating methodology, and an escalation path, the dashboard will simply display stale data faster. The CRO should pair the dashboard with a register hygiene protocol and a named accountable executive per top risk.
2. The business unit heads offer to own the dashboard. Evaluate this offer and recommend how the CRO should respond, considering independence and incentive conflicts.
Read the worked answer
The offer is attractive operationally but creates a conflict: the same executives who generate risk would control the reporting of it, and they have explicitly conditioned ownership on avoiding audit findings. That is an incentive to under-report or soften language. ERM's value depends on a degree of independence from the first line. The CRO should accept business-unit content contribution (they supply data and narrative for their risks) while retaining ERM ownership of methodology, aggregation, and the final dashboard. Accountability for each risk stays with the business head; accountability for the reporting framework stays with the CRO. Practically: define a data-provision SLA with the units, have ERM reconcile and challenge, and have internal audit review the framework annually. The CRO should also state in writing that the dashboard is not an audit attestation and does not shield or expose owners-removing the premise of the offer. This preserves independence, uses the units' proximity to risk, and avoids a structure where the fox reports on the henhouse.
3. Recommend a 90-day implementation plan with no new headcount, identifying the two highest-leverage changes.
Read the worked answer
Highest-leverage changes: (1) a risk owner of record with reassignment trigger-every top-20 risk gets a named accountable executive and a deputy, reviewed when anyone leaves or changes role; (2) a rating methodology with an explicit impact scale so ratings cannot be set on likelihood alone. The 90-day plan: Days 1–20, re-baseline the top risks, reassign orphaned owners, and rewrite the rating rubric; Days 21–45, build the one-page dashboard from existing data (no new systems), pilot with the risk committee chair; Days 46–70, run one tabletop on a crystallizing risk to test escalation, and draft the escalation protocol; Days 71–90, present the dashboard and protocol to the board risk committee, and agree an annual internal audit review. Use existing analysts by reallocating effort from register maintenance to top-risk analysis, and use the departing-owner incident as the case for change with the CEO. The constraint is not headcount but attention: cap the dashboard at the top risks plus a watchlist, and keep the register as the underlying system rather than a parallel artifact.