Risk Monitoring and Reporting
Monitoring mechanisms
Monitoring provides ongoing assurance that risk remains within appetite. Know the tools: KRIs and key control indicators, limit monitoring and exception reports, dashboards, trend analysis, loss-event tracking, and periodic independent review. Distinguish continuous monitoring (automated, real-time) from periodic assessment (quarterly RCSA refresh, annual review). A common trap is treating a green dashboard as proof of low risk - indicators can be lagging, incomplete, or gamed.
Reporting: audience and content
Reporting must be fit for purpose. The board needs aggregated, forward-looking, appetite-linked information; management needs granular operational detail; regulators need prescribed formats and timeliness. Good reports state the metric, its limit, the trend, the breach status, and the action owner. Traps: reporting too much data without interpretation, hiding breaches in averages, and confusing risk reporting with financial reporting.
Escalation and thresholds
Define thresholds (green, amber, red), escalation timing, and accountable owners. Amber should trigger investigation, not just observation. Understand that a breach of a limit is a governance event requiring escalation even if the financial impact is small, and that repeated near-misses signal weakening controls.
Worked example and rule of thumb
A liquidity coverage ratio limit is 110%, with amber at 115% and red at 110%. The ratio falls to 114%: this is an amber trigger requiring the treasurer to investigate, document cause, and report to the risk committee, even though no limit is breached. Rule of thumb: every reported metric should answer - what is it, what is the limit, what is the trend, and who acts if it moves? If a report cannot answer all four, it is data, not monitoring.