The Risk Report Nobody Could Act On
A pension fund's quarterly board risk report is 62 pages. It lists 140 risks, each rated high/medium/low by the risk team, with no owners, no trends and no financial quantification. The board spends 15 minutes on it. In the last year, two material issues - a custodian concentration of 40% of assets and a 3-year rise in illiquid private credit from 5% to 18% of the portfolio - appeared in the report as 'medium' with no commentary. The regulator has asked the board to demonstrate effective oversight. The CEO proposes shortening the report to 10 pages by removing the 100 'low' risks. The chief risk officer worries this hides emerging risks and wants a different redesign.
1. Evaluate the CEO's proposal and design a report structure that supports board decision-making.
Read the worked answer
The CEO's proposal treats length as the problem. The real defects are: no ownership, no trend, no quantification, no linkage to appetite, and no prioritisation by consequence. Cutting the 'low' risks to 10 pages would produce a shorter document that still cannot support oversight - and could remove the early signals of emerging risk, which are often rated low before they compound.
Better structure - organise by decision, not by count:
- Appetite dashboard (1–2 pages): each principal risk against its limit or tolerance, with RAG status and trend arrows.
- Top risks with quantification (3–4 pages): 10–15 risks, each with an owner, exposure estimate (currency or % of assets), movement since last quarter, and the specific decision or assurance sought from the board.
- Concentration and emerging risk (2 pages): custodian 40%, private credit 5%→18%, with commentary on trajectory and exit liquidity.
- Incidents and control assurance (1–2 pages): losses, near misses, audit findings and remediation status.
- Appendix: full register, available on request.
Every item should answer 'so what?' - what changes if the board does nothing. Low-rated risks are retained in the register and surfaced when their trend deteriorates, rather than dropped.
2. Explain how the two 'medium' issues should have been reported and escalated, and what governance failure their treatment reveals.
Read the worked answer
Both issues were mis-rated because the rating was qualitative and unlinked to appetite or consequence.
Custodian concentration at 40%: this is a concentration risk with low probability but severe impact - loss of assets or a freeze would be existential. It should be reported with the exposure amount, the recovery/insurance position, the alternative custodians available, and the time to migrate. A 'medium' label with no commentary gives the board no basis to challenge.
Private credit 5%→18% over three years: the signal is the trend, not the level. Illiquid allocations raise exit risk, valuation uncertainty and liquidity mismatch with benefit payments. Reporting should show the trajectory against the strategic limit, valuation methodology, redemption terms, and a stress case (e.g., gates or markdowns in a downturn).
Governance failure: ratings were assigned by the risk team with no owner accountability, no trend analysis and no escalation trigger. The board could not demonstrate challenge because the report contained no decision points. Effective oversight requires that material and emerging risks are escalated on defined triggers (e.g., concentration above a set percentage, illiquid allocation rising more than a set amount per year), that each has a named owner, and that the board minutes record challenge and decisions. The regulator's concern is not report length but whether the board could have known and acted - and on this evidence, it could not.