Risk Reporting, Monitoring and Board Oversight
Reporting
Risk reporting should be decision-useful: concise, forward-looking, linked to appetite, and distinguishing exceptions from business as usual. Core elements include the risk profile against appetite and limits, KRIs with thresholds and trends, top and emerging risks, losses and incidents, stress results, and capital and liquidity positions. A dashboard with a clear escalation protocol beats a data dump.
KRIs
Good KRIs are measurable, comparable over time, predictive (leading rather than purely lagging), and linked to a limit or appetite statement. Each should have green/amber/red thresholds with a defined action and named owner at each level. Backtest KRIs periodically - a metric that never breaches may be badly calibrated rather than reassuring.
Board oversight
The board approves strategy and risk appetite, oversees that the framework is operating, and provides constructive challenge. It does not manage risk - that is management's job. Effective oversight needs independent-minded non-executives, adequate risk expertise on the risk committee, timely and clear information, and a documented record of challenge.
Traps
- Assuming more data improves oversight - volume obscures.
- Setting KRI thresholds without escalation triggers or owners.
- Believing the board should approve individual transactions or sub-appetite limits.
- Reporting only historical losses with no forward-looking indicators.
- Allowing management to control the reporting agenda.
Rule of thumb: if a report page does not change a decision, cut it. Every top-risk entry should state exposure versus appetite, trend, the key uncertainty, and the named owner.