Risk reporting, communication and stakeholder engagement
What the exam tests
Risk reporting and communication: tailoring information to boards, regulators, investors and policyholders, and ensuring it drives action.
Core rules
- Reports should be audience-specific: the board needs aggregated, forward-looking, appetite-linked information; operational managers need granular, timely data.
- A good board risk report includes top risks, movement, appetite status, KRI trends, limit breaches, emerging risks, stress results and actions with owners and dates.
- Use dashboards and narratives together; a heat map without explanation hides assumptions.
- Stakeholder mapping: identify influence, interest, information needs and regulatory obligations (e.g. ORSA report, supervisory reporting).
- Communication must continue in a crisis: pre-agreed channels, spokespeople and escalation.
Worked example
A board pack contains 200 risks and 60 pages of loss data. Directors cannot identify the top exposures. Redesign: ten principal risks, each with appetite status, trend, key indicator, latest stress result, owner and action. Appendices hold detail. Reasoning: aggregation and relevance support challenge and decision-making; the appendix preserves auditability. Reporting risk count, not risk significance, is a common failure.
Traps
Data dumps without interpretation; lagging indicators only; no action owners; reports inconsistent with the appetite statement; ignoring external stakeholders; over-smoothing bad news.