Risk Reporting
Domain focus
Risk reporting tests what the board and senior management receive, how often, with what data quality, and how breaches are escalated.
Core rules
- BNM expects timely, accurate and independent risk reporting to the board and its risk committee.
- Market and liquidity risk are typically reported daily to management; credit and operational risk monthly; the board receives a consolidated dashboard at least quarterly, with ad hoc escalation for material breaches.
- A good report covers risk appetite utilisation, limit breaches, concentrations, VaR and backtesting, incidents, liquidity ratios, compliance breaches and stress-test results.
- Data governance must ensure accuracy, completeness and timeliness; this aligns with BCBS 239 principles for risk data aggregation.
- Material incidents, including cyber incidents, must be escalated internally and reported to BNM within the required timeframe.
Worked example
A board receives a VaR report only quarterly. A limit breach occurs in week 2 and is not escalated until the next quarter. This is a reporting failure: management should receive daily VaR, the breach should be escalated immediately, and the board should see a monthly summary. The fix is an escalation matrix with defined thresholds and owners.
Traps
Do not report only to business lines. Do not hide breaches in averages. Do not confuse volume with insight. Do not exclude stress-test results. Do not miss BNM incident-reporting deadlines.