Charta is on Google Play: practise on the go. Get the app
Charta

Pinpoint what the various organizational committees are responsible for, and show how risk reports ought to be built for each committee or business function.

FRM® Part II · Operational Risk and Resilience · Risk Reporting · FRM2.ORR.6.a

The idea

Risk reporting starts from the audience, because each body decides different things. The board and its risk committee set risk appetite and strategy, so they need short, aggregated, forward-looking reports that compare exposure with appetite and flag the few issues needing a decision. The audit committee oversees internal audit and the control environment, so it wants control weaknesses, audit findings and whether remediation is overdue. The management operational risk committee, made up of business heads and risk staff, needs more detail by business line: loss events, indicator breaches, action plans and owners. Business line managers need frequent, granular and actionable data on their own area. The usual mistakes are sending everyone the same report and burying decisions in detail. For the exam, match content, granularity and frequency to the committee, with one consistent data source underneath.

A practice question

From the question bank, with the reason each wrong option is wrong.

Which description best fits an operational risk report prepared for the board of directors?

  1. A complete listing of every internal loss event with ledger references, posting dates and the approvers of each write-offWhy not: Gives the board transaction-level detail that suits business line managers and buries the decisions the board must take.
  2. A concise, aggregated, forward-looking summary comparing exposure with appetite and flagging decisions needed - correct
  3. A daily report of operational incidents in each branch, with the names of staff involvedWhy not: Uses the frequency and granularity of a business line report; the board meets far less often and sets strategy, not branch actions.
  4. A technical annex on the loss distribution model parameters and fitting statisticsWhy not: Focuses on model mechanics for specialists, not on exposure against appetite.

The board sets strategy and appetite, so it needs short, aggregated, forward-looking reporting tied to appetite. Detail should be available on request, not placed in the main report.

A harder one

The chief risk officer sends the board risk committee a 60-page pack listing every internal loss event above USD 10,000, by business line. Directors say they cannot see where the firm stands against appetite. What is the main weakness of the report?

  1. It is too frequent, because a board report should never be produced more than annuallyWhy not: States a frequency rule that does not exist; the weakness is the granularity and lack of appetite focus, not annual versus quarterly timing.
  2. It reports loss events at all, since the board should only receive the regulatory capital numberWhy not: Treats capital as the only board metric; events and trends are valid content, but they must be summarised.
  3. It is too detailed for its audience and hides aggregate exposure - correct
  4. It is addressed to the wrong committee, because loss events belong only in the audit committee packWhy not: Assigns loss events to one committee only; the audit committee focuses on controls and audit findings, and the board still needs summarised loss information.

Good practice is to tailor granularity: the board gets aggregated, appetite-linked information and the management committee and business lines get event-level detail. The pack fails on audience fit.

The hardest tier

A bank sends the same quarterly group dashboard to the board, to the management operational risk committee and to each trading desk head. Desk heads say it is not actionable and the board says it is too long. Which redesign best follows good practice?

  1. Board: monthly, event-level by desk. Operational risk committee: quarterly, group totals only. Desk heads: annual, appetite basedWhy not: Reverses granularity and frequency: those closest to the risk need the most frequent and detailed data.
  2. Keep one dashboard for all three audiences, but lengthen it so that every audience can find the detail it needs in one placeWhy not: Keeps a one-size report and makes it longer, worsening the problem; reports should be tailored, not enlarged.
  3. Board: quarterly and aggregated. Operational risk committee: monthly, by business line. Desk heads: weekly, event-level data on their own desk - correct
  4. Board: weekly and event-level. Operational risk committee: annual and aggregated. Desk heads: quarterly and aggregatedWhy not: Gives the board the most frequent detail and the desks the least actionable data, the opposite of what each needs.

Frequency and granularity rise as one moves toward the front line; the board needs a periodic aggregated view, and desk heads need timely detail on what they can act on.

In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.

Start free →

More in Risk Reporting