Charta is on Google Play: practise on the go. Get the app
Charta

Show how exposures should best be reported to regulators and other outside stakeholders.

FRM® Part II · Operational Risk and Resilience · Risk Reporting · FRM2.ORR.6.d

The idea

External reporting serves regulators and outside stakeholders such as investors, rating agencies and auditors, and each gets a different depth. Supervisors receive detailed, confidential information. This includes event-level data, capital calculations, remediation plans and prompt notice of material incidents, without waiting for a full root-cause study. Public disclosure under Pillar 3 of the Basel framework exists to support market discipline. It should be clear, comprehensive, meaningful, consistent over time and comparable across banks, covering governance, loss history and capital in summarised form. Client names and sensitive internal detail are not disclosed. Figures given to regulators, the public and the board must reconcile, and the basis, such as gross or net of recoveries, must be stated. The common error is treating a difference in basis as an inconsistency, or concealing a material exposure because the outcome is uncertain.

A practice question

From the question bank, with the reason each wrong option is wrong.

Which description best fits good practice for public disclosures about operational risk?

  1. Maximum detail, including the names of clients affected by each loss eventWhy not: Disclosing client names breaches confidentiality and adds nothing for market discipline.
  2. Reported once a decade in a format chosen to suit the bank each time it chooses to publishWhy not: Infrequent, inconsistent formats prevent users from judging risk and tracking changes.
  3. Clear, comprehensive, consistent over time and comparable - correct
  4. Qualitative statements only, avoiding any figures for losses or capitalWhy not: Omits the quantitative information users need; disclosure should combine qualitative and quantitative elements.

Disclosures must be meaningful to users, consistent over time and comparable, covering both qualitative and quantitative aspects without revealing confidential information.

A harder one

A material cyber incident causes a significant, still uncertain loss. Which approach to reporting it to the supervisor is best practice?

  1. Wait until the root-cause analysis is complete so the report is finalWhy not: Delays notification of a material event; supervisors expect prompt notice, even if preliminary.
  2. Include it only in the next annual public reportWhy not: Confuses public disclosure with supervisory reporting and gives the supervisor no timely information.
  3. Report it only if the loss would exceed the bank's total operational risk capital, which is a trigger that is almost never metWhy not: Sets an unrealistic trigger; materiality for supervisors is far lower than total capital.
  4. Notify the supervisor promptly with known facts, then update as the analysis develops - correct

Supervisors need timely, candid information on material events. Preliminary notification with later updates is better than waiting for complete answers.

The hardest tier

A bank has a large legal claim relating to a past processing error, with an uncertain outcome. How should it treat the exposure in reports to regulators and external stakeholders?

  1. Omit it until the case is settled, because its outcome is still uncertain and could be favourable to the bankWhy not: Hiding a material exposure makes disclosures misleading; uncertainty is no reason to omit it.
  2. Disclose its nature and estimated exposure, applying accounting rules for provisions, consistently across reports - correct
  3. Disclose a figure of zero to regulators and a range to the pressWhy not: Gives inconsistent figures to different audiences, which damages credibility and breaches reporting principles.
  4. Include it only in the internal report to avoid influencing share pricesWhy not: Withholds material information from supervisors and the market, contrary to disclosure principles.

Uncertainty affects how an exposure is measured and described, not whether it is reported. Disclosures must be consistent across audiences.

In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.

Start free →

More in Risk Reporting