Reporting
The report should match what the desk actually saw
Reporting assembled after the fact tends to describe a tidier version of events than the one people lived through. Deriving it from the same records removes that gap entirely.
Peak, average and closing position by dimension
How close to the ceiling, and how often
Every one, whether it was overridden and by whom
Manual and automatic actions with their reasons
Scenario outputs run over the period
Standing overrides and when each expires
Three principles
The second one is the least popular and the most important
Derived, never reassembled
Reports are computed from the event record rather than rebuilt from exports. A report run today for last quarter returns the answer it would have returned then, which is the only useful definition of accurate.
It should be uncomfortable sometimes
A risk report that never contains anything awkward is not measuring anything. Breaches and overrides appear whether or not they reflect well, because their absence is what a regulator would find interesting.
Scheduled, not remembered
The reports that get produced are the ones that arrive without anyone triggering them. Anything depending on a person remembering is a report that stops existing during a busy month.
See it live
The pack, generated rather than assembled
Exposure, utilisation and breach history sit in the same KPI tiles and charts the desk already uses, so the board reads what the desk saw.
FAQ
Risk reporting: common questions
6 short answers to what teams ask before a demo.
From the same event records the desk acted on at the time, not from exports reassembled afterwards. This is why a report run today for an earlier period returns the same answer it would have returned then.
Yes. The standard set covers what most boards and regulators ask for, and beyond that the underlying data is available so your own template can be built rather than approximated.
Always, with who overrode them and why. A report showing only the breaches nobody overrode gives a flattering and misleading picture, and its incompleteness is exactly what an examiner would look for.
On whatever schedule you set — daily for the desk, monthly for management, quarterly for a board. Scheduled delivery matters because reports requiring someone to remember are the ones that lapse when things get busy.
Yes, with expiry dates. Standing overrides accumulate quietly, and a periodic list of what is currently disapplied is one of the more useful pages in any risk pack.
Yes, in structured form as well as as a document, so it can feed your own reporting rather than being re-keyed into it.
Still have a question?
A specialist will answer it directly, with your set-up in mind.
Ask a specialistHow long does your risk pack take to produce?
If the answer is measured in days and involves one person who knows where everything is, that is the risk worth reporting on.