OR 6 – Risk Reporting

Monitoring and reporting form the fourth step of the operational risk management cycle, coming after identification, assessment and mitigation. Once risks have been found, sized and treated, somebody has to watch them over time and tell decision makers how the picture is changing. A well-built report shows the board and senior management the firm’s operational risk profile, lets them judge whether the risk management framework is actually working, and confirms that the business is running inside the limits of its risk appetite. When those limits are breached, or when incidents turn out bigger or more frequent than expected, reporting is how the news travels upward. Such signals can point to a flaw in how the framework was designed or in how it is being applied, and either case calls for corrective action.

No single report can serve everyone, because each audience has its own role and its own reason for looking. Inside the firm, the minimum set of recipients is the board’s risk committee, the business lines themselves, the central operational risk function and the executive committee (ExCo). Outside the firm, the regulator and the public are always audiences, and many firms also report to suppliers, clients and other third parties. The raw material is broadly the same for all of them: the nature and size of the firm’s exposure, past risk events, risk appetite and the indicators that track it, the mitigation strategy, and resilience measures. What changes from one audience to the next is the selection, the level of detail and the format.

Internal and external audiences at a glance

The rest of this lesson follows that order. It starts with the governance committees, moves through the operational layers that generate the data, then turns to the content of a good internal report, the statistical traps in operational loss data, and finally the external audiences.

The board risk committee

The board delegates to its risk committee the job of checking that the firm’s risk management framework is effective. That remit is wider than operational risk, since the committee looks after every risk the firm faces, but operational risk is a large part of it. The risk appetite itself is set by the full board, so what the committee needs from operational reporting is enough evidence to conclude that the firm’s control and monitoring systems keep the business compliant and inside that appetite.

In practice the committee receives the key risk indicators tied to appetite, how often risk events occur and how severe they are, and investigations into the causes of large events. It also expects a summary of the overall operational risk exposure, emerging risks and any upward trends. Significant control failures, or a marked change in operational risk status, are escalated to it directly. When the committee issues directives, it is the ExCo that carries out the changes needed to manage the risk profile better.

The audit committee

The audit committee is a second board subcommittee, and it owns a third level of oversight delivered through internal audit, which is the third line of defense. Internal audit gives assurance on the whole internal control system, so its scope goes well beyond operational risk, yet it overlaps heavily with operational risk management. Internal audit reviews the operational risk function on a regular cycle and reports what it finds to both the ExCo and the audit committee. Control weaknesses and vulnerabilities uncovered during audits also go to the audit committee. Because those weaknesses must connect to the strategies that will fix them, board members sometimes sit on both the risk committee and the audit committee at the same time, which keeps the two views joined up.

The executive committee

The ExCo combines elected board members with senior executives and steers the work of the full board. It keeps decisions moving between board meetings and during a crisis. In calmer periods it sets priorities for the board’s agenda, oversees board policies and safeguards good governance. On risk specifically, the ExCo is responsible for making sure the operational risk management (ORM) framework is executed properly and effectively. So, any significant information showing whether the framework is working, or failing, belongs in ExCo reporting: risk events, action plans and the status of remediation, culture and use test indicators, and trends in risk and exposure.

Most operational risk information in the firm flows into the second line of defense, where the central operational risk function gathers it from every business line. The function turns that mass of data into aggregated, synthesized reporting for the operational risk committee and sends feedback back down to the business lines. The content covers risk events together with exposures, controls, indicators, the status of action plans, and changes in the risk profile caused by new initiatives or emerging trends. All of it should be analysed, condensed and formatted so that each audience can actually use it to decide something.

The central function has a vantage point nobody else has. Cybersecurity, employment issues and damage to physical assets cut across the whole firm, yet business lines tend to manage them inside their own silos. Only the central function sees how these risk and event types interact, so it is responsible for presenting the risk profile as a whole rather than as a collection of fragments. A second duty follows: it must coordinate the separate reporting streams by risk type and business line so that the combined view is complete without the same item being reported twice.

Business-line managers and risk champions

The data starts life in the business operations, where it is watched most closely. Business-line managers usually track the status of their key risk indicators (KRIs), how their action plans are progressing, and what kind of events their unit has suffered and how serious they were. That information travels up to the central function for the firm-wide report. Reporting that comes back down gives managers and risk champions more than a view of their own risks: it lets them benchmark their unit against other business lines, other departments or a firm-wide average.

Too much versus too little

Risk reporting is harder than ordinary management reporting, and the classic dilemma is volume. Reports running to several hundred pages are common, even at board risk committee level, and the bigger the pack, the more likely it is that a critical signal goes unnoticed. Burying insight under detail is dangerous in risk matters. The opposite failure is just as real: squeeze the data into a few pages, especially through poorly chosen aggregation, and the result can lose its meaning altogether.

The design answer is to decide, for each audience, what to send and in what form. Senior management, departments and business units need different information at different depth. Moving information upward means choosing what to escalate unchanged and what to fold into summary statements. High risks, near misses and failing key controls are typically passed up without alteration, while the remainder is aggregated.

Several large banks select risk information in tiers, sending a smaller slice to each higher decision level, and the shape this produces resembles a tiered cake. The name “reporting cake” was coined by Chapelle in a 2015 article. Each tier is defined by what its audience needs the information for.

Tier 1: all you need to monitor

For business-line managers and risk champions, monitoring and reporting are practically the same activity. They work with the full set of metrics and follow exposures and indicators every day. Most of this detail never leaves the operations level; only alerts that need escalation, plus summaries of everything else, move up.

Tier 2: all you need to act

Division heads and the operational risk committee receive only the subset of metrics that calls for action from them. Typical triggers are launching an action plan to redesign a faulty process, approving a budget to automate controls, or stepping in early to limit the damage from an operational risk event. Everything that requires no action from senior executives goes into a monthly or quarterly template showing the overall operational risk profile without flagging any particular concern.

Tier 3: all you need to decide

Executives and board members make decisions that shape the direction of the company, so they need the most relevant material for that purpose. It may include leading indicators that show where to put more attention and resources, trends of worsening performance, progress against plans, and unexpected results, good or bad, that reveal risks materialising against objectives. A top-down scan of the environment affecting the firm’s strategy is also part of this tier.

Operational risk reports look very different from firm to firm, in template as well as in focus. Some firms spend most of their pages narrating past incidents and how often and how badly losses struck; others look ahead and concentrate on the risk outlook, KRIs and action plans. As a broad rule, a more mature ORM approach produces more forward-looking reporting. Qualitative monitoring matters just as much as quantitative trend analysis of loss volatility or of shifts in the loss profile caused by internal or external changes to people, processes or systems.

A comprehensive internal report has at least seven building blocks. The outline below would suit a quarterly pack for the operational risk committee; the depth of each element varies by audience, with more detail for specific activities and more aggregation as the report moves up the hierarchy.

Prioritised risks and the risk outlook

The top-10 list, drawn from the risk register (also called the risk inventory), is among the most common features of any operational risk report. Senior management chooses the risks according to its strategic priorities, usually ten of them, so the list tells the reader where management’s concern is concentrated. A risk can earn its place because of high inherent exposure, meaning the business environment makes it intense, or because of high residual exposure, meaning the controls fall short. (Credit risk uses the words gross risk and net risk for the same two ideas.) During the COVID-19 pandemic, for example, firms ranked staff well-being, the extra risks of home working and cyberattacks near the top because the environment had made those risks unusually intense. A firm that doubts its anti-money laundering (AML) controls might likewise put the risk of a compliance breach on its list.

Regulatory and compliance breaches, cyberattacks, data loss and technology failures appear on most financial firms’ lists, next to risks specific to the firm. A bank in the middle of a large digital transformation will usually rank project failure and transformation risk highly. The risk outlook works like a rating agency’s credit outlook: it says whether each risk is expected to rise, fall or stay roughly where it is.

The illustrative template below follows that structure. The final column is derived here by multiplying impact by likelihood; the products line up with the printed rating labels (20 Extreme, 16 High, 12 Major, 9 Moderate, 8 Minor).

Illustrative risks that do not describe any real organisation. The template also carries an empty column for residual position and planned activity.

Outside modelling and capital work, business lines assess operational risks with qualitative likelihood and impact scales in a risk and control self-assessment (RCSA). The output is collected in a risk register, which lists every assessed risk with its description and its likelihood and impact both before and after controls. A full register resembles the top-10 template but also names the controls on each risk and rates how well they operate, since that rating justifies the residual level. The top-10 list is, for the most part, a selection of the highest risks in the register.

The heatmap, or probability-impact matrix, plots the same register in two dimensions. It usually communicates better than a table: one page carries the main message, and nobody has to read fine print.

Risk appetite metrics

The risk function owes the board enough good-quality information to tell whether the firm is within its appetite and, where it is not, what action to take. So, appetite reporting is central to operational risk reporting. The metrics cover overall exposure, what the controls must achieve, and incidents or near misses. Business units collect and analyse them one by one, together with issue monitoring. These measures, also known as risk appetite KRIs, show whether the firm is complying with the limits of its operational risk appetite. When they reach the board, they appear as one list rather than being split into operational risk subcategories.

The table below is modelled on the appetite and KRI structure of a European retail bank and is for illustration only, not a statement of best practice. Columns have been reordered so that the trend reads left to right, and a derived column shows the change since the last period.

Values exactly as printed in the illustration. The threshold for “1 minus % of high performers” is printed in a stylised glyph and is read here as 50.

KRIs can give a detailed, forward-looking reading of exposure within particular activities, or of the drivers behind one specific risk. When it comes to collecting data, choosing KRIs and reporting them, many firms have learned that reusing metrics already gathered somewhere in the organisation is quicker and more effective than launching a fresh data collection exercise.

Case study: a conduct dashboard built from existing metrics

In 2018 a commercial bank faced an urgent internal audit recommendation. Its risk and compliance function had to produce metrics that would let the risk committee and the audit committee follow staff conduct toward retail customers, the reporting and resolution of risk events, the timeliness of action plans, and compliance. The same dashboard would also show regulators that the bank’s internal monitoring was strong. The bank went through a long list of conduct-related metrics that it already collected and kept those that met both aims. Approximately 20 metrics qualified, which is plenty for a single risk. The compliance department gathered the figures from the departments that produced them and issued the dashboard every quarter. Four years later it was still running, and internal audit had long since closed the recommendation.

An abbreviated version follows. Thresholds are illustrative, columns are reordered so that the three periods sit together, and indicator names are shortened.

Values as printed. “Flat” stands for the dash printed in the trend column. Two Q-2 entries (control testing and incident reporting) are printed in a stylised glyph and are read as 50. The threshold for days overdue is printed with a percent sign.

Issues as a reporting stream

Issues are signs of trouble in operations or in the control system that could lead to incidents: logged IT problems, flags on weak controls, overdue action plans, operational glitches and process delays. Picture a mortgage lender whose new underwriting tool has bugs that cause errors and slow loan closings, annoying staff and borrowers alike. Nothing has been lost yet, but left unfixed the bugs could turn into legal and commercial damage.

Issues behave like KRIs, because both an open issue and an adverse KRI trend mean an operational risk event has become more likely. Most issues relate to a process and belong to one activity or business line, and some, such as control weakness metrics, system vulnerabilities or missing data encryption, can serve directly as preventive KRIs. Reporting them usefully is hard, so they should be grouped by business line, by emerging risk, or by major initiative such as a new business, a merger or a large project. Most firms run a full issue collection system from operations up to the central risk function, and Tier-1 banks commonly convert an issue that remains unresolved after its allotted time, usually three months, into a KRI.

A great many firms open their operational risk report with what actually happened: the events that occurred and what each one cost. Event reporting is a core part of ORM reporting and normally covers four things:

• how many events there were and how large they were;
• frequency and severity by period, by event type and by business line or unit;
• a trend analysis, or at minimum a comparison across quarters or months depending on the reporting cycle;
• a separate narrative for larger incidents above an internal materiality threshold.

Thresholds and classification

Under the new standardized approach to operational risk capital, banks must track events with financial losses above €20,000 and, separately, above €100,000, or the equivalent in dollars or another currency (Basel Framework, OPE25, paragraph 25.18). Good practice is to record each loss above the threshold individually and give it a classification that links it to similar losses elsewhere in the firm. Classifications are increasingly standardised and shared across institutions; the ORX global banking loss-data classification is a widely used example.

Collection thresholds, by contrast, still differ widely. Some firms record every event down to $1 of loss, while others collect only losses above $10,000 or equivalent, or only certain impact types. Events that damage reputation or carry regulatory consequences are collected and reported almost everywhere. Since operational loss distributions are so asymmetric, small losses vastly outnumber large ones, a point taken up in a later section.

Near misses and potential impact

A strong risk culture includes near misses in incident reporting. Their importance is judged by how much damage was avoided by luck. They teach the same lessons as real losses without the cost, which makes them one of the best opportunities to strengthen the ORM system. In principle an event’s materiality depends on its potential impact as well as its actual impact, so thresholds ought to be set on potential impact. Potential impact is hard to estimate reliably, however, so most firms and regulators set their thresholds on observed impact instead.

Action plans, controls and remediation

Action plans are mitigation programmes meant to strengthen the control environment, and they come in more than one flavour. Corrective plans are reactive: they often follow a large incident, responding to a loss that surprised the firm or exposed an unexpected gap in the ORM system. Detective controls are built into operations so that possible incidents are spotted early. Preventive plans target specific risks that exceed the firm’s appetite, for instance risks surfaced in an RCSA or a “war room” scenario exercise.

Action plans are run like small projects. The business-line owner tracks and reports them, implements the controls and reports progress on the actions taken. Firms with strong risk management set a “zero objective”, meaning no overdue action plans and no overdue audit recommendations. Overdue counts are sometimes called discipline indicators. Where risk management is robust, senior management and the relevant board committee, whether the board risk committee, the audit committee or the ExCo, see both current and overdue figures.

Emerging risks and horizon scanning

Volatile business conditions have pushed firms to scan the horizon for new trends and emerging risks, which are then reported to the board risk committee monthly or quarterly. Much of this scanning concentrates on regulation and on changes in the compliance environment. Had it been applied in the 2007 to 2009 financial crisis, horizon scanning would have exposed weak operational controls around mortgages, such as unrealistic property appraisals and poor valuation of mortgage-backed securities. Good practice is for the scan to capture the drivers that could change emerging risks and to highlight shifts in volatility. A common way to present the results is a set of concentric rings, each ring marking how soon a risk could materialise.

Risk software for reporting

Dedicated applications for collecting and reporting operational risk data have multiplied over the last two decades and are now usually called governance, risk, and compliance (GRC) systems or solutions. Vendors range from very small firms to global software houses, and prices differ by several orders of magnitude, roughly $10,000 at the low end and over $1,000,000 at the top, depending on the vendor, product complexity and number of users. Whatever the price, every GRC tool aims to simplify collection, treatment and reporting of risk data by linking risks with controls, collating assessment data and generating reporting packs automatically. More advanced systems also assess control effectiveness as the environment changes, including when internal or external stakeholders reset risk appetite priorities.

Collecting operational risk data costs money, particularly when the work is manual and qualitative, so apart from mandatory regulatory reporting every monitoring and reporting choice should pass a cost-benefit test like any other business activity. Three rules capture the test, and together they amount to asking “so what?” of every number in a report.

1. The information must be worth more than it costs to gather. If producing a metric costs more than the insight it delivers, it should not be produced.
2. The firm must know what the information is for. A report adds value when its purpose is clear, when it fulfils that purpose, and when collection, monitoring and remediation support management’s objectives and priorities.
3. Good reporting should influence a decision, even if the decision is to carry on with business as usual (BAU). This rule ties the first two together: information has value when it changes, or deliberately confirms, what management does.

The asymmetry of operational losses

Operational loss data is heavily skewed, with most of the total severity coming from a few rare, very large events and most of the event count coming from frequent small incidents that barely dent the annual loss budget. The pattern holds across firms and over time. Aggregated 2014 to 2019 statistics from ORX, the largest operational loss data consortium, whose members include most of the world’s biggest banks, show how stark it is.

The largest losses, above €10M, made up only 0.4% of occurrences but 66.6% of total severity. The smallest, between €20K and €100K, were 57.9% of occurrences yet only 4.4% of severity. The resource lesson is direct: risk management effort should go into preventing and fixing large incidents rather than chasing daily noise. Frequent, visible but trivial events are an easy trap for inexperienced risk managers.

Escalating large events

Large events, and near misses above the firm’s tolerance, usually become known to management and the people affected almost at once, and they must go straight to senior management for review and action. Each one receives detailed reporting, root-cause analysis and a remediation plan. Being outliers, they should also be reported separately from the small losses so that they do not distort the summary statistics and give a false picture of the distribution.

Handling a large number of small losses

Small frequent losses make up most reported incidents, and a lower collection threshold means a longer list. The list is longer still where processes remain manual and human error is common. These losses deserve regular analysis to spot patterns that point to a control breach or a structural process flaw needing an action plan. If instead they arrive randomly, are capped in size, stable and repetitive, their average cost can simply be priced into the service and passed on to customers.

A loss figure on its own says little; the same amount can be trivial in one setting and alarming in another. Losing $100,000 to operational events during a transformation expected to deliver millions in synergies and efficiency will be read very differently from losing $100,000 in a mature, thin-margin activity. Likewise, a new product with low margins that brings heavy compliance risk, and with it a Pillar 2 capital add-on, may not be worth launching. Expressing losses relative to a benchmark, such as gross income or the regulatory capital consumed, helps management decide both how much operational risk to budget for and where to allocate capital.

The useful denominators are gross income, the total cost of a cost center, the total budget of a project, or regulatory capital measured in basis points. Because capital is scarce and costly in banking, a growing number of banks express the financial effect of operational risk in basis points of regulatory capital consumed. Percentages make units of different size comparable and let the same report format scale to any entity, and they help operational risk managers weigh the costs and trade-offs of adding controls or restricting operations.

The skew in operational losses does more than redirect management attention; it changes how the data should be summarised. So, a summary rule applies: “No averages in operational risk.” An average is informative when the distribution is symmetric, has a low variance, contains no outliers or clusters and has one mode, and operational risk distributions rarely satisfy any of those conditions. Applied to them, the mean becomes far less relevant and often misleading.

Better choices are the median, the point that splits the distribution in half, and the first and third quartiles, which are just as easy to show and explain. The distortion in a loss average usually comes from a handful of outliers. If an average is genuinely required, strip the large tail losses out before calculating it and report each of them on its own. The body of the distribution is more concentrated and more symmetric, so an average, minimum or maximum describes it sensibly. The same caution applies to KPI and KRI data, risk ratings and any observations whose distribution must be understood before they yield insight.

The flat line that hides the story

Picture a made-up KPI tracked for twelve quarters, perhaps fully satisfied customers per unit of sales or days ahead of or behind schedule. A flat line drawn at its average sits close to most quarters yet far from the few large positive and negative spikes. In risk management, those spikes are exactly where the information lies. Averages also hide heterogeneity: they stop the reader from seeing clusters of similar events, customers or employees that push a metric up or down. Looking at the whole distribution and then drilling into meaningful subgroups, for example complaints per salesperson revealing that a small group generates most of them, brings that structure to light.

Credit card fraud is caught because spending departs from a customer’s usual pattern, and the same logic runs through all good risk reporting: information lives in deviations from the norm. Outstanding traders, the positive outliers, have unusually long records of performance; rogue traders, the negative outliers, often report suspiciously smooth, low-volatility results. The best managers keep their staff longer and achieve the highest productivity, while weak suppliers cause the most operational mishaps. Value is found in patterns, in the concentrated regions of a distribution, and in the gaps between observations.

A trend observed over two or more cycles can establish a baseline of normal behaviour, which makes abnormal readings easier and more reliable to detect and helps set KRI thresholds and alert criteria. The analysis has to fit the data, though. Applying identical summary statistics and charts to datasets with different distributions and different data-generating processes, a “cookie cutter” approach, is a mistake.

Reporting is also a chance to look behind the numbers at what is going well, not just at what might fail. Positive outliers, pleasant surprises and exceptional performance carry useful information, and success stories can yield lessons worth reporting. Sadly, most risk managers give these far less attention than they give to problems and large historical losses.

Scenarios that could shift the loss profile

Robust analysis of loss patterns also considers low-, medium- and high-risk scenarios that could change the loss profile. Over the last decade, climate change has been the clearest example of a condition that can speed up losses. Greater volatility in environmental factors has caused unexpected operational losses: weather damage, for instance, can lead to long system outages and lost customer revenue, especially where business continuity plans are inadequate. Unexpected changes to regulatory compliance frameworks can also cause losses if people, processes or systems fail to adjust in time to the new operating environment.

A risk rated “5” (extreme) next to a risk rated “1” (low) is not necessarily the same as two risks rated “3” (moderate). Risk scores, colour ratings and similar indicators are discrete and qualitative, so they cannot be added or averaged. They tell you the order of risks, but a rating written as a number is no more additive than one written as a colour or an adjective. Financial risk reporting rarely meets this problem; operational risk reporting meets it constantly. Three approaches are worth considering.

Conversion and addition

Translate each qualitative metric into one linear, additive monetary unit, then add. The so-called non-financial impacts (reputational, regulatory, continuity and so on) are expressed in money and summed with the financial impacts. Money is continuous, so totals can be compared across RCSA results or different event types. The method rests on assumptions and approximations that some firms dislike, while others value the comparability. It has a further benefit: putting money on non-financial impacts shows how large operational risk is next to credit and market risk and catches senior management’s attention more effectively than colours.

Categorization

When conversion is impractical or unwanted, report scores and indicators grouped by colour or score. Counting by category avoids collapsing mixed information into a false aggregate, yet keeps the report short and balanced. Stacked bar charts with red at the top are known as “candle” charts: the longer the flame, the greater the danger. The image tends to stick with audiences. Any comparable sets of red-amber-green (RAG) ratings, such as RCSA results, KRIs, action plan ratings, issues or audit recommendations, can be shown this way.

Worst-case reporting

The worst score in a set, such as a group of KRIs, becomes the aggregate value, so a single red item turns the whole group red. No other aggregation is as conservative and fits cases where risk tolerance is minimal and the data are reliable predictors of the risk. It is prudent but can be over-alarming, and it can even become unsafe if it fires so many alerts that people start ignoring them.

Case study: an aggregated RCSA heatmap

A retail asset-management bank combined the results of several RCSA workshops into one heatmap, with confidential details modified. Each cell counts how many risks, across all assessment units, were placed at that pairing of likelihood and impact. Mitigation starts with the risk in the top-right corner and works down and to the left until the risks are within appetite. The table transposes the printed grid and adds derived totals; blank cells were empty or unreadable in the printed figure.

Likelihood scale: almost certain means expected within the year; likely, within 2 years; possible, once in the next 3 to 5 years; unlikely, not in the coming 5 to 10 years; rare, not in the coming 20 years.

Combined assurance asks the three lines of defense to cooperate so that the board receives one coherent assurance picture. The aim is to align the assurance work of internal audit with that of the other assurance providers so that senior management and the audit committee receive sound insight into governance, risk and control. Internal assurance providers are the second-line functions: the ORM function and other risk management teams and, depending on the firm, IT security, legal, compliance or quality assurance.

Combined assurance marks a mature level of coordination among oversight functions, with joint scheduling, consolidated planning and reporting, a common vocabulary and a shared methodology. In practice the three lines agree on one risk taxonomy and assign clear ownership and accountability for every risk. Each line agrees its review plans and timetable with the others, so that, for example, internal audit’s plan and the risk function’s reviews do not overlap or duplicate one another. The ORM function, as owner of risk oversight, keeps the combined assurance map and uses it to report oversight results to the relevant governance committee.

Who does what

• First line: assesses risks and controls, tests controls, and attests that controls and risk management activities work as intended.
• Second line: oversees the first line’s risk management, carries out deep-dive thematic analysis and risk assessment on chosen risk types, and sample-tests controls.
• Third line: performs periodic internal audit assurance according to the audit cycle.

A combined assurance map shows each assessment unit against the three lines with a RAG status in each cell. Green means satisfactory, amber means attention is needed, red means an unsatisfactory rating demanding attention and action, and grey means no assessment has been made. The example below, reported to the board risk committee, uses modified data for illustration.

Reading across a row is what makes the map useful. Business Unit 1 has an amber self-assessment, no second-line review and a red audit result, which signals that the first line underestimated its own problems and the second line has not looked. Qualitative and historical data remain the foundation of an actionable ORM framework, but quantitative techniques, modelling included, can complement them, and addressing management’s objectives in both ways makes assessment, reporting and mitigation more dynamic. Given how uncertain operational risk is and how short its history of data, many firms add scenario analysis to their existing toolkit.

Public disclosure of financial and risk information falls under Pillar 3 of the Basel framework. The Basel Committee updated the Pillar 3 operational risk requirements in December 2018, following publication of the standardized approach. Under that approach (SA), banks compute operational risk capital from defined components: the business indicator component, built from data covering the past three years, applies to every bank using the approach, and any bank that must compute an internal loss multiplier also feeds in its own loss events from the past 10 years. The disclosures fall into three parts.

1. Qualitative disclosure on how operational risk is managed

Banks describe the governance and risk management arrangements they use to manage, mitigate or transfer operational risk. That includes their policies, frameworks and guidelines, how the ORM and control function is structured and organised, the measurement systems and data behind the capital charge, the scope of operational risk reporting to executive management and the board, and the risk mitigation and risk transfer tools they rely on.

2. Historical losses

This and the next component are quantitative, mandatory for every regulated bank, and reported annually in fixed, prescribed templates. Banks must disclose enough about aggregate operational losses over the past 10 years, dated by when each loss was booked in the accounts, to support capital calculations wherever a jurisdiction applies the internal loss multiplier within the SA. Each national supervisor sets the format and provides further guidance. Banks add narrative explaining the figures in aggregate and commenting on losses since the last submission, together with any other material information on losses or recoveries, but they may stay at aggregate level and leave out confidential or proprietary detail.

3. The business indicator and its subcomponents

The final component discloses the business indicator and its subcomponents, which drive the core of the capital calculation. Banks again add a commentary on significant changes during the period and what caused them.

Absence of evidence is evidence of absence

To a regulator or auditor, whatever cannot be proved does not exist; a risk manager’s spoken assurance is not accepted. Reporting and documentation provide the proof that controls and governance procedures exist, for regulators and for the market alike. A firm can show that its operational risk and governance frameworks are actually used by keeping minutes of governance committees, including the board, the board risk committee and the executive committee, and by recording issues, discussion and decisions in approved minutes. Reporting on each element of the operational risk management framework (ORMF) to committees and business lines lets the firm run ORM properly and change course when needed, and it also demonstrates effective ORM to outsiders and builds their confidence in the firm.

Separate from Pillar 3 public disclosure, most jurisdictions oblige financial institutions to tell their regulator about significant operational risk events and conduct breaches, in addition to informing law enforcement about fraud from inside or outside the firm, malfeasance or terrorism. Any one of four criteria can trigger a notification:

• materiality criteria: the event is significant relative to a loss or materiality threshold;
• reputation criteria: the event significantly affects the firm’s reputation;
• resilience criteria: the event could stop the firm providing adequate services to customers and could seriously harm a customer;
• stability criteria: the event could have serious consequences for the financial system.

Regulators expect firms to be “open and honest” about their operational risks. Firms often feel pulled between compliance and reluctance to reveal internal failures, but transparency is the best policy for keeping the regulator’s trust. In any case, a significant incident usually affects outside parties and is soon picked up by specialist media, so it will become public regardless.

Reporting to the market: the risk section of the annual report

Beyond Pillar 3 and domestic law, firms discuss their risk exposures and risk management in the annual report. For banks and other financial services firms most of that discussion concerns financial risks, but operational risk is gaining weight. The challenge is to appear transparent, aware and honest about exposures without alarming stakeholders unnecessarily. Research on risk communication has found that firms seen as both open about their risks and competent in handling them earn more trust in their brand and management.

Credit Suisse’s 2021 annual report illustrates the approach. Its operational risk discussion in the first half highlights cyber risk, along with keeping data secure, keeping systems running, and meeting many demanding regulations, and lists the bank’s significant operational exposures and the near-unavoidable events they may produce. The tone is frank: the bank acknowledges that its risk management policies and procedures might not fully mitigate every risk in every market environment and that unexpected material losses could follow. The second half contains a detailed risk management section organised into five parts: key risk developments in 2021 and beyond; risk oversight and governance, including culture and the main committees; the risk appetite framework and the constraints it applies; risk coverage and management, giving for each risk type its definition, sources, evaluation, management and governance; and a risk portfolio analysis with quantitative detail, mainly on credit and market risk.

Reporting on operational resilience

Operational risk reporting is being joined by reporting on operational resilience, to meet market and regulatory expectations. In the UK, regulated financial firms entered a three-year transitional period in March 2022. By March 2025 they must have mapped and tested each important business service so that it can stay within its impact tolerance, made the investments needed for those services to operate consistently within their tolerances, and reported on these elements to the regulator.