Board risk reporting: from register to judgement

Most board risk reports are inventories: forty risks, colour-coded, unchanged for six quarters. Directors read them the way one reads a safety card on an aircraft — obligatory, unmemorable, and consulted only after something has gone wrong. The failure is structural, not effort-based.

The register is the input, not the report

A register exists to be complete; a board report exists to direct attention. The translation between them is the risk function’s real job: which exposures moved, which controls weakened, which appetite limits are near breach, and — the question boards actually own — where is management asking the board to accept risk?

A structure that works

One page of movement. What changed since last quarter, and why. No heat map unless something on it moved.

Appetite against actuals. Each board-approved limit, its current reading, and the trend. Breaches carry a management action, dated.

Deep-dive on one risk. A single exposure examined properly each quarter beats forty summarised badly.

Decisions requested. Explicitly: what the board is being asked to accept, fund or stop.

Regulators have noticed the difference too. Supervisory teams increasingly ask not “do you have a risk report” but “show us a decision the board took because of one.” Boards that cannot answer are carrying governance risk of their own.

TrueNorth designs ERM frameworks and board reporting for UAE and GCC institutions — led by an SCA Approved Risk Officer.