Reporting

Sergio Scandizzo

Reports are the main product of operational risk functions around the world. They are the tangible, quantitative, hopefully useful and actionable key output of the risk-management process. The richer and more informative the report, the more numerous and highly placed its audience, the more trusted and unquestionable its conclusions, the more successful and well regarded the operational risk group that produces it is. In contrast a report that no one reads or one that is in practice inconsequential, no matter the readership and the content, is a sure sign that the operational risk function has failed in its one, most important goal: making the organisation aware and responsive to the threats of operational risk.

It follows that, like all the other key concepts discussed in previous chapters (risk identification, risk measurement, risk appetite and so on), reports are worth more than the paper they are printed on only when they become useful management tools. This does not happen solely because a report is up to the best-quality standards, in form and/or in content, but requires an entire framework to be in place whereby operational risk is recognised as a matter for which staff