Skip to content

FRM Exam Part II · Risk Reporting

Frequency, Distribution and Review of Risk Reports under BCBS 239

Updated 11 October 2026 · Fact-checked

Under BCBS 239, a bank must produce risk reports at a frequency that matches the risk, the user and stress conditions, and send them promptly to the right recipients with confidentiality protected. Supervisors review compliance, require remediation of weaknesses, and cooperate across home and host authorities.

Understand Frequency, Distribution and Review of Risk Reports

Risk reports exist so that decisions get made. A perfect report that arrives late, or goes to the wrong person, helps nobody. BCBS 239 (the Basel Committee's principles for effective risk data aggregation and risk reporting) treats this as the last group of principles: timeliness (frequency) and distribution, plus supervisory review, tools and cooperation.

Frequency. The board and senior management should set how often each report is produced and how fast. Frequency depends on the nature of the risk, how fast it changes, and how important the report is to the decision. Fast-moving risks such as market and liquidity risk need more frequent reports than slow-moving ones. Frequency must also rise in stress or crisis. A bank should be able to produce accurate reports quickly, including ad hoc requests, without breaking its own data quality standards. Speed must not cost accuracy.

Distribution. Reports must reach the right people on time. That means the board, senior management and other relevant functions get the information they need. At the same time, access must be controlled. Sensitive information should be shared on a need-to-know basis, and confidentiality must be kept. Good distribution means both: nobody who needs it is missed, and nobody gets it who should not.

Supervisory review. Supervisors should review and evaluate how well a bank complies with the principles. They can use on-site work, internal and external audit findings, thematic reviews and other tools. Where weaknesses are found, supervisors should have the tools and resources to require remedial action, and can use measures such as limiting risk-taking or requiring independent reviews. Remediation should be timely and tracked to completion.

Home and host cooperation. For banks operating across borders, home and host supervisors should cooperate and share information about compliance. This avoids duplicated or conflicting reviews and lets weaknesses in group-wide reporting be seen as a whole.

Key formulas to remember

Frequency principle
Frequency ∝ speed of risk change × importance to decisions; increase in stress
This is a rule of thumb from the principle, not a numeric formula. No fixed number of days is prescribed for all reports.
Distribution principle
Right recipient + right time + confidentiality (need-to-know)
Both parts matter. Wide circulation without access control fails the principle.
Supervisory cycle
Review → identify weakness → require remedial action → follow up
Supervisors can use audit findings, thematic reviews and on-site work. Remediation must be monitored.
Cross-border rule
Home supervisor + host supervisors → cooperate and share information
Aim is consistent assessment of group-wide compliance.

How to solve Frequency, Distribution and Review of Risk Reports questions

Most questions give a short case about a bank's reporting and ask what is wrong or what should happen next. Use this method.

  1. 1Identify which part is tested: frequency, distribution, supervisory review, remediation, or cooperation.
  2. 2Find the report's user and the risk's speed of change. This sets the right frequency.
  3. 3Check whether stress or ad hoc demand applies. If so, the bank must still produce accurate reports quickly.
  4. 4Test distribution on both sides: did the right recipients get it on time, and was confidentiality kept?
  5. 5For supervisory items, ask who acts (home or host supervisor) and which tool fits: audit review, on-site work, or required remediation.
  6. 6Match the answer to the principle wording. Prefer options that keep accuracy and timeliness together.
  7. 7Eliminate options that use fixed schedules for all reports, trade accuracy for speed, or ignore cross-border cooperation.

Quickest way: Three-check scan

When to use it: When you have under 90 seconds and the options look similar.

  1. Check frequency: does it match risk speed and stress needs?
  2. Check distribution: right people, need-to-know access.
  3. Check supervision: review, then remediation, then cooperation across home and host.
  4. Pick the option that satisfies all three and does not sacrifice accuracy.

Common mistakes in Frequency, Distribution and Review of Risk Reports

  • Assuming one fixed reporting frequency for every risk report.

    Students want a number to memorise.

    Fix: Remember frequency is set by risk nature, speed of change and user needs, and rises in stress.

  • Thinking faster reporting justifies lower accuracy in a crisis.

    Urgency feels more important than precision.

    Fix: The principles require timely reports that still meet accuracy and integrity standards.

  • Treating wide distribution as always better.

    Transparency sounds positive.

    Fix: Distribution must protect confidentiality. Share on a need-to-know basis.

  • Believing supervisors only observe and cannot require action.

    Confusing principles with voluntary guidance.

    Fix: Supervisors should be able to require remedial action and follow it up.

  • Ignoring home-host cooperation for banks with foreign operations.

    Students think each supervisor works alone.

    Fix: Remember home and host supervisors should cooperate and share information on compliance.

Worked examples

Example 1

A global bank produces its liquidity risk report monthly. During a market shock, senior management asks for daily reports, but the data team says daily reports would need unvalidated data. What does BCBS 239 imply?

Show the solution
  1. Liquidity risk changes quickly, and stress raises the need for frequency.
  2. The principles expect the bank to produce reports faster in stress without abandoning accuracy.
  3. So the bank should have the capability to deliver validated daily data, not skip validation.
  4. The monthly cycle alone is inadequate for stress conditions.

Answer: The bank should be able to increase frequency in stress while keeping data accuracy. Using unvalidated data, or staying monthly, both fail the principle.

Example 2

A bank's credit risk report with named client exposures is sent to all staff by email to improve transparency. Which principle is breached and what should be done?

Show the solution
  1. Distribution has two tests: right recipients and confidentiality.
  2. Sending named exposures to everyone breaches confidentiality.
  3. The fix is to restrict access to those who need the information, such as the board, senior management and relevant risk functions.
  4. Aggregated, non-sensitive versions can still be circulated more widely.

Answer: The distribution principle is breached because confidentiality is not protected. Limit access on a need-to-know basis.

Exam tips

  • Look for the trap words: always, fixed, all reports, or accuracy sacrificed for speed.
  • Distribution answers usually need both timeliness and confidentiality.
  • For supervisory questions, pick review followed by required remediation, not mere observation.
  • In cross-border cases, home-host cooperation and information sharing is usually the right choice.

Practice questions from Risk Reporting

Frequency, Distribution and Review of Risk Reports in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Frequency, Distribution and Review of Risk Reports: frequently asked questions

How often should banks produce risk reports under BCBS 239?

There is no single fixed frequency. Management sets it by the nature and speed of the risk and the needs of recipients. Frequency should increase in stress, with accuracy maintained.

Who should receive risk reports?

The board, senior management and other relevant functions that need the information to decide. Access should follow need-to-know so confidentiality is kept.

What can supervisors do when reporting practices are weak?

They review compliance using tools such as audits and on-site work, then require remedial action and follow it up. They may also limit risk-taking in serious cases.

Why do home and host supervisors cooperate on risk reporting?

Cross-border banks report on a group-wide basis. Cooperation and information sharing let supervisors assess compliance consistently and avoid duplicate or conflicting reviews.