FRM Exam Part II · Risk Reporting

Risk Report Content and Design for the Board

Updated 11 October 2026 · Fact-checked

A good risk report gives decision-makers a clear view of current exposures against limits and appetite, concentrations, forward-looking indicators and stress test results, with trends and actions. You solve exam questions by matching content and detail to the audience: the board needs concise, aggregated, decision-focused information; desks need granular data.

Understand Risk Report Content and Design

A risk report exists to support decisions. It tells readers what risks the firm is taking, whether those risks fit the risk appetite, and what might go wrong next. If a page does not help someone decide or act, it does not belong.

A good report has a core set of content. Exposures show how much risk is held, such as VaR, notional, or loan balances by risk type. Limits and appetite compare exposures with approved thresholds and flag breaches. Concentrations show where risk clusters: by counterparty, sector, country, product or funding source. Forward-looking indicators, including key risk indicators and early warning indicators, show where risk is heading. Stress test results show losses under severe but plausible scenarios.

Good design matters as much as content. Information should be accurate, complete, timely, clear and useful. Use trends over time, not single snapshots. Use consistent definitions so numbers can be compared period to period. Explain what the numbers mean, state assumptions and limitations, and give recommended actions with owners.

Tailor the report to the audience. The board and senior management need a short, aggregated view focused on risk appetite, major breaches, emerging threats and decisions required. Risk committees and business heads need more detail by portfolio. Desk-level users need granular, frequent data. Frequency also differs: trading risk may be daily, board packs often monthly or quarterly.

This topic links to BCBS 239, which sets principles for risk data aggregation and reporting. Its themes are accuracy, comprehensiveness, clarity, usefulness, frequency and distribution. A report is only as reliable as the data and governance behind it.

Key formulas to remember

Limit utilisation: Utilisation (%) = Current exposure ÷ Approved limit × 100; Report it with a trend and flag breaches or amber zones. Utilisation above 100% is a breach.
Headroom: Headroom = Limit − Current exposure; Negative headroom means a limit excess that needs escalation.
Concentration share: Share of largest exposure (%) = Largest single exposure ÷ Total portfolio exposure × 100; A simple concentration indicator. Often shown for top 10 names, sectors or countries.
Core content checklist: Exposures + Limits/appetite + Concentrations + Forward-looking indicators + Stress results + Actions; Use as a rule to judge whether a report is complete. It is a checklist, not a numerical formula.
Audience rule: Higher audience level → more aggregation, less detail, more focus on decisions; A general principle, not an absolute rule. Material issues must still be escalated to the board.

How to solve Risk Report Content and Design questions

Use this method for any question on what a risk report should contain or how to design it.

1Identify the audience: board, senior management, risk committee, desk or regulator.
2Identify the purpose: monitoring appetite, a decision, an escalation, or regulatory disclosure.
3Check content against the core set: exposures, limits, concentrations, forward-looking indicators, stress results and actions.
4Check design quality: accurate, clear, timely, consistent, with trends and context.
5Match detail and frequency to the audience: aggregated and decision-focused for the board, granular for desks.
6Look for the flaw in the scenario, such as data overload, missing limits, backward-looking only, or no recommended action.
7Pick the option that improves decision usefulness while keeping data integrity.

Quickest way: Audience-and-gap scan

When to use it: Use for scenario MCQs where a report is described and you must find the weakness or the best improvement.

Underline who reads the report.
Tick off the six content items. Spot the one that is missing.
Ask whether the information is backward-looking only.
Ask whether the detail level fits the reader.
Choose the option that fixes the gap without adding unnecessary volume.

Common mistakes in Risk Report Content and Design

Assuming more detail is always better for the board.
Candidates equate completeness with quality.
Fix: Remember the board needs aggregated, prioritised information. Detail goes in supporting appendices or lower-level reports.
Treating a report as only current exposures.
Exposure numbers feel like the core of risk reporting.
Fix: Add limits, concentrations, forward-looking indicators and stress results. Reports must show where risk is heading, not just where it is.
Showing exposure without the limit or appetite.
Candidates forget a number needs a benchmark.
Fix: Always pair exposure with its limit, utilisation and any breach.
Treating key risk indicators as lagging measures.
Confusing KRIs with loss data.
Fix: KRIs and early warning indicators are forward-looking signals. Loss events are lagging.
Ignoring data quality and consistency.
Focus is placed on presentation only.
Fix: Link reports to BCBS 239 themes: accuracy, completeness and timeliness depend on strong data aggregation and governance.
Using one report and frequency for every audience.
Candidates overlook that needs differ.
Fix: Tailor content, detail and frequency. Daily for trading desks, periodic for the board, with ad hoc escalation for breaches.

Worked examples

Example 1

A bank's monthly board risk pack contains 120 pages of position-level VaR by desk and historical loss data. It has no limit comparison, no stress results and no recommendations. Which improvement best raises its usefulness to the board?
A. Add more desk-level VaR detail
B. Replace it with an aggregated summary showing exposures against risk appetite and limits, concentrations, key risk indicators and stress results, with actions required
C. Move to daily distribution of the full pack
D. Remove all forward-looking information to avoid speculation

Show the solution

Audience is the board, which needs aggregated, decision-focused information.
The pack is detailed but lacks limits, stress results, forward-looking indicators and actions.
Option A adds more detail, which worsens overload.
Option C raises frequency without fixing content.
Option D removes forward-looking content, which the board needs.
Option B adds the missing core items and aggregates the information.

Answer: B

Example 2

A bank has a USD 500 million single-name credit limit for a counterparty. Current exposure is USD 430 million. The total credit portfolio is USD 8,600 million. Report the limit utilisation, headroom and this exposure's share of the portfolio.

Show the solution

Utilisation = 430 ÷ 500 × 100 = 86%.
Headroom = 500 − 430 = USD 70 million.
Concentration share = 430 ÷ 8,600 × 100 = 5%.
Interpretation: the limit is not breached, but at 86% it may fall in an amber zone, so the report should show the trend and flag it for monitoring.

Answer: Utilisation 86%, headroom USD 70 million, portfolio share 5%.

Exam tips

Always identify the audience first. Most questions turn on tailoring.
Check for the missing core element: limits, concentrations, forward-looking indicators, stress results or actions.
Prefer options that give the board aggregated, prioritised information with clear decisions and escalation of material breaches.
Link good reporting to BCBS 239 themes of accuracy, completeness, clarity, usefulness and timeliness.
Do simple utilisation and concentration percentages carefully and state what the result means.

Practice questions from Risk Reporting

Risk Report Content and Design in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Risk Report Content and Design: frequently asked questions

What should a risk report include for the board?

It should show key exposures against risk appetite and limits, concentrations, forward-looking indicators and stress test results. It should also highlight breaches, emerging risks and actions needed. Keep it concise and aggregated.

How do key risk indicators fit into a risk report?

Key risk indicators are forward-looking metrics that signal rising risk before losses occur. Reports show them with thresholds and trends. Breaching a threshold should trigger escalation and action.

How does a board report differ from a desk-level report?

The board report is aggregated, focused on appetite, material issues and decisions, and issued less often. A desk report is granular and frequent, often daily, to support day-to-day risk-taking.

Why are stress test results part of risk reports?

Exposures and VaR describe normal conditions. Stress results show potential losses in severe but plausible scenarios, helping management judge capital, liquidity and limit adequacy.