Board Risk Reporting and Accountability

Why Accountability Belongs in Board Risk Reporting

A board risk report can contain accurate figures and still fail to support oversight. A heat map, trend chart, or list of incidents may show what has happened, but not who is responsible for responding, what decision is required, or what remains unresolved. The board then has information without a clear route from that information to governance action.

A useful report makes the accountability chain visible. It helps directors understand which executive is answerable for managing the issue, whether a material decision falls within the board’s authority, what uncertainty or remediation remains, and what the board is expected to do next. The board oversees and challenges; it does not take over the executive’s day-to-day management responsibilities.

Definition: Accountable board risk reporting presents material risk information in a form that identifies the executive responsible for the response, any decision requiring board attention, unresolved issues relevant to oversight, and specific follow-up or oversight actions. The appropriate detail depends on the board’s mandate and the organization’s delegation arrangements.

This is aligned with the CAS Exam 9 (Risk Management for Actuaries) syllabus. It uses the governance concepts of executive risk ownership, delegated authority, escalation, and effective challenge. It does not prescribe a universal report format: the test is whether the information enables the board to perform its actual oversight role.

A Four-Part Test for Report Accountability

Review each material issue against four questions. A report does not need to use these exact labels, but its content should answer them clearly. If an element does not apply, the report should say so and give a brief reason; silence is not the same as a considered conclusion that no board decision or action is needed.

Who is accountable? Identify the executive responsible for managing the response. A committee, department, or control function may contribute, but naming a group alone can leave individual accountability unclear.
What decision is required? State whether the board must approve, direct, or otherwise decide something, and explain why the matter is before it. If management can act under delegated authority, make that clear rather than implying the board must decide.
What remains unresolved? Describe outstanding uncertainty, a control weakness, a disputed assessment, or incomplete remediation that could affect the board’s understanding or decision. Distinguish confirmed facts from estimates and assumptions.
What oversight action is needed? Specify what the board, its committee, or management must do next. Where follow-up is required, identify a responsible person or body, a due date or review point, and how completion will be evidenced.

These questions separate risk ownership from oversight. The accountable executive remains responsible for the management response. The board may request further analysis, set a condition on a decision, or require a progress report, but it should not become the operational owner of the control or remediation.

A Practical Review Method

A structured review reduces the chance that a polished presentation will obscure a missing accountability link. Start with material issues rather than scoring every item in the pack equally. Then follow the chain from the issue to the person, decision, open point, and next action.

Select the material items.
Identify issues with significant consequences, exceptions, emerging concerns, or matters requiring a decision under the board’s mandate or delegated-authority rules.

Trace executive accountability.
For each item, verify that a named executive is responsible for the management response. Check that the person’s role is consistent with the organization’s assigned responsibilities.

Make the board’s role explicit.
Determine whether the board is being asked to decide, oversee a response, or simply receive information. Confirm that the stated role is consistent with the relevant authority.

Test open issues and actions.
Look for unresolved matters, an action owner, a deadline or review date, and evidence that will demonstrate progress or closure.

Record gaps and follow up.
State what is missing, who must provide it, and when the board or its committee will revisit the issue. Do not treat a missing report field as proof that the underlying risk is controlled.

For a repeatable diagnostic, a reviewer can mark each of the four elements as present or absent for each material issue. The resulting proportion is a completeness indicator, not a measure of risk severity or governance quality. It is useful for locating omissions; a high proportion cannot make a weak decision, unsupported assurance, or inadequate challenge acceptable.

\text{Completeness proportion} = \frac{\text{number of required accountability elements evidenced}} {\text{number of required accountability elements reviewed}}

The ratio is justified by treating each required element as one review item: if $m$ elements are evidenced out of $n$ elements reviewed, the fraction $m/n$ is the share of reviewed items with evidence. It does not imply that the four elements have equal governance importance. A missing decision authority or unowned urgent issue may warrant immediate attention even when the overall proportion is high.

Worked Example: Finding Gaps in a Board Dashboard

A hypothetical insurer’s board pack contains three material issues. For each issue, a reviewer checks whether the report identifies (1) an accountable executive, (2) a decision required or an explicit statement that no board decision is required, (3) an unresolved issue or an explicit statement that none remains, and (4) an oversight action with a follow-up point.

Issue A, a concentration in a particular class of business, names the Chief Underwriting Officer, requests a board decision on a proposed restriction, identifies incomplete exposure data as unresolved, and assigns a follow-up report to that officer for the next meeting. It earns $4$ evidenced elements out of $4$.

Issue B, a rise in claims-processing exceptions, names the Chief Operating Officer and describes the unresolved cause. It says “continue monitoring,” but does not state whether a board decision is needed or identify a specific follow-up owner and review date. It earns $2$ out of $4$: the accountable executive and unresolved issue are present; the decision status and actionable oversight follow-up are not.

Issue C, a decline in investment-data quality, asks the board to note a trend and gives an estimated impact. It does not name an accountable executive, identify whether a decision is needed, explain what uncertainty remains, or set a follow-up action. It earns $0$ out of $4$.

Calculation. The report has $3 \times 4 = 12$ required elements. The evidenced total is $4 + 2 + 0 = 6$. Therefore, the completeness proportion is $6/12 = 0.50$, or $50\%$. No intermediate rounding is needed.

Assessment and method. The method is an issue-by-issue accountability check, not a risk ranking. The reviewer should ask for a named executive and a clear board role for Issue C, and for explicit decision status and a dated follow-up for Issue B. Issue A is more complete, but the board must still judge the proposed restriction and the significance of the data limitation.

Common mistake avoided. Counting the dashboard’s three displayed risk topics as three completed reports would confuse presentation with accountability. The correction is to test the required elements for each material issue; a chart or narrative does not, by itself, identify ownership or a follow-up obligation.

Decisions, Open Issues, and Follow-Through

A report should distinguish a matter for board decision from one for board information. If a matter is reserved to the board, the report should identify the requested decision, the relevant authority, the accountable executive presenting it, and material uncertainties that could affect the choice. If management can act under delegated authority, the board may still need oversight information, but the report should not describe ordinary management action as a board approval request.

Unresolved issues also need careful treatment. “In progress” is not a sufficient explanation on its own. The report should tell directors what is incomplete, why it matters to the decision or oversight, who is addressing it, and when new evidence is expected. If management concludes no material issue remains, that conclusion should be explicit and supported at a level appropriate to the issue.

Follow-up actions should be verifiable. “Improve controls” is difficult to monitor because it does not identify a deliverable or completion test. A stronger action might specify that the named executive will provide a reconciled control-test result by a stated date, with exceptions and residual work reported. The board can then assess whether the response is complete or whether further challenge is necessary.

Worked Example: Testing a Decision Request Against Authority

In a hypothetical organization, its delegation schedule reserves new market entry to the board when planned initial expenditure exceeds $ \$40{,}000{,}000 $. Management proposes entry requiring $ \$48{,}000{,}000 $. The report names the Chief Strategy Officer as the executive responsible for the proposal, but the decision paper summarizes expected benefits without stating the outstanding regulatory approval or the board’s requested resolution.

Step 1: Test the threshold. Proposed expenditure is $ \$48{,}000{,}000 $, and the reserved-decision threshold is $ \$40{,}000{,}000 $. The excess is $ \$48{,}000{,}000 - \$40{,}000{,}000 = \$8{,}000{,}000 $. As a proportion of the threshold, the excess is $ \$8{,}000{,}000 / \$40{,}000{,}000 = 0.20 $, or $20\%$. The proposal therefore meets the stated condition for board consideration.

Step 2: Check accountability. The Chief Strategy Officer is named as the accountable executive. This identifies who presents and manages the proposal, but does not transfer the executive’s implementation responsibility to the board.

Step 3: Identify the unresolved issue and decision gap. Regulatory approval is outstanding and must be disclosed as unresolved. The report must also specify what the board is being asked to decide; a summary of benefits is not a resolution request.

Step 4: State a useful oversight response. The board can defer its decision pending specified approval evidence, or consider a clearly worded conditional resolution if its governance arrangements permit. The report should name who will provide the evidence and the date or event for returning to the board. The facts given do not establish that approval will be granted, so the report must not present it as certain.

Check. The arithmetic gives an excess of $ \$8{,}000{,}000 $, exactly $20\%$ of the $ \$40{,}000{,}000 $ threshold. The authority test is based on the stated initial-expenditure condition, not on the potential benefits of the proposal.

Common mistake avoided. A reviewer might assume that the board has already approved the proposal because it appears in a board pack. The correction is to check the actual authority condition and the requested resolution: inclusion in a report is not a decision.

Worked Example: Separating Timely Closure From Current Status

A hypothetical board committee reviews six remediation actions as of October 15. Four were completed by their original deadlines. A fifth was due October 5 and was completed October 10. The sixth remains open and was due September 30. Assume calendar-day differences and that the dates stated are inclusive of the described completion status.

Step 1: Count actions closed by the review date. Four timely actions plus the action completed October 10 gives $4 + 1 = 5$ closed actions. The closure proportion by October 15 is $5/6 = 0.8333$, or $83.33\%$ when expressed to two decimal places.

Step 2: Calculate late days for the completed late action. October 10 minus October 5 is $5$ calendar days. This action is closed at the review date, but it was not completed on time.

Step 3: Calculate the age of the open overdue action. September 30 to October 15 is $15$ calendar days. Thus, one action is currently overdue by $15$ days.

Step 4: Calculate timely completion. Only the four actions completed by their deadlines count as timely. The timely-completion proportion is $4/6 = 0.6667$, or $66.67\%$ to two decimal places. The remaining two actions comprise one late closure and one still-overdue action.

Assessment and method. A status-and-timeliness reconciliation distinguishes three facts: $5$ of $6$ actions are closed, $4$ of $6$ were closed on time, and $1$ action remains open and is $15$ days overdue. The board report should identify the executive accountable for the open action, explain any material reason for delay, and set a follow-up date and evidence of completion.

Check. The categories reconcile: $4$ timely completions $+ 1$ late completion $+ 1$ open overdue action $= 6$ actions. Reporting only the $83.33\%$ closed figure would conceal both lateness and the outstanding action.

Common mistake avoided. Treating every closed action as timely overstates performance. The correction is to compare each completion date with its own deadline and separately report open overdue actions.

Common Reporting Traps

Using a function instead of an accountable executive. “Risk,” “operations,” or “the committee” may describe participants, but may not identify who is answerable for the management response.
Presenting a trend without a board role. A trend can be important, but directors need to know whether they are deciding, overseeing, or receiving information.
Hiding uncertainty in a single estimate. A point estimate should not obscure missing data, assumptions, or unresolved analysis that could change the interpretation.
Using vague action language. “Monitor,” “address,” and “improve” need an owner, a time point, and an observable deliverable to support follow-up.
Confusing completion with effectiveness. A task marked complete is not necessarily evidence that the underlying issue has been resolved. The report should state what was tested and what remains open.
Relying on a high completeness proportion. A summary ratio does not replace judgment about materiality, authority, urgency, or the quality of evidence.

The board’s oversight is more effective when reports surface exceptions and unresolved matters without burying them in aggregate measures. The executive remains responsible for managing the response; directors use clear reporting to question assumptions, make decisions within their authority, and request proportionate follow-up. This approach is aligned with the CAS Exam 9 (Risk Management for Actuaries) syllabus.

Check Your Understanding

For each hypothetical case, identify the key accountability gap and use the facts provided to check any requested calculation.

A report lists two material issues. For Issue 1, it names an executive, states no board decision is required, identifies an unresolved data limitation, and sets a dated follow-up. For Issue 2, it names an executive, describes an open control weakness, and requests a board decision, but gives no decision wording or follow-up date. Using four elements per issue, calculate the completeness proportion. (Answer: $7/8 = 87.50\%$; Issue 2 still lacks actionable follow-up.)
A hypothetical delegation rule requires board approval for commitments above $ \$25{,}000{,}000 $. A proposed commitment is $ \$30{,}000{,}000 $; the report names the accountable executive but says only “for discussion.” How much does the proposal exceed the threshold, and what decision-reporting gap remains? (Answer: $ \$5{,}000{,}000 $ above the threshold; the requested board resolution is not stated.)
Five actions are reviewed at month-end. Three were completed on time, one due on the 20th was completed on the 24th, and one due on the 22nd remains open as of the 30th. Calculate the timely-completion proportion and the overdue age of the open action in calendar days. (Answer: $3/5 = 60.00\%$; the open action is 8 days overdue.)
A board report identifies a named executive and a decision request. It states that a key data reconciliation is incomplete, but gives no owner or date for completing it. Name two specific reporting additions that would make oversight follow-up more actionable. (Answer: name the executive responsible for completing the reconciliation and specify a due date or review point, together with the evidence to be reported.)
A committee dashboard states that 9 of 10 actions are closed. Of the 9, 7 were completed by deadline and 2 were late; the remaining action is open and was due 12 days ago. State the timely-completion proportion and the additional status fact that should not be hidden by the closure figure. (Answer: $7/10 = 70.00\%$; one action remains open and is 12 days overdue.)

What You'll Learn