Boards oversee risk; management manages it; and the quarterly risk pack is the instrument through which the overseeing happens. A board that has read a good pack can say which risks could prevent the organization from meeting its objectives, whether exposure to each sits inside the appetite the board approved, what changed since last quarter and why, which indicators are warning, what went wrong and what was learned, which risks management has chosen to accept and which issues are overdue, and how much of what it has just read has been independently checked. Most packs do not let a board say any of that. They run to sixty pages of heat maps, metrics and narrative that describe everything and decide nothing, they are read by the committee chair and skimmed by the rest, and they satisfy a disclosure requirement about risk oversight without producing any.
This guide sets out how to build a pack that works: what directors are required and expected to oversee, the questions the pack must answer, a twelve-page structure that answers them, the design rules that keep it readable, how the board divides the work with its committees, the roles of the chief risk officer and the chief audit executive, how internal audit assures the pack, the failures that recur, and two worked examples, from Lakeshore Bancorp, the $9 billion regional bank used in examples across this site, and MidState Beverage, the three-state drinks distributor with no risk committee and a four-page pack. The risk appetite, tolerance, capacity and limits guide supplies the appetite the pack reports against, the KRI program guide the indicators, and the presenting to the audit committee guide the craft of the meeting itself.
In this guide
- What directors must oversee
- The questions the pack must answer
- The twelve-page pack
- Design rules that keep it readable
- Board, risk committee, audit committee: who sees what
- The chief risk officer and the chief audit executive
- How internal audit assures the pack
- The failures that recur
- A worked example: Lakeshore Bancorp’s board risk committee pack
- A worked example: MidState Beverage’s four pages
- Questions about board risk reporting
- Related guides
What directors must oversee
The legal and regulatory expectations of board risk oversight have hardened over thirty years, and the pack is the evidence that the board met them. In Delaware, where most large US companies are incorporated, the Caremark decision (1996) established that directors can be liable for failing to implement a reporting system for the risks the company faces or, having implemented one, for consciously failing to monitor it; Marchand v. Barnhill (2019) applied the standard to a food company whose board had no process for overseeing food safety, the risk central to its business, and the Boeing derivative litigation (2021) allowed claims to proceed where the board had no committee or reporting on aircraft safety. The lesson boards took is that oversight of mission-critical risks must be visible in the record: a committee charter, a standing agenda item, a report received and discussed, minutes that show the discussion. The SEC’s 2009 proxy disclosure rules (Regulation S-K Item 407(h), effective February 2010) require public companies to describe the board’s role in risk oversight and how it is structured, which made the pack’s existence a disclosed fact; the NYSE’s listing standards require the audit committee to discuss policies with respect to risk assessment and risk management, which makes the audit committee a default owner where no risk committee exists. In banking, the Dodd-Frank Act and Regulation YY require publicly traded bank holding companies above $50 billion to maintain a board risk committee with an independent chair and at least one member with risk management expertise, and the OCC’s heightened standards (2014) require the boards of large national banks to approve a risk governance framework and hold management to it; smaller banks are expected to show proportionate oversight in the CAMELS management component. In the United Kingdom, the 2024 Corporate Governance Code’s Provision 29, applying to financial years from 1 January 2026, requires boards to declare the effectiveness of material internal controls, including risk management, which depends on a reporting system that would support the declaration. The table summarizes the sources and what each implies for the pack.
| Source | Who it reaches | What it expects | What the pack must show |
|---|---|---|---|
| Delaware Caremark line (Caremark 1996; Marchand 2019; Boeing 2021) | Directors of Delaware corporations; followed elsewhere | A reporting system for mission-critical risks and good-faith monitoring of it | Mission-critical risks named; reports received regularly; discussion minuted |
| SEC Regulation S-K Item 407(h) (2010) | US public companies | Disclosure of the board’s role in risk oversight and its structure | A structure that matches the disclosure: which committee, how often, what it receives |
| NYSE 303A.07; Nasdaq equivalents | Listed companies | Audit committee discusses risk assessment and risk management policies | An audit committee agenda item with a report behind it |
| Dodd-Frank 165(h); Regulation YY | Publicly traded bank holding companies above $50 billion | Board risk committee with independent chair and risk expertise; enterprise-wide risk management framework overseen by it | A risk committee pack covering the framework, appetite and profile |
| OCC heightened standards (12 CFR 30, Appendix D, 2014) | National banks above $50 billion | Board approves the risk governance framework; receives risk appetite reporting; holds management accountable | Profile against appetite; breaches and their resolution |
| UK Corporate Governance Code 2024, Provision 29 | UK premium-listed companies, financial years from 1 January 2026 | Board declaration on the effectiveness of material controls, including risk management | Evidence of monitoring sufficient to support the declaration |
| COSO ERM 2017; ISO 31000 | Any organization adopting them | Board risk oversight as the first principle of governance and culture; information, communication and reporting as a component | Reporting that supports strategy and performance decisions, not only compliance |
| Global Internal Audit Standards, Domain III | Internal audit functions and their boards | Board receives internal audit’s results and its view of governance, risk management and control | The assurance view and the chief audit executive’s opinion where given |
The questions the pack must answer
Design starts from the reader’s questions rather than from the data available. A director who has read the pack should be able to answer, without help, the following: Which risks could stop us meeting our objectives this year and over the plan horizon? For each, is our exposure inside the appetite we approved, and if not, what is management doing and by when? What changed since last quarter, and was the change in the risk, in our controls or in our measurement? Which early-warning indicators are amber or red, and what response is underway? What went wrong this quarter (losses, incidents, near misses, regulatory contact), what did it cost and what did we learn? What is new on the horizon that is not yet in the register? Which risks has management decided to accept above tolerance, and did the right level approve that? Which agreed fixes are overdue, and who owns them? How much of this picture has been independently tested, by whom and with what result? And what decisions, if any, does management want from us today? A pack that answers those ten questions in twelve pages has done its job; one that answers them in sixty has not, because the answers will not be found.
The twelve-page pack
| Page | Content | Question answered | Design notes |
|---|---|---|---|
| 1. Summary | Five to eight sentences from the chief risk officer: the profile against appetite in one line, the two or three things that changed, the decisions requested; a single status strip (inside appetite / approaching / outside) for each top risk | All ten, at headline level | Written last, read first; no charts; the page a director reads if they read nothing else |
| 2. Profile against appetite | Each appetite statement or metric with its limit, the current reading, last quarter’s and the trend; breaches highlighted with the escalation taken | Inside appetite? | The core page; if appetite is not measurable, this page exposes it |
| 3 to 4. Top risks and their trend | The ten to fifteen enterprise risks: rating, direction of change, the driver of the change (risk, control or measurement), the owner, the key controls’ status and the next milestone | Which risks; what changed and why | One line per risk; a heat map only as a secondary visual; explain movement in words |
| 5. Indicators | The enterprise KRIs in amber or red with the reading, the threshold, the response and its deadline; green indicators listed by name only | What is warning? | Twenty-five to forty-five enterprise indicators exist; the pack shows the ones that moved |
| 6. Loss and incident experience | Operational losses against the annual tolerance; significant incidents and near misses with cause, cost and lesson; regulatory contact and findings; litigation of note | What went wrong and what did we learn? | Lagging data, deliberately placed after the leading data |
| 7. Emerging risks | Three to six developments (regulatory, technological, market, geopolitical, internal) with an assessment of relevance, time horizon and what is being done to understand them | What is coming? | Rotating; items graduate to the register or are retired with a note |
| 8 to 9. Deep dive | One risk per quarter in depth: the exposure, the control environment, the second line’s assessment, internal audit’s findings, the scenarios, the investment case; rotates through the top risks over two to three years | Do we understand this risk? | The page directors remember; management presents, risk and audit comment |
| 10. Risk acceptances and overdue issues | Risks accepted above tolerance in the period with the approver and expiry; issues overdue beyond the escalation threshold with owner and revised date; aged issue trend | What has been accepted; what is late? | The accountability page; names appear |
| 11. Assurance view | For each top risk, the coverage by the second line, internal audit and external providers in the period and planned, with the results in one word each; the chief audit executive’s observations | How much of this has been checked? | Drawn from the assurance map; the only page internal audit authors |
| 12. Stress and scenario results | Capital, liquidity or business stress results against limits; scenario analysis conclusions; model and assumption changes that moved results | Can we survive the bad case? | Quarterly where regulated; semi-annual elsewhere |
| Appendix (not paginated in the twelve) | The full register, indicator list, methodology notes, glossary | Reference | Available, not presented |
Design rules that keep it readable
Eight rules separate a pack that gets read from one that gets received. Appetite first: every risk is reported against the board’s own statement, so that the pack is a conversation about the board’s decisions rather than management’s descriptions. Movement over position: the pack explains what changed and why (the risk grew, a control failed, the measurement improved), because a static heat map tells a quarterly reader nothing. Leading before lagging: indicators and emerging risks come before losses, so that the board’s attention goes to what it can still influence. Decisions named: the summary states what management wants from the board (approve, note, decide, discuss), and the minutes record which it was. Names, not functions: owners of risks, acceptances and overdue issues are named executives. One scale: ratings, severities and statuses use one scale across risk, compliance, audit and the business, so that a High means the same thing on every page; the finding severity ratings guide covers the scale. Twelve pages: the discipline that forces choices; the appendix holds the rest. Consistency across quarters: the same structure every time, so that directors learn where to look and notice what is missing. The audit committee presentation template and presenting to the audit committee guides cover the presentation craft that goes with the document.
Board, risk committee, audit committee: who sees what
Where a board has a risk committee (required for large banks, common in insurance and increasingly adopted elsewhere), it receives the full pack quarterly and the board receives the summary page plus the chair’s report; the audit committee receives the assurance view, the loss and incident page and anything bearing on financial reporting and controls, and the two committees hold a joint session or cross-membership so that neither assumes the other is covering a gap. Where the audit committee carries risk oversight, as at most companies below the largest, it receives the whole pack, and the design should resist the tendency to let risk crowd out the committee’s financial reporting duties: a separate meeting or a separate half of the agenda, with the risk pack presented by the chief risk officer or equivalent rather than folded into the chief audit executive’s report. Where the full board retains risk oversight (smaller companies, private companies, public bodies), the twelve pages are the board’s and the deep dive becomes the mechanism through which the board learns each major risk over time. The audit committee charter and annual agenda guides show how the committee’s calendar carries the cycle, and the audit committee playbook the committee’s wider work.
| Governance model | Full board receives | Risk committee receives | Audit committee receives | Typical organizations |
|---|---|---|---|---|
| Separate risk committee | Summary page; chair’s report; the annual deep-dive cycle in summary | The full twelve pages quarterly | Assurance view; loss and incident page; anything bearing on financial reporting and controls | Large banks (required above $50 billion); insurers; large listed companies |
| Audit committee carries risk | Summary page; chair’s report | None (no committee) | The full twelve pages, in a separate meeting or agenda half, presented by the second-line executive | Mid-size public companies; regional banks below the threshold; many private companies |
| Full board retains risk | The full pack, often shortened to four to eight pages; the deep dive as the learning mechanism | None | Financial reporting and the assurance view | Smaller companies; public bodies; nonprofits |
| Joint arrangements | As above | Shared members or joint sessions with the audit committee at least annually | Shared members or joint sessions | Any organization with both committees |
The chief risk officer and the chief audit executive
The pack has two authors with different obligations. The chief risk officer (or the executive who carries the second-line role) owns pages 1 to 10 and 12: the profile, the appetite comparison, the indicators, the losses, the emerging risks, the deep dive, the acceptances and the stress results are management’s account of the risk position, challenged by the second line and presented by it. The chief audit executive owns page 11, the assurance view, and has a standing right to comment on any other page where internal audit’s work supports or contradicts what management has said; the Global Internal Audit Standards require the board to receive internal audit’s results and, where the function gives one, its overall opinion on governance, risk management and control, and the pack is the natural vehicle. The two should not merge: a pack in which internal audit reports the risk profile has made the third line the second, and a pack in which the chief risk officer reports on audit coverage has made the second line the third. Both attend the meeting; both have private sessions with the committee; and the committee should hear where they disagree. The what is a chief audit executive guide covers the CAE’s reporting duties and the Three Lines Model guide the division of roles.
How internal audit assures the pack
Internal audit assures the pack in two ways. Continuously, through the assurance view and its comments, it tells the board which parts of the picture have been tested; periodically, through an audit of risk reporting, it tests whether the pack itself is accurate, complete and useful. The periodic audit, often a component of the ERM audit, tests the following: that the risks in the pack are the risks in the register and the register is complete against the strategy, the loss experience and the audit findings; that appetite metrics are computed as defined and the readings reconcile to source; that a sample of indicator readings reproduces from source data; that losses and incidents reconcile to the loss database, the incident system, the litigation register and regulatory correspondence; that risk acceptances in the pack match the acceptance log and none is missing; that overdue issues reconcile to the issue log; that movements explained in the pack are supported by evidence; that the stress results match the model outputs; and, through interviews with directors, that the pack answers their questions and that decisions traceable to it exist. The finding that recurs is omission rather than error: a loss, an acceptance or an overdue issue that was in the systems and not in the pack, which is the finding directors mind most.
The failures that recur
| Failure | How it looks | Fix |
|---|---|---|
| Description without decision | Sixty pages; no decision requested; minutes say “noted” | Summary page names decisions; twelve-page limit |
| No appetite comparison | Risks rated High, Medium, Low with no statement of what the board would accept | Page 2; make appetite measurable or say that it is not |
| Heat map as the product | Dots move; no explanation of why; averages hide the extremes | Movement explained in words; heat map secondary |
| Lagging only | Losses and incidents reported; no indicators or emerging risks | Pages 5 and 7 before page 6 |
| Omitted bad news | Losses, acceptances or overdue issues in the systems but not in the pack | Reconciliation controls over the pack’s inputs; internal audit’s periodic test |
| Measurement change presented as improvement | A risk falls because the model or the assumption changed | Driver column: risk, control or measurement |
| Assurance absent | Board cannot tell what has been tested | Page 11 from the assurance map |
| Everyone’s slide | Each function adds its page; the pack grows yearly | One author; one structure; appendix for the rest |
| Inconsistent scales | Risk’s High is audit’s Medium | One severity scale across functions |
| The pack as the oversight | Received, filed, disclosed; never discussed | Deep dive rotation; questions recorded in the minutes; director interviews in the audit |
A worked example: Lakeshore Bancorp’s board risk committee pack
Lakeshore Bancorp, the $9 billion publicly traded regional bank holding company used in examples across this site, maintains a board risk committee by choice (it sits below the Regulation YY threshold), chaired by an independent director with a risk management background, to which the chief risk officer reports; the audit committee receives the assurance and loss pages and the two committees share two members. The pack inherited from 2021 ran to 58 pages, led with a heat map of 63 risks and had never recorded a decision. After the FY26 operational risk framework audit found the appetite breach that had been reported without escalation and the KRI program that had never escalated anything, the chief risk officer rebuilt the pack to the twelve-page structure, and internal audit audited risk reporting as a component of the FY27 ERM audit.
| Page | Lakeshore’s content (second quarter FY27) | Decision or discussion recorded |
|---|---|---|
| 1. Summary | Profile inside appetite on eleven of twelve statements; commercial real estate concentration approaching its limit at 318 percent of total capital against 330; deposit assumption governance finding closed; two decisions requested | Committee approved the two decisions below |
| 2. Profile against appetite | Twelve appetite metrics: capital, liquidity survival horizon (35 days against 30), interest rate risk (EVE −14.1 percent at plus 200 against −15), CRE concentration, operational losses ($1.6 million year to date against $4 million), compliance, model risk, cyber, third-party, conduct, strategic, reputation | CRE approaching-limit status discussed; management asked to present options at the next meeting |
| 3 to 4. Top risks | Fourteen risks; three moved: CRE up (risk: office valuations), deposit assumption risk down (control: independent review implemented), third-party risk unchanged with inventory completeness at 91 percent (measurement) | Noted; the driver column answered the chair’s question without a presentation |
| 5. Indicators | Four of 38 enterprise indicators amber, one red (vendor assurance reports expired, 9 of 61 critical vendors); responses and deadlines listed | Red indicator response accepted; follow-up at next meeting |
| 6. Losses and incidents | $1.6 million operational losses; one $240,000 wire fraud recovered in part; two severity-1 outages; OCC loss data MRA closed | Noted |
| 7. Emerging risks | Updated model risk guidance (SR 26-2) and the policy change; private credit competition in middle-market lending; AI tools in customer service; a state privacy law amendment | Model risk policy change scheduled as the next deep dive |
| 8 to 9. Deep dive | Liquidity: the rebuilt stress testing framework, the 35-day survival horizon, the contingency funding plan test, internal audit’s FY26 follow-up findings | Committee asked for the reverse stress test breaking points in the next liquidity report |
| 10. Acceptances and overdue issues | One acceptance (a legacy system’s segregation of duties gap, accepted by the COO to the system’s retirement in FY28, approved by the committee); three overdue issues, two with revised dates and one escalated | Acceptance confirmed; escalated issue owner asked to attend the next meeting |
| 11. Assurance view | Coverage of the fourteen risks by credit review, compliance testing, model validation and internal audit in the period, from the assurance map; the chief audit executive’s comment that two of the fourteen (strategic, reputation) had no independent coverage planned | Internal audit asked to propose coverage of strategic risk in the FY28 plan |
| 12. Stress and scenarios | Capital stress results under the risk function’s severely adverse scenario; liquidity survival horizon; the nine operational risk scenarios’ refresh | Noted |
Internal audit’s FY27 test of the pack reconciled every appetite reading and indicator to source (one indicator reading was a quarter stale; Low), reconciled losses to the database and acceptances to the log (complete), and interviewed four committee members, all of whom could answer the ten questions from the pack; its one Medium finding was that the pack’s movement explanations were not evidenced in a working file, so that a change attributed to a control improvement could not be traced to the control’s test result. The committee chair’s comment, recorded in the minutes, was that the pack had gone from 58 pages that produced no decisions to twelve that produced four in a meeting. The bank audit universe guide shows the risk function entities in Lakeshore’s 126 and the auditing ERM guide the FY27 engagement the test sat inside.
A worked example: MidState Beverage’s four pages
MidState Beverage, the three-state drinks distributor with about $221 million of revenue, twelve depots and a six-person internal audit function used in examples across this site, has no chief risk officer, no risk committee and no compliance function; its enterprise risk register of 63 risks is maintained by the finance director with the audit function’s help, and the audit committee carries risk oversight. Its pack is four pages, presented by the finance director with the chief audit executive commenting: page one, the top ten risks against a qualitative appetite statement the board approved in 2025, with movement and driver; page two, twelve indicators (route cash reconciliation exceptions, driver turnover, depot shrink, open critical vulnerabilities, overdue audit actions, customer concentration, fleet compliance exceptions, cyber incidents, days sales outstanding, inventory accuracy, payroll exceptions, supplier concentration) with thresholds; page three, losses and incidents (the FY26 Dayton driver theft and the $410,000 shrink write-off had taught the committee what this page was for) and the risk acceptances (the COO’s acceptance of the customer-statement risk from report FY27-01 appears here each quarter until resolved); page four, overdue actions and the chief audit executive’s assurance comment. The deep dive is one risk a year, presented by its owner at the committee’s planning meeting. The structure is the same as Lakeshore’s at a third of the length, which is the point: the twelve pages are a maximum, and a company of MidState’s size answers the ten questions in four. The inside the internal audit department guide covers MidState’s function and the risk acceptance guide the COO’s acceptance and how it is reported.
Questions about board risk reporting
What should a board risk report contain?
A one-page summary with decisions requested; the risk profile against the board’s appetite; the top risks with their movement and its driver; indicators in amber or red with responses; losses, incidents and lessons; emerging risks; a rotating deep dive; risk acceptances and overdue issues with named owners; the assurance view; and stress or scenario results. Twelve pages at most, with an appendix.
How often should the board receive risk reporting?
Quarterly for the full pack, with an escalation protocol for appetite breaches, red indicators and significant incidents between meetings. Large banks’ risk committees often meet more frequently; smaller organizations may take the deep dive annually and the rest quarterly.
Who should present risk to the board?
The chief risk officer or the executive carrying the second-line role presents the risk profile; the chief audit executive presents the assurance view and comments where internal audit’s work bears on the picture. The two roles should not merge, and both should have private sessions with the committee.
Should the pack use a heat map?
Only as a secondary visual. A heat map shows position, not movement or cause, and averages hide the extremes directors need to see. Explain what changed and why in words, with the driver (risk, control or measurement) named for each movement.
What do directors legally have to oversee?
Under Delaware’s Caremark line of cases, directors must implement a reporting system for the risks the company faces, especially mission-critical ones, and monitor it in good faith. US public companies disclose the board’s role in risk oversight under SEC rules, exchange rules assign risk discussion to the audit committee, large bank holding companies must have a board risk committee, and UK listed companies must declare the effectiveness of material controls from 2026.
How does internal audit assure board risk reporting?
By authoring the assurance view and commenting on the pack continuously, and by periodically testing the pack: reconciling appetite readings, indicators, losses, acceptances and overdue issues to their sources, checking that movement explanations are evidenced, and asking directors whether the pack answers their questions and produces decisions.
Related guides
- Risk appetite, tolerance, capacity and limits — what the pack reports against.
- Risk appetite statements — worked wording for page 2.
- Designing a KRI program — the indicators on page 5.
- Auditing enterprise risk management — the engagement that tests the pack.
- Building an operational risk framework — where the losses, indicators and scenarios come from.
- Assurance mapping — the source of page 11.
- Risk acceptance by management — what belongs on page 10.
- Presenting to the audit committee — the meeting itself.
- Audit committee presentation template — the internal audit report that accompanies the pack.
- The audit committee charter — the committee’s duties.
- The audit committee annual agenda — the calendar the pack sits in.
- The audit committee playbook — the committee’s wider work.
- What is a chief audit executive? — the CAE’s reporting duties.
- The Three Lines Model — who authors which page.
- Finding severity ratings — one scale across functions.
- Risk assessment matrix — the rating scale behind the top risks.
- The Risk Library — every risk type on this site.
- How to Run a Strategic Risk Assessment: A Seven-Step Method — a seven-step method from assumptions to signposts.
- How to Audit Corporate Governance: Program and Example — board information, committees, delegation of authority, conflicts and disclosures.
- Reporting to the Audit Committee: The Quarterly Pack — the written quarterly pack that answers four questions, with an annotated model outline.
Leave a Reply