How to set a Risk Governance Calendar That Holds

A risk governance calendar is the document that turns a set of mandates into a year. The calendar fixes when each body sits, what must be in front of it when it does, and which dated obligations fall where. A calendar is built in one order: the bodies, then their cadences, then the papers each cadence needs, then the dated events, then the gaps those choices have just created.

Most institutions have all the parts of this and no calendar. There is a list of committees somewhere, a set of mandates in a folder, a report that goes out every month because it always has, and a diary entry in eight separate calendars. Every one of those is true and none of them is the year. The year only exists once somebody writes the whole of it down in one place, and the reason to do that is not tidiness. The reason is that a calendar is the only place in an institution where two decisions taken years apart, by different people, for good reasons, are forced to sit beside each other and be read together.

What is a risk governance calendar, and why is it a document rather than a diary?

A governance calendarThe document that fixes when each body sits, what is in front of it, and which dated obligations fall where. answers three questions at once: when does each body sit, what must be in front of it when it does, and what is it expected to decide by the time it stands up. A diary answers only the first. The two missing questions are the whole difference, and the difference is not a small one. A diary says a room is booked; a calendar says what has to be true before anybody walks into it. Think of a wedding at household scale. The date in the diary is the easy part. The calendar is the caterer confirming numbers fourteen days out, the hall paid for by a date, the invitations posted before the printing shop closes for the season. Nobody argues about the date. The arguments are always about the things that had to happen first.

So a calendar row has a fixed set of columns, and a row missing any of them cannot be checked by anybody. There are seven: the item number, the body it belongs to, when it happens, what must be in front of it, who produces that, when it circulates, and what decision is expected at the end. Leave out who produces the paper and the paper arrives late and nobody was wrong. Leave out the decision expected and the item happens forever without anything coming of it. Keeping every appointment and settling nothing is the commonest way a governance structure fails.

The item numbers matter more than they look. At Vindhya Commercial Bank Limited, invented, the recurring items are numbered CA1 to CA9 and the dated events of the year are numbered CD1 to CD11. Numbering is not bureaucracy; it is the difference between citing a row and describing one. Two people describing the same row usually turn out to be discussing two different rows, and the discovery arrives late, in a meeting, when somebody says the report was supposed to come to this committee.

In what order is the year built, and what does each step create?

Each step creates the problem the next one solves. The five steps hold their order for that reason. Listing the bodies leaves rows with nothing in them. Setting the cadences creates drift. A cadence decides how far a number may move before anybody looks. Putting the papers on it shows that some papers arrive more often than the body they are addressed to sits. Laying the dated events on top shows which of them landed between two sittings. Reading the gaps comes last, and it is the step most calendars never reach at all. The fifth step is where a calendar stops being a schedule and starts being a diagnosis.

Step 1, list the bodies

The first step lists every body that can decide something about risk, with what it is there to do. The bank has eight bodies, and the eight are its own arrangement rather than anybody's model: G1 the board, G2 the board risk management committee, G3 the audit committee, G4 the asset liability management committee, G5 the credit risk management committee, G6 the operational risk management committee, G7 the market risk committee and G8 the information security committee. The decisions each body may take are settled separately. The calendar needs something narrower from the list: a name, and a count of how often each body sits.

The counts are where the surprise is, so add them next. Six a year for the board, six for the board risk management committee, six for audit, twelve for asset liability, twenty six for credit, twelve for operational risk, twelve for market risk and four for information security. The eight counts are 6 plus 6 plus 6 plus 12 plus 26 plus 12 plus 12 plus 4, being 84 sittings a year. Eighteen of them are board level and sixty six are below it, and 18 plus 66 is 84. Read as shares, 21.4 per cent of this bank's committee time happens at board level and 78.6 per cent happens below it, and no single mandate anywhere in the institution says so. The credit committee sits 26 times a year and the board sits 6, so a reading on the loan book can be looked at more than four times as often by a management committee as by the people finally answerable for it.

Step 2, set the cadence

Everything here rests on one sentence. A cadenceHow often a body sits, which is also a decision about how far a reading may move before anybody looks at it. is a decision about how much a number is allowed to move before anybody looks at it. Nobody writes it down that way. The decision gets written as a 6 in a column, usually because the last version of the document said 6, and the argument in the room is about diaries and travel. Six sittings a year lets a reading run unwatched for about two months at a time; twenty six lets it run for two weeks. Both of those sentences state the same decision in the units that matter, and stating it that way is the single most useful thing a calendar does.

Take the everyday version first. The mechanism is exactly the same at household scale. A household that opens its bank statement once a year finds out about the standing order it cancelled and the shop kept charging, twelve months late. A household that opens it monthly finds out in about a fortnight on average. Nobody in either household is more careful than the other. The difference is entirely a decision about how often to look, taken once, quietly, and never revisited. A committee cadence is that decision at institutional scale, and the reason it hides so well is that it is written as a frequency rather than as a delay.

Step 3, put the papers on it

Now the calendar acquires its second kind of item, and this is where most calendars quietly go wrong. Vindhya Commercial Bank Limited has nine recurring items. Eight of them, CA1 to CA8, are sittings: they have a room, a quorum, a chair and a decision at the end. The ninth, CA9, is not a sitting at all. CA9 is the monthly risk report, 38 printed sides carrying 173 numbers, of which 14 are on the opening side, circulated 5 working days ahead of the sitting it is addressed to. Three of those 38 sides carry a decision the committee has to take and 35 carry information. A document has an author, a circulation date and no decision of its own. A calendar listing only the sittings is therefore half a calendar.

The circulation leadThe gap between a paper going out and the sitting it is for, which is 5 working days at this invented bank. is the column people skip, and it is the one that decides whether the paper can actually be read. Five working days on a document of 38 printed sides is a real ask of a person who has another job. Two days is a ritual. When the column is missing the lead is zero days, and a paper handed round the table gets its decision from whoever wrote it. And the report is also where a standing itemA paper that arrives at every sitting whether or not anybody asked for it. lives: an open breach that appears on every agenda until it closes cannot be forgotten by anybody. Not forgetting is a property of the calendar rather than of anybody's memory.

Step 4, lay the dated events on top

Steps 1 to 3 produce a recurring year, the same one every year. Step 4 adds the things that actually happened, and no two years bring the same list. A dated obligationSomething the calendar must carry on a specific date rather than at a repeating interval. is anything the calendar has to carry on a particular date rather than at a repeating interval, and this bank's year holds eleven of them, CD1 to CD11. The dated obligations run from breach B5 on the trading book in month 3, closed on day 23, through the approval of policy PL6 in month 4, four more limit crossings, the month 8 sitting at which the board risk management committee recorded that climate risk appears nowhere in its own list of risk categories, and out to the model sweep and the continuity test at the year end.

Now lay them on the recurring year and read what happens. The two events that closed fastest, CD1 and CD7, never needed a committee at all: a position was moved and the crossing was gone in a day or two. The events that stayed open are the ones that needed a decision, and a decision has to wait for a sitting. Breach B1 crossed limit L3 in month 5 and the board risk management committee accepted it in month 6. One sitting later is as fast as a six sitting cadence can physically go. Nobody was slow. The delay was decided years earlier, by whoever wrote 6 in the cadence column.

Step 5, read the gaps

The last step needs no new information at all. Everything it uses is already in the columns just filled in. A cadence turns into two numbers: the interval between sittings, and the average wait from a random event to the next one. On a 365 day year, six sittings a year is an interval of 60.8 days and an average wait of 30.4 days. Twelve sittings is 30.4 and 15.2. Twenty six is 14.0 and 7.0. Four is 91.3 and 45.6. Something that happens at a moment nobody chose lands, on average, halfway between two sittings, so the average wait is half the interval.

One small identity makes the whole arithmetic memorable. Half of a sixth is a twelfth, so at six sittings a year the average wait is exactly one twelfth of the year. A body that sits six times a year has committed, by arithmetic and not by intention, to an average delay of one month on everything that reaches it. The urgent things wait that month with the rest. Ask for a wait inside a month and six will not do it. Seven will: 365 over 7 is 52.1 days and half of that is 26.1. Seven sittings a year is an odd looking number that nobody would propose in a meeting, and it is the only single step that crosses that particular line.

What happens to a reading between two sightings of it?

A sightingOne occasion on which a reading is actually put in front of a body that can act on it. is one occasion on which a number is actually put in front of a body that can act on it. Between two sightings the number carries on doing whatever it was doing, and nobody is watching. The movement between two sightings is driftHow far a number moves between two sightings of it., and drift is the honest cost of a cadence. The bank's record holds exactly two readings of one limit and no others: the sector concentration measured against limit L3 stood at 12.2 per cent of gross advances in month 5, when it first crossed the bank's own 12.0 per cent cap, and 13.0 per cent at month 12. In rupees at month 12 that is Rs 7,644 crore of exposure against a cap of Rs 7,056 crore. How the sector measure itself is built belongs to the credit subject; the calendar takes the reading as locked and asks who saw it and when.

A straight line through those two points rises 0.8 percentage points over 7 months, being 0.1143 points a month and 1.3714 points a year. Divided by the number of sightings, that gives the drift between one sighting and the next: 1.371 points at one sighting a year, 0.343 at four, 0.229 at six, 0.114 at twelve and 0.053 at twenty six. Drift falls as one over the number of sightings. Every doubling halves what is left rather than removing a fixed amount, and the first few extra sittings therefore buy far more than the later ones. Going from six to twelve saves about 0.114 points. Going from twelve to twenty four saves about 0.057, half as much for the same doubling of cost.

What does the calendar show when twelve reports meet six sittings?

Everything so far has been arithmetic on a single column. The last thing the calendar does is put two columns beside each other, and that is where it earns its place. The monthly risk report is produced twelve times a year. The body it is addressed to sits six times a year. Both of those decisions are perfectly defensible on their own. Together they are a question nobody has answered.

How can anyone tell whether a calendar is working?

Four tests, and every one of them can be run on the document itself without asking anybody how they felt about the meeting. First, does every dated obligation land somewhere that can act on it. Second, does every recurring paper have a sitting to land at. The bank here fails that second test on six documents out of twelve. Third, is the wait implied by each cadence written down beside it in days. A cadence stated as a frequency hides the delay and a cadence stated as a delay cannot hide it. Fourth, does every item name the decision expected. An item that has produced no decision for four sittings running can then be seen for what it is.

There is a fifth test that is really the first one turned round, and it is the sharpest of the five. Take the fastest thing that could plausibly go wrong and ask how long the calendar makes it wait. At this bank a foreign exchange position went over its cap on month 9 day 2, was escalated to Devendra Achar the same evening and was squared the next morning: one business day, and no committee was involved in fixing it. The calendar was not the mechanism that fixed the fast breach, and a calendar that only serves the slow ones has been mistaken for the whole of governance. The annual cycleThe set of items that happen once a year, of which the appetite approval is the anchor. matters too, and its anchor is the board's approval of the risk appetite statement, from which the year of limits and reports is supposed to hang.

What can a calendar not fix?

A calendar moves paper on time. Moving paper on time is the whole of the promise, and the word governance invites people to hear a great deal more. At the month 12 sitting of the board risk management committee every calendar obligation was met: the report of 38 sides went out 5 working days ahead exactly as the row required, complete, to everybody entitled to it. Of the 8 people in the room, 6 had read it before arriving. Every obligation on the document was met and a quarter of the audience was unprepared, and no column anywhere on the calendar could have prevented that.

None of that is an argument against calendars. The unprepared quarter is an argument about what to do next, and about where the next fix has to come from. Whether the paper is readable is a question about the agenda and the report design: 35 of 38 sides carrying information and 3 carrying a decision is a document that buries its own point, and the opening side carries 14 numbers and none of the 3 decisions. Whether the room engages with it is a question about the charter and the culture. Both of those are settled elsewhere in this sequence and neither is a calendar problem. The calendar does one thing nothing else does: it makes it impossible to say afterwards that nobody knew the paper was due.

Who actually picks a calendar up, and what do they do with it?

An independent director joining a board asks for three documents, and the calendar is one of them, usually before the risk appetite statement. The reason is practical rather than ceremonial: it is the fastest way to find out what will actually reach them and how often. A director who reads that the body meets six times a year, and works out that this means an average wait of thirty days on anything that arises, has learned something about their own exposure that no mandate document states. Sunanda Ravikumar, the chief risk officer at this invented bank, produces the calendar; the people who most need to read it closely are the ones who did not write it.

Internal audit reads it as a test plan. Rustom Batliwala, who heads internal audit here and reports to the audit committee rather than into management, can test a calendar without opinions: did the paper circulate by the date the row states, did the item appear on the agenda, was a decision recorded against the items that name one. The three checks run across a testable population of a few hundred rows a year, and a test that needs no judgement is unusual in this subject. A counterparty analyst at another institution uses the calendar differently again, as a crude read on how quickly this bank can respond to something. The read matters when that institution decides how much of its own exposure to leave sitting here.

The mechanism does not change with scale. Consider the household version. A household running on one salary, with one card statement, one insurance renewal and one school fee date, has a governance calendar whether or not it has written one. The ones who write it down do not become better with money. A household that writes it down never finds out about the renewal three days after the cover lapsed. A written calendar does exactly that much, at every size, and it is worth more than it sounds.