Risk Reporting: The Report, the Dashboard and What a Committee Needs

A risk report is the document that carries every risk an institution runs to the body that has to decide about it. A dashboard is the single sheet in front of it, and the two are different instruments rather than a long and a short version of one thing. At the invented Vindhya Commercial Bank Limited the report runs to 38 sheets and 173 numbers, and 3 sheets ask for a decision.

One discipline has to come before anything else. A risk report touches every risk an institution runs. Touching everything makes a report the easiest place to start teaching subjects that live somewhere else, and once that starts, the material stops being about reporting and becomes a thin version of six other subjects. So the rule for everything below is this. Every line on this report is named, its purpose on the report is explained, what a committee needs beside it is stated, and the mechanism behind it is handed straight back to the subject that teaches it. A report is a container, and the container is the subject.

What is a Risk Report, and what is it actually for?

Start with the everyday version. The shape is identical and the stakes are only smaller. A household running on one salary has four or five things that could go wrong: the salary stops, the rent goes up, somebody falls ill, the car dies, the school fee lands in the same month as the insurance premium. Every one of those lives in a different corner of somebody's head. Once a month, the two people who actually decide things sit down and put all five in front of each other at the same time. Nothing new is discovered in that half hour. Five separate worries become one picture, and one picture can be argued with.

Putting them side by side is the whole job. A report exists so that every risk arrives in front of one body, in one document, at one time, and can therefore be traded off against every other risk. Any one of those risks could be watched perfectly well on its own, by the person closest to it, in more detail than a report would ever carry. No individual watcher can say whether the risk they watch matters more than the risk somebody else watches. Only a document that holds them side by side can do that, and only a body that receives all of them at once can act on it.

At the invented Vindhya Commercial Bank Limited, that document is produced monthly and addressed to committee G2, the board risk management committee. The report runs to 38 sheets, it is circulated 5 working days before the meeting, and it carries 173 numbers. Of those 173 numbers, 14 sit on the first sheet. Of the 38 sheets, 3 carry a decision the committee has to take and 35 carry information. At the month 12 meeting, 6 of the 8 attendees had read it before arriving. Every one of those figures is the bank's own.

Notice where the report stops. A report is not the place where any of these risks is measured. Every number on it was produced somewhere else, by somebody whose job is that risk, under a method that belongs to that risk. The report's contribution is assembly and sequencing, not measurement, and a report that starts measuring things has quietly taken over somebody else's job. The same is true in the household version: nobody works out the insurance premium during the monthly conversation. The premium arrives already known.

What is a Risk Dashboard, and why is it not a shorter report?

Almost everybody meets the dashboard first and assumes it is the report with the boring parts removed. A dashboard is not that, and treating it as that damages both objects. A report is read once and argued over; a dashboard is looked at repeatedly and has to survive being glanced at. Those are two different design problems and they pull in opposite directions.

Think about what glancing does. A person who glances is not reading sentences, they are scanning for anything that has changed colour. So a dashboard can carry a status and cannot carry a reason. A reason takes a sentence, and a sentence cannot be glanced at. Now think about what arguing does. A person who wants to challenge a number needs the movement since last time, the thing the number is measured against, and the assumption underneath it. Movement, benchmark and assumption take prose, and prose cannot be scanned. Ask the dashboard to explain and it stops being scannable. Ask the report to summarise and it stops being able to support a challenge.

The bank's dashboard carries 16 indicators, numbered K1 to K16 here because the record counts them without numbering them. At month 12, 9 are green, 5 are amber and 2 are red, and 9 plus 5 plus 2 is 16. The two reds are K1, the sector concentration standing behind breach B1, and K2, the top twenty depositor share standing behind breach B4. The colours on the middle group are the bank's own assignment against its own invented triggers, and none of them is anybody's requirement.

Now the part worth pausing on, and it decides what a dashboard is actually capable of. Eleven of the 16 indicators are lagging countsMeasures that count something after it has finished happening, such as losses booked or breaches recorded, so they can confirm but never warn., meaning they count something that has already finished happening, and only 5 move before a loss does. The eleven count losses booked, breaches recorded, issues past their date, exceptions observed. The five that lead are attrition in the dealing room, the age profile of open privileged access rights, the share of manual journal entries at close, the proportion of exceptions approved by the person who raised them, and the certificate of deposit roll rate. Eleven of sixteen is 68.8 per cent, and a dashboard that is more than two thirds history is a summary of the quarter that has gone rather than a warning about the one arriving.

Set that against what the year did. Of the 13 operational incidents I1 to I13, 4 were preceded by an amber or red indicator, being 30.8 per cent, so 9 of them, being 69.2 per cent, arrived with nothing showing. Two thirds of the dashboard looks backwards and roughly two thirds of the year's incidents were not signalled by it, and those are separate facts about separate objects that happen to sit near each other. The 68.8 per cent is the share of the dashboard that is a count; the 69.2 per cent is the share of incidents nothing warned about. The two shares are 0.4 percentage points apart and they are not two readings of one thing. How an indicator is designed so that it leads rather than counts, and how a warning with an action attached differs from an indicator that merely reports a position, belong to the material on risk indicators and early warning.

One last difference, and it is the sharpest one available. Limit L10, the wholesale funding share, stands at 22.6 per cent against a 20.0 per cent limit and is in live breach as B3. Limit L10 is not one of the 16 indicators. The breach does appear on the report, in the funding line, in full, with its cause. A breach can be absent from the dashboard and present in the report, and that is a design choice about what a glance is for rather than a hole in the record. A dashboard that turned every open item red would be scanned once and then ignored, which is the failure mode of every warning light that is always on.

What does every line on the report have to carry?

Every line itemOne section of a report covering one risk, which states where that risk stands and points elsewhere for the method behind the number. on a report has the same three parts, and the third one is the part that keeps a report from turning into a textbook. First, the position: where the number stands now. Second, the comparison, which is a limit, an appetite clause or a trigger the institution set for itself. Third, a pointer to where the mechanism is explained. A line that carries the first two parts and replaces the third with the explanation itself does not stay one line. An explanation cannot be shortened next month, and nobody ever deletes one.

The growth is easy to watch. Somebody in a meeting asks what economic value sensitivity actually means. A helpful person adds half a sheet to next month's report explaining it. The month after, a different member asks about the deposit assumption underneath it, and another half sheet appears. Nothing in that sequence is wrong, and at the end of two years the report has grown by ten sheets of material that gets read once each. A pointer answers the same question, permanently, in six words, and costs the report nothing.

Which thirteen lines does this bank's report actually carry?

Thirteen sections, numbered RL1 to RL13 in what follows. The numbering is a convention for reference against the shape the record locks, not a required content list and not anybody's standard. A different bank of a different shape would carry a different set, and the useful thing about a list like this is not the list, it is the test that can be run down it: for every line, ask what position it states, what that position is measured against, and where a reader is sent for the method, and any line that fails the third test is about to become an essay.

What do the capital, credit and asset quality lines say?

Take the first three in order, quickly. The interesting part is not any of the numbers. Line RL1 is capital. The bank's total capital ratio is 15.0 per cent, made of common equity tier 1 at 10.0 per cent, tier 1 at 11.0 per cent, and Rs 2,400 crore of tier 2 subordinated bonds on top, all measured against risk weighted assets of Rs 60,000 crore. The capital line sits against appetite clause A1. Clause A1 says the bank stays above its own internal floor of 11.0 per cent at all times and under its own severe scenario. Note the shape of the clause: it names two conditions, now and under stress, so a capital line that reports only today's reading has answered half of what it was asked. No limit sits under clause A1, which means nothing about capital moves between board meetings unless this report moves it.

Line RL2 is credit exposure and concentration. The ten largest single names, C1 to C10, carry Rs 9,960 crore of funded exposure, being 16.9 per cent of gross advances of Rs 58,800 crore, plus Rs 2,880 crore of undrawn committed lines and Rs 228 crore of derivative current exposure. The line runs against four limits: L1 single name at 94.5 per cent, L2 borrower group at 80.0 per cent, L3 sector concentration at 108.3 per cent, and L4 sub-investment grade share at 93.3 per cent. Limit L3 is over its cap, and that is breach B1.

Here is the reporting point buried in that line, and it has nothing to do with credit. The top ten is ranked by funded exposure, the bank's own chosen basis. Nirjhar Alloys Private Limited, a wholly held subsidiary of counterparty C1, carries Rs 660 crore funded and Rs 672 crore in total. The bank reports it inside the group line instead, so it appears nowhere on that list. On a funded ranking it would sit ninth. A ranked list is only readable when the report says what it is ranked on, and this one changes membership depending on the answer. That is a sentence the report line has to carry. How exposure is measured, netted and grouped belongs to the credit and counterparty risk subject and is not settled here.

Line RL3 is asset quality: gross non-performing assets of Rs 1,764 crore, being 3.0 per cent of gross advances, net of Rs 1,200 crore of provisions at 0.98 per cent of net advances, with provision coverage of 68.0 per cent. Appetite clause A5 sets 3.5 per cent for that line, and again no limit sits underneath it.

What does the market risk line report, and where is it measured?

Line RL4 carries two numbers that people constantly merge. The first is the position: value at risk on the trading book of Rs 15.6 crore, against limit L5 of Rs 18.0 crore, so utilisationWhat is actually running against a limit, stated as a percentage of the limit, where anything above 100 per cent means the limit has been passed. is 86.7 per cent. The second is the model's own report card: 7 backtesting exceptions, numbered X1 to X7, over 250 observation days. The bank's own policy escalates at five exceptions and requires a model review at seven, and both were triggered this year.

The position and the report card answer different questions, and a report that runs them together has destroyed both. The first says how much the bank could lose on a bad day by its own measure. The second says how often that measure was wrong. A position can sit comfortably inside its limit while the measure producing it has been passed seven times in a year, and exactly that happened at this bank. Value at risk itself, how an exception is counted, and how a supervisor treats a count all belong to the market risk subject. The Basel Committee at bis.org publishes the approach that puts an exception count into a band, and what applies in India comes from the Reserve Bank of India at rbi.org.in. Neither is stated here, and the 7 is this invented bank's own.

What does the Earnings at Risk line put in front of a committee?

Line RL5 reports one number: under the bank's own 200 basis point parallel rate scenario, the worst case fall in net interest income over the next twelve months is Rs 336 crore. Against net interest income of Rs 2,880 crore that is 11.7 per cent, and against appetite clause A2 of Rs 360 crore it is 93.3 per cent. The line stops there. How that sensitivity is computed, from a repricing ladder and a cumulative gap, belongs to the market risk subject and is not derived here.

A committee needs four things beside the number, and every one of them fits on the same line. First the horizon: twelve months. A sensitivity without a period is meaningless. Then the scenario. The 200 basis points is the bank's own internal choice and not anybody's requirement. Then the direction. The answer is not symmetrical: the same scenario applied upward adds Rs 156 crore to income while applied downward it takes Rs 336 crore away, and the asymmetry comes from deposit rates that do not fall as far as loan rates do. And last the clause it runs against. A reading of 93.3 per cent of a clause is a very different sentence from 93.3 per cent of nothing in particular.

Now the trap, and it is on the same report. The 93.3 per cent here is the earnings sensitivity against appetite clause A2 and it is not limit L4's utilisation, even though limit L4 reads 93.3 per cent too, three lines earlier, in the same document. Rs 336 crore over Rs 360 crore reduces to 14 over 15. Rs 8,232 crore over Rs 8,820 crore also reduces to 14 over 15. One fraction is wearing two meanings, and the only defence is the discipline of naming the object every single time it is written.

What does the Economic Value at Risk line need beside its number?

Line RL6 is this bank's own label for the sensitivity of the economic value of its equity to the same rate move. The line reads minus Rs 840 crore, being 12.7 per cent of tier 1 capital of Rs 6,600 crore, against limit L8 of Rs 990 crore, so utilisation is 84.8 per cent. Once again the computation itself belongs to the market risk subject and is not performed here.

Two things have to travel with that number or the committee has been handed a conclusion with the argument removed. The first is the other half of the position: the identical 200 basis point rise that takes Rs 840 crore off value adds Rs 156 crore to income. Both figures are right and they answer different questions, one about value today and one about earnings over a year, and a committee shown only one of the pair has been shown half of an interest rate position and told it is the whole.

The second is the assumption. The figure depends on the average behavioural life given to Rs 36,000 crore of current and savings balances, set at 0.5 years by a model that has never been validated. At 2.0 years, the midpoint of the bank's own repricing bucket RB5 where the very same Rs 36,000 crore is slotted, the answer is plus Rs 240 crore instead. So the sign of the headline reading is set by an input that appears nowhere on the line. And name that one too: Rs 240 crore over Rs 990 crore is 24.2 per cent of limit L8. The never validated share of the model population is also 24.2 per cent in the same bank, and the two have nothing to do with each other. Whether a behavioural assumptionA stated view of how customers will act rather than what a contract says, such as how long a deposit repayable on demand actually stays. like that one belongs on the face of a report or in an appendix is a real argument. Whether it belongs somewhere is not.

What do the liquidity, funding and operational loss lines carry?

Line RL7 states three things: a coverage reading of 125.0 per cent, being a buffer of Rs 14,400 crore against modelled net outflows of Rs 11,520 crore over thirty days; a survival horizon of 34 days under the bank's own severe scenario; and three limits, L9 the short bucket gap at 89.3 per cent, L10 the wholesale funding share at 112.8 per cent and L12 depositor concentration at 120.8 per cent, the last two being live breaches B3 and B4.

There is a reporting rule sitting inside that, and it is one of the most useful in this guide. The 125.0 per cent sounds like a quarter more resource than is needed. The bank's own severe scenario consumes Rs 13,200 crore of the Rs 14,400 crore buffer within thirty days, or 91.7 per cent of it. Both numbers are correct. The first uses one set of run-off assumptions and the second uses a harsher set the bank chose for itself. When a report puts two readings of one buffer on one sheet, the sentence explaining why they differ has to come before the second number and not after it, or the reader spends the gap between them thinking somebody made a mistake. The ladders, the buffer and the survival horizon are taught by the liquidity risk subject and none of them is derived here.

Line RL8 reports operational loss: Rs 43.8 crore net over a rolling twelve months, against limit L11 of Rs 60.0 crore, at 73.0 per cent utilisation, from 13 incidents I1 to I13 and 5 near misses N1 to N5. Underneath that one net figure sit Rs 97.7 crore of gross losses and Rs 53.9 crore of recoveries.

And the reporting choice is which of those two the line ranks on. Rs 41.4 crore of a duplicated settlement came back, so incident I2 carries the largest gross loss of the year at Rs 42.0 crore and one of the smallest net ones at Rs 0.6 crore; incident I13 carries the largest net loss at Rs 15.4 crore. A loss table ranked on gross opens with I2 and a loss table ranked on net opens with I13, and only one of them tells the committee what the year actually cost. The Rs 15.4 crore is the net loss of incident I13 and it is not the Rs 15.6 crore of trading book value at risk on line RL4, a different object two lines earlier. Incident I13 is 1 of 13 by count, being 7.7 per cent, and 35.2 per cent of the year by value. How an incident is categorised, investigated and attributed belongs to the operational risk subject.

What does the Cyber Risk line carry, and who receives it?

One line, one position, one pointer. Cyber risk is genuinely interesting and it belongs to another subject, so this is where the discipline gets tested. The line reports where the institution stands on the risk of loss from an attack on or a failure of its information systems, and the subject itself is taught by the operational risk material, the home of information security and the incidents behind it. That is the whole of what belongs here.

The line carries three things in this bank: indicator K13, the age profile of open privileged access rights, one of only five forward looking indicators on the dashboard and green at month 12; the two incidents in the year that touched systems, being I3, where the core banking system was unavailable for 4 hours and 20 minutes on a working day, and I7, a phishing campaign against internet banking customers that reached 312 people who were reimbursed, at a net loss of Rs 1.5 crore; and policy PL7, information security.

And it carries one piece of routing that only a report can surface. Committee G8, the information security committee, has 6 members and meets quarterly, and it reports into committee G6, the operational risk management committee, rather than into the board. G6 meets monthly and G2 sits six times a year. So a cyber status set by a body that meets four times a year travels through a body that meets twelve times a year to reach a body that meets six times. A monthly line fed by a quarterly body has to say when its status was last refreshed. Otherwise a reader cannot tell a green set last week from a green set eleven weeks ago. That is a reporting duty and not a criticism of anybody's calendar.

What does the Third Party Risk line carry after incident I9?

Same discipline, same shape. The line reports where the institution stands on the risk arising from work it has arranged for somebody else to do, and the subject is taught by the operational risk material, the home of third party arrangements and how they are assessed and monitored. Policy PL8 governs it in this bank.

The year's instance is incident I9. A payment gateway hosted outside the bank failed for 9 hours and 48,000 transactions failed with it. The gross loss was Rs 4.4 crore, Rs 1.2 crore was recovered from the provider, and the net loss was Rs 3.2 crore. Name that first figure carefully: Rs 4.4 crore is the gross loss of incident I9, and it is not the whole year's net loss in event category 7, also Rs 4.4 crore across three separate incidents. Two numbers, one value, no relationship.

The recovery is the only figure on that line that says whether the arrangement transferred any of the loss or merely the work, and it is the part a committee actually needs. A third party line that reports the outage and not the recovery has described an inconvenience. A line that reports both has described a contract. A committee decides about the arrangement, not the counterpart.

What does the FX Transaction Risk line report when a deal settles?

A committed foreign currency amount settles at whatever rate applies on the day, and the difference between that and the rate expected lands in the profit and loss account. The difference is the exposure the line reports. The mechanism, the aggregation and every question about how a position is measured belong to the market risk material.

The position on this report is the bank's aggregate net open positionThe total foreign currency exposure left after offsetting, measured by a stated method, which is what a limit on currency exposure is set against. across five currencies numbered FX1 to FX5: Rs 192 crore against limit L7 of Rs 240 crore, so utilisation is 80.0 per cent. Breach B2 sits in the log against it, when the position reached Rs 276 crore on month 9 day 2 after a customer deal was booked past the cut-off, and was squared the next morning.

The line's own reporting duty is to state the method, and here is why. The net long positions across the five currencies come to Rs 192 crore. The net short positions come to Rs 120 crore in absolute terms. The bank measures the aggregate as the greater of the two, and the greater figure is the Rs 192 crore running against the limit. Adding the five currencies algebraically instead would give Rs 72 crore and would report a bank carrying five separate open positions as very nearly flat. The method is not a technicality on this line, it is the difference between 80.0 per cent of a limit and a third of that. The Bank for International Settlements at bis.org publishes the shorthand approach this follows and what applies in India comes from the Reserve Bank of India at rbi.org.in, and neither is stated here.

Why does FX Translation Risk get a second line of its own?

Because it lands somewhere else. A balance already held in a foreign currency gets restated when the rate moves, and the restatement moves a reserve rather than the profit and loss account. In this bank the exposure is a net investment of Rs 480 crore in one overseas branch, and a 5.0 per cent move in the rupee against that currency shifts the translation reserveA component of equity that absorbs the effect of restating foreign currency balances at new rates, without any amount passing through profit or loss. by Rs 24 crore.

One changes the result and the other changes the balance sheet, so the two exposures take two lines. A committee reading a single merged foreign exchange line cannot tell which of the two it is looking at. That is the entire argument for the split, and it is a reporting argument rather than a currency one. Everything about how either exposure arises, how it is measured and what can be done about it belongs to the market risk material.

Where does Wrong Way Risk appear on the counterparty line?

Line RL12 reports the counterparty book: Rs 228 crore of derivative current exposure across the ten largest names C1 to C10, the netting agreements that apply to it, and the one name where the exposure and the counterparty weaken together. The name is counterparty C7, Wainganga Textiles Limited, an importer on internal grade 6 holding a United States dollar forward against the bank. Its funded exposure is Rs 840 crore, and that Rs 840 crore is counterparty C7's funded exposure and not the Rs 840 crore of economic value change on line RL6, a different object on the same report.

Wrong way risk is exposure that grows in the same state of the world that weakens the counterparty, and that sentence is the entire amount of it that belongs on a report line. The credit and counterparty risk material teaches what it is, why it matters, how it is measured and what a netting agreement does about it.

The report line owes the committee something smaller and more specific: that one name in the book carries the feature, which name it is, and where the full treatment sits. A report that says less than that has hidden a known concentration of a particular kind. A report that says more than that has started teaching.

What does the breach log ask the committee to decide?

Line RL13 is different from every line above it, and the difference is the point of the whole subject. Six breaches occurred in the twelve months, numbered B1 to B6. Three are closed: B2, the overnight currency position, squared in one business day; B5, the trading book limit, closed when positions were reduced two days later; and B6, the sub-investment grade share, back inside its cap by month 9 as one exposure ran off. Three are open at month 12: B1 the sector concentration, B3 the wholesale funding share and B4 depositor concentration.

Look at what separates the two groups. The three that closed were traded out or ran off within days, and the three that are still open are every one of them a concentration built into the shape of the balance sheet. Not one of the three closes by itself. A breach caused by a position can be undone by reversing the position. A breach caused by the structure of the book has to be decided about.

So this line asks rather than tells. Committee G2 sets every limit L1 to L12 and accepts or refuses every breach, so nobody else in the institution can settle an open one. Breach B1 shows what settling looks like: the committee accepted it in month 6 as a temporary excess with a remediation plan running to month 18, and the risk owner is Manjari Sondhi, head of wholesale banking. The acceptance is a decision, recorded, with a date attached, and it is not the same thing as nobody having acted.

The record fixes that 3 of the 38 sheets carry a decision the committee has to take, and does not say which three. The record does fix that only committee G2 can accept or refuse a breach and that three breaches stand open, so a reader can see where a decision has to come from without being told where in the paper it was printed.

How to build a Risk Report: what are the eight steps?

Here is the method, in eight steps numbered BR1 to BR8. The order makes it a method rather than a list, and specifically where the order starts. A report built from the decision it serves ends up short. A report built from the numbers that happen to be available ends up at 38 sheets: every number that exists has somebody who would quite like to see it.

BR1, name the body and the decisions it actually takes. BR2, list the risks that bear on those decisions. BR3, choose one line for each risk, and one only. BR4, decide what each line needs beside its number, namely the three parts set out under the line item. BR5, place the decisions first. BR6, fix the frequency against the calendar of the body that receives it. BR7, agree the circulation lead time and then hold it. BR8, review annually against which lines anybody actually used.

Two of the eight are worth dwelling on. Step BR5, placing the decisions first, sounds like formatting and is not. If the three sheets a committee has to act on are scattered through 38, then whether anybody reaches them depends on how far they read, and that is not a property anybody designed. Step BR8 is the only step that can shorten anything. A line gets added because somebody asked for it once, in a meeting, three years ago, and nothing in the ordinary running of an institution ever removes it again. Reports do not grow because anybody decided they should; they grow because addition is easy and subtraction requires somebody to say a number is not needed.

How much of a real report actually asks the reader for anything?

The measurements are where the argument is. The report runs to 38 sheets and carries 173 numbers, or 4.55 numbers a sheet. Fourteen of those numbers are on the first sheet. The other 37 sheets carry the remaining 159, or 4.30 a sheet. The first sheet is more than three times as dense as anything behind it, and it is the one sheet every reader is certain to open.

Then the second measurement, and it changes how the first reads. Of the 38 sheets, 3 carry a decision the committee has to take and 35 carry information. Three against 35 is 7.9 per cent against 92.1 per cent. And none of the 3 decisions is on the first sheet. So the sheet most likely to be read in full is simultaneously the densest sheet in the document and the sheet that asks for nothing at all.

Two more figures from the same meeting. The report is circulated 5 working days ahead, a generous circulation lead timeThe interval between a paper being sent out and the meeting it serves, which is all the preparation time a reader actually gets. by any standard. And 6 of the 8 attendees had read it before arriving, being 75.0 per cent, so 2 arrived without. Both of those are usually reported as good news, and both measure delivery rather than preparation. A readership statistic shows that the document arrived and was opened; it cannot show whether opening it made anybody readier to decide anything. With 35 of the 38 sheets asking for nothing and the 3 that do asking from wherever they happen to sit, reading it and being prepared are not the same event.

What happens when twelve reports meet six sittings?

Who actually reads this, and what do they do with it?

Four readers, four completely different uses, and seeing them side by side is the fastest way to understand why the document is shaped as it is.

A committee member reads it to find out what they are being asked. Finding that out is the whole of their job in the five working days between the paper landing and the meeting. So the useful test a member can run without any technical knowledge at all is to go through the paper marking every sheet as either a decision sheetA sheet that asks the receiving body to settle something, as opposed to one telling it where things currently stand. or a context sheet, and then ask why the three in the first pile are not at the front. A member who cannot say what they are being asked for after reading the paper has found a fault in the paper rather than in themselves.

The chief risk officer, Sunanda Ravikumar in this invented bank, reads it as the person who has to sign it and defend it. She is not re-deriving anybody's arithmetic. She is looking for whether any line has grown an explanation, whether any percentage has been written without its object beside it, and whether a line that was added two years ago on somebody's request is still earning its space. Those checks are step BR8 run informally every month rather than once a year, and they are the only habit that keeps a document at a readable length.

A credit analyst at another institution, looking at this bank from outside as a counterparty rather than from inside it, would go to the breach log first if they could see it. Not the capital ratio, not the coverage reading. The breach log is the only line where the institution states in its own words the things it said it would not do and then did. Three breaches open at a reporting date, all three of them concentrations built into the balance sheet, says more about how a book is being run than any ratio on the front page.

The mechanism does not change with scale, so return to the household version. The monthly conversation from the opening example gains one column: for each of the five worries, is this a month where somebody has to decide something, or a month where the household is just checking. Most months, four of the five are checking. When the column is never marked, every worry arrives with the same weight and the conversation drifts to whichever one is loudest. When it is marked, the conversation takes twenty minutes and ends with two decisions rather than five recitals. Marking the column is the entire content of step BR5, and it costs nothing.

What is settled elsewhere?