# Risk Reports the Board of Directors Actually Uses > The article explains how risk reports for the board of directors become a basis for decisions under Art. 716a CO, FINMA circulars and the Swiss Code. It addresses boards and risk functions. SwissGRC® also shows how to check which reports lead to action. - URL: https://swissgrc.com/en/risk-reports-board-of-directors-decision-basis/ - Publisher: SwissGRC® - Published: 2026-10-30 - Last updated: 2026-10-31 ## Key facts - Art. 716a CO assigns the board of directors the non-transferable duties of overall direction of the company and overall supervision of management, but does not prescribe how risk information is prepared. - FINMA Circular 2017/1 Corporate Governance, Banks has been in force since 1 July 2017 and requires the governing body to approve the risk policy and to take note of the compliance report at least annually. - FINMA Circular 2023/1 Operational Risks and Resilience, Banks has been in force since 1 January 2024 and requires at least annual reporting on operational resilience to the board of directors and executive management. - The Swiss Code of Best Practice for Corporate Governance, published by economiesuisse on 6 February 2023, recommends at least an annual risk assessment by the board of directors of listed companies. - Gartner names three weaknesses of risk reports: repetitive metrics without new context, delayed information and subjective assessments without a traceable basis. - A decision-ready report shows which risks reinforce each other, which risk appetite is affected and which courses of action exist. A risk report that the board of directors merely takes note of has failed its purpose. Art. 716a CO obliges the board of directors to provide overall direction and supervise management, but it does not prescribe how the underlying risk information should be prepared. For financial institutions, FINMA specifies this duty in its own circulars; for listed companies, the Swiss Code adds an annual risk assessment. The yardstick remains the same in both cases: does the report contribute to a decision, or does it simply get filed away. In short Risk reporting provides the board of directors with a basis for decision-making when it goes beyond the statutory duty under Art. 716a CO and makes risk interdependencies, courses of action and the risk appetite affected visible. FINMA circulars specify this for banks, and the Swiss Code recommends an annual risk assessment. What matters is whether a report triggers a response or is simply filed away. ## What duty does the board of directors bear in risk oversight? Under Art. 716a CO, the board of directors has non-transferable and inalienable duties, which include the overall direction of the company and the overall supervision of management. According to the Faculty of Law at the University of Zurich, overall direction includes setting and enforcing strategy as well as assessing the risk situation as sub-tasks under Art. 716a CO. Overall supervision of the persons entrusted with management is additionally set out in Art. 716a para. 1 no. 5 CO. However, the Swiss Code of Obligations does not prescribe how the board of directors fulfils this duty in practice. Technical standards such as ISO 31000:2018 or the COSO Enterprise Risk Management framework are cited for orientation, but they are not binding. The gap between the statutory duty and its concrete implementation lies in the responsibility of each individual board of directors. ## What do FINMA and the Swiss Code specifically require of reporting? For banks, FINMA specifies the reporting duty in its own circulars; for listed companies, the Swiss Code recommends an annual risk assessment. The [FINMA Circular 2017/1 Corporate Governance – Banks](https://www.finma.ch/de/~/media/finma/dokumente/dokumentencenter/myfinma/rundschreiben/finma-rs-2017-01-20200101.pdf?la=de), issued on 22 September 2016 and in force since 1 July 2017, defines risk management as the structures, methods and processes used to identify, analyse, assess, manage, monitor and report risks. Under the circular, the governing body approves the risk policy and the framework concept for institution-wide risk management and takes note of the compliance function’s report at least annually. The fully revised FINMA Circular 2023/1 Operational Risks and Resilience – Banks, in force since 1 January 2024, further specifies regular reporting and requires at least annual reporting to the board of directors and executive management on operational resilience. For listed companies outside the financial sector, the [Swiss Code of Best Practice for Corporate Governance](https://backend-api.economiesuisse.ch/sites/default/files/2025-12/SwissCode_DE_RZ.pdf) published by economiesuisse on 6 February 2023 recommends at least an annual risk assessment by the board of directors, the results of which feed into the further development of the internal control system. ![Risk Reporting: aggregiertes Risiko gegen Risikotragfähigkeit in der SwissGRC Plattform](https://swissgrc.com/wp-content/uploads/sites/2/2026/09/rq-capacity-1024x837.webp) Risk Reporting: aggregiertes Risiko gegen Risikotragfähigkeit in der SwissGRC Plattform ## Where do many risk reports fail in practice? Risk reports fail their purpose when they are repetitive, too slow or too subjective to support a decision. A Director Analyst at Gartner stated at the Enterprise Risk, Audit & Compliance Conference 2026 in London that exactly these three characteristics regularly degrade risk reporting from a basis for decision-making to a mere status update. Repeated metrics without new context, delayed information after a risk has already materialised, and subjective assessments without a traceable basis all lead to the board of directors taking note of a report without acting on it. As a countermeasure, Gartner suggests that ERM teams go beyond mere report streamlining and visualisation and use artificial intelligence to identify trends, uncover risk interdependencies and suggest possible responses. A growing risk register without ongoing prioritisation reinforces this pattern further. ## What distinguishes a decision-ready report from a documenting one? A decision-ready report makes risk interdependencies and possible responses visible instead of merely listing the status quo. The IIA Three Lines Model describes the role of the board of directors as the governing body that sets vision, mission, values and risk appetite, delegates operational responsibility to management and receives reports from management on the achievement of objectives. According to this model, the interaction of the three lines is intended to ensure the reliability, coherence and transparency of the information needed for risk-based decisions. Applied to reporting practice, this means a report must identify which risks reinforce each other, which risk appetite is affected and what courses of action exist. Monetary magnitudes help make risks comparable with one another, for example through risk quantification, rather than describing them only in words. ## How can risk reporting be improved in practice? The board of directors checks for each report whether it can derive a decision from it, and sends back reports lacking this quality with a specific query. A first, verifiable step: the risk function presents the board of directors, at the next ordinary meeting, with a list of the risk reports submitted during the current year and marks which report led to a concrete decision, a follow-up query or no response at all. This overview immediately shows which type of report actually has an effect and which merely documents. The second step concerns the structure itself: reports that are to move from status reporting to steering require a logic that prioritises risks instead of merely listing them. The transition from evidence to a steering instrument concerns not individual metrics but the entire reporting logic. Related ### Risk in figures for the board of directors The solution for risk quantification translates risks into monetary magnitudes. It makes risk reports comparable and decision-ready for the board of directors. [RiskQuant](https://swissgrc.com/en/risk-quantification/) For practice ## Key points - The board of directors should check every risk report to determine whether it leads to a concrete decision or merely conveys status. - For banks, FINMA Circulars 2017/1 and 2023/1 set out specific requirements for the content and frequency of reporting to the board of directors. - The Swiss Code recommends at least an annual risk assessment by the board of directors for listed companies. - Risk reports gain decision value when they show risk interdependencies and courses of action rather than just metrics. - A list of decisions already made in response to risk reports reveals which reporting format actually has an effect. FAQ ## Frequently asked questions What legal basis governs risk oversight by the board of directors in Switzerland? Art. 716a CO obliges the board of directors to provide overall direction of the company and overall supervision of management. According to legal interpretation, this also includes setting the strategy and assessing the risk situation. The law itself does not prescribe how this duty is implemented in practice. Are there specific rules on risk reporting for banks? Yes. FINMA Circular 2017/1 requires the governing body to approve the risk policy and to receive at least annual compliance reports. The fully revised Circular 2023/1 additionally requires at least annual reporting on operational resilience to the board of directors and executive management. What does the Swiss Code recommend regarding risk reporting for listed companies? The Swiss Code of Best Practice for Corporate Governance recommends at least an annual risk assessment by the board of directors for listed companies. Its results are meant to feed into the further development of the internal control system, although the Code does not prescribe a specific reporting format. Why do many risk reports to the board of directors merely get noted rather than lead to decisions? Gartner names three causes: repetitive metrics without new context, delayed information after a risk has already materialised, and subjective assessments without a traceable basis. These characteristics degrade a report to a mere status update that the board of directors does not act on. How can it be checked whether a risk report to the board of directors actually has an effect? The risk function compiles a list of all risk reports submitted during the current year and marks which report led to a concrete decision, a follow-up query or no response at all. This overview immediately shows which type of report has an effect and which merely documents. Sources 1. [FINMA Circular 2017/1 Corporate Governance – Banks](https://www.finma.ch/de/~/media/finma/dokumente/dokumentencenter/myfinma/rundschreiben/finma-rs-2017-01-20200101.pdf?la=de)FINMA 2. [Swiss Code of Best Practice for Corporate Governance 2023](https://backend-api.economiesuisse.ch/sites/default/files/2025-12/SwissCode_DE_RZ.pdf)economiesuisse ## Frequently asked questions ### Welche gesetzliche Grundlage gilt für die Risikoüberwachung durch den Verwaltungsrat? Art. 716a CO verpflichtet den Verwaltungsrat zur Oberleitung der Gesellschaft und zur Oberaufsicht über die Geschäftsleitung. Dazu zählt auch die Beurteilung der Risikolage. Wie diese Pflicht umgesetzt wird, schreibt das Gesetz nicht vor. ### Gibt es für Banken besondere Vorgaben zum Risikoreporting? Ja. Das FINMA-Rundschreiben 2017/1 verlangt, dass das Leitungsorgan die Risikopolitik genehmigt und den Compliance-Bericht mindestens jährlich zur Kenntnis nimmt. Das Rundschreiben 2023/1 verlangt zusätzlich mindestens jährliche Berichterstattung zur operationellen Resilienz an Verwaltungsrat und Geschäftsleitung. ### Was empfiehlt der Swiss Code zum Risikoreporting börsenkotierter Unternehmen? Der Swiss Code empfiehlt mindestens eine jährliche Risikobeurteilung durch den Verwaltungsrat. Die Ergebnisse fliessen in die Weiterentwicklung des internen Kontrollsystems ein. Ein bestimmtes Berichtsformat schreibt der Code nicht vor. ### Warum führen viele Risikoberichte nicht zu Entscheidungen? Gartner nennt drei Ursachen: wiederholte Kennzahlen ohne neuen Kontext, verspätete Informationen nach Eintritt eines Risikos und subjektive Einschätzungen ohne nachvollziehbare Grundlage. Dadurch wird der Bericht zum blossen Statusupdate. ### Wie lässt sich prüfen, ob ein Risikobericht wirkt? Die Risikofunktion legt dem Verwaltungsrat eine Liste aller im laufenden Jahr eingereichten Risikoberichte vor. Sie markiert, welcher Bericht zu einem Entscheid, einer Rückfrage oder zu keiner Reaktion führte.