Risk Reports the Board of Directors Actually Uses

A risk report that the board of directors merely takes note of has failed its purpose. Art. 716a CO obliges the board of directors to provide overall direction and supervise management, but it does not prescribe how the underlying risk information should be prepared. For financial institutions, FINMA specifies this duty in its own circulars; for listed companies, the Swiss Code adds an annual risk assessment. The yardstick remains the same in both cases: does the report contribute to a decision, or does it simply get filed away.

What duty does the board of directors bear in risk oversight?

Under Art. 716a CO, the board of directors has non-transferable and inalienable duties, which include the overall direction of the company and the overall supervision of management. According to the Faculty of Law at the University of Zurich, overall direction includes setting and enforcing strategy as well as assessing the risk situation as sub-tasks under Art. 716a CO. Overall supervision of the persons entrusted with management is additionally set out in Art. 716a para. 1 no. 5 CO. However, the Swiss Code of Obligations does not prescribe how the board of directors fulfils this duty in practice. Technical standards such as ISO 31000:2018 or the COSO Enterprise Risk Management framework are cited for orientation, but they are not binding. The gap between the statutory duty and its concrete implementation lies in the responsibility of each individual board of directors.

What do FINMA and the Swiss Code specifically require of reporting?

For banks, FINMA specifies the reporting duty in its own circulars; for listed companies, the Swiss Code recommends an annual risk assessment. The FINMA Circular 2017/1 Corporate Governance – Banks, issued on 22 September 2016 and in force since 1 July 2017, defines risk management as the structures, methods and processes used to identify, analyse, assess, manage, monitor and report risks. Under the circular, the governing body approves the risk policy and the framework concept for institution-wide risk management and takes note of the compliance function’s report at least annually. The fully revised FINMA Circular 2023/1 Operational Risks and Resilience – Banks, in force since 1 January 2024, further specifies regular reporting and requires at least annual reporting to the board of directors and executive management on operational resilience. For listed companies outside the financial sector, the Swiss Code of Best Practice for Corporate Governance published by economiesuisse on 6 February 2023 recommends at least an annual risk assessment by the board of directors, the results of which feed into the further development of the internal control system.

Where do many risk reports fail in practice?

Risk reports fail their purpose when they are repetitive, too slow or too subjective to support a decision. A Director Analyst at Gartner stated at the Enterprise Risk, Audit & Compliance Conference 2026 in London that exactly these three characteristics regularly degrade risk reporting from a basis for decision-making to a mere status update. Repeated metrics without new context, delayed information after a risk has already materialised, and subjective assessments without a traceable basis all lead to the board of directors taking note of a report without acting on it. As a countermeasure, Gartner suggests that ERM teams go beyond mere report streamlining and visualisation and use artificial intelligence to identify trends, uncover risk interdependencies and suggest possible responses. A growing risk register without ongoing prioritisation reinforces this pattern further.

What distinguishes a decision-ready report from a documenting one?

A decision-ready report makes risk interdependencies and possible responses visible instead of merely listing the status quo. The IIA Three Lines Model describes the role of the board of directors as the governing body that sets vision, mission, values and risk appetite, delegates operational responsibility to management and receives reports from management on the achievement of objectives. According to this model, the interaction of the three lines is intended to ensure the reliability, coherence and transparency of the information needed for risk-based decisions. Applied to reporting practice, this means a report must identify which risks reinforce each other, which risk appetite is affected and what courses of action exist. Monetary magnitudes help make risks comparable with one another, for example through risk quantification, rather than describing them only in words.

How can risk reporting be improved in practice?

The board of directors checks for each report whether it can derive a decision from it, and sends back reports lacking this quality with a specific query. A first, verifiable step: the risk function presents the board of directors, at the next ordinary meeting, with a list of the risk reports submitted during the current year and marks which report led to a concrete decision, a follow-up query or no response at all. This overview immediately shows which type of report actually has an effect and which merely documents. The second step concerns the structure itself: reports that are to move from status reporting to steering require a logic that prioritises risks instead of merely listing them. The transition from evidence to a steering instrument concerns not individual metrics but the entire reporting logic.

FAQ

Frequently asked questions

What legal basis governs risk oversight by the board of directors in Switzerland?

Art. 716a CO obliges the board of directors to provide overall direction of the company and overall supervision of management. According to legal interpretation, this also includes setting the strategy and assessing the risk situation. The law itself does not prescribe how this duty is implemented in practice.

Are there specific rules on risk reporting for banks?

Yes. FINMA Circular 2017/1 requires the governing body to approve the risk policy and to receive at least annual compliance reports. The fully revised Circular 2023/1 additionally requires at least annual reporting on operational resilience to the board of directors and executive management.

What does the Swiss Code recommend regarding risk reporting for listed companies?

The Swiss Code of Best Practice for Corporate Governance recommends at least an annual risk assessment by the board of directors for listed companies. Its results are meant to feed into the further development of the internal control system, although the Code does not prescribe a specific reporting format.

Why do many risk reports to the board of directors merely get noted rather than lead to decisions?

Gartner names three causes: repetitive metrics without new context, delayed information after a risk has already materialised, and subjective assessments without a traceable basis. These characteristics degrade a report to a mere status update that the board of directors does not act on.

How can it be checked whether a risk report to the board of directors actually has an effect?

The risk function compiles a list of all risk reports submitted during the current year and marks which report led to a concrete decision, a follow-up query or no response at all. This overview immediately shows which type of report has an effect and which merely documents.

Sources

1. FINMA Circular 2017/1 Corporate Governance – BanksFINMA
2. Swiss Code of Best Practice for Corporate Governance 2023economiesuisse