{"id":70969,"date":"2026-10-30T16:33:52","date_gmt":"2026-10-30T15:33:52","guid":{"rendered":"https:\/\/swissgrc.com\/en\/?p=70969"},"modified":"2026-10-31T08:35:13","modified_gmt":"2026-10-31T07:35:13","slug":"risk-reports-board-of-directors-decision-basis","status":"publish","type":"post","link":"https:\/\/swissgrc.com\/en\/risk-reports-board-of-directors-decision-basis\/","title":{"rendered":"Risk Reports the Board of Directors Actually Uses"},"content":{"rendered":"<div id=\"sgce-a\" class=\"sgce-article\">\n<p class=\"rc-lede\">A risk report that the board of directors merely takes note of has failed its purpose. Art. 716a CO obliges the board of directors to provide overall direction and supervise management, but it does not prescribe how the underlying risk information should be prepared. For financial institutions, FINMA specifies this duty in its own circulars; for listed companies, the Swiss Code adds an annual risk assessment. The yardstick remains the same in both cases: does the report contribute to a decision, or does it simply get filed away.<\/p>\n<div class=\"rc-tldr\">\n<div class=\"rc-tldr-label\">In short<\/div>\n<p>Risk reporting provides the board of directors with a basis for decision-making when it goes beyond the statutory duty under Art. 716a CO and makes risk interdependencies, courses of action and the risk appetite affected visible. FINMA circulars specify this for banks, and the Swiss Code recommends an annual risk assessment. What matters is whether a report triggers a response or is simply filed away.<\/p>\n<\/div>\n<nav class=\"rc-toc\" aria-label=\"Contents\">\n<div class=\"rc-toc-label\">Contents<\/div>\n<ol>\n<li><a href=\"#a1-what-duty-does-the-board-of-directors-be\">What duty does the board of directors bear in risk oversight?<\/a><\/li>\n<li><a href=\"#a2-what-do-finma-and-the-swiss-code-specifi\">What do FINMA and the Swiss Code specifically require of reporting?<\/a><\/li>\n<li><a href=\"#a3-where-do-many-risk-reports-fail-in-pract\">Where do many risk reports fail in practice?<\/a><\/li>\n<li><a href=\"#a4-what-distinguishes-a-decision-ready-repo\">What distinguishes a decision-ready report from a documenting one?<\/a><\/li>\n<li><a href=\"#a5-how-can-risk-reporting-be-improved-in-pr\">How can risk reporting be improved in practice?<\/a><\/li>\n<\/ol>\n<\/nav>\n<h2 id=\"a1-what-duty-does-the-board-of-directors-be\">What duty does the board of directors bear in risk oversight?<\/h2>\n<p>Under Art. 716a CO, the board of directors has non-transferable and inalienable duties, which include the overall direction of the company and the overall supervision of management.<\/p>\n<p>According to the Faculty of Law at the University of Zurich, overall direction includes setting and enforcing strategy as well as assessing the risk situation as sub-tasks under Art. 716a CO. Overall supervision of the persons entrusted with management is additionally set out in Art. 716a para. 1 no. 5 CO.<\/p>\n<p>However, the Swiss Code of Obligations does not prescribe how the board of directors fulfils this duty in practice. Technical standards such as ISO 31000:2018 or the COSO Enterprise Risk Management framework are cited for orientation, but they are not binding. The gap between the statutory duty and its concrete implementation lies in the responsibility of each individual board of directors.<\/p>\n<h2 id=\"a2-what-do-finma-and-the-swiss-code-specifi\">What do FINMA and the Swiss Code specifically require of reporting?<\/h2>\n<p>For banks, FINMA specifies the reporting duty in its own circulars; for listed companies, the Swiss Code recommends an annual risk assessment.<\/p>\n<p>The <a href=\"https:\/\/www.finma.ch\/de\/~\/media\/finma\/dokumente\/dokumentencenter\/myfinma\/rundschreiben\/finma-rs-2017-01-20200101.pdf?la=de\" target=\"_blank\" rel=\"noopener nofollow\">FINMA Circular 2017\/1 Corporate Governance &#8211; Banks<\/a>, issued on 22 September 2016 and in force since 1 July 2017, defines risk management as the structures, methods and processes used to identify, analyse, assess, manage, monitor and report risks. Under the circular, the governing body approves the risk policy and the framework concept for institution-wide risk management and takes note of the compliance function&#8217;s report at least annually.<\/p>\n<p>The fully revised FINMA Circular 2023\/1 Operational Risks and Resilience &#8211; Banks, in force since 1 January 2024, further specifies regular reporting and requires at least annual reporting to the board of directors and executive management on operational resilience. For listed companies outside the financial sector, the <a href=\"https:\/\/backend-api.economiesuisse.ch\/sites\/default\/files\/2025-12\/SwissCode_DE_RZ.pdf\" target=\"_blank\" rel=\"noopener nofollow\">Swiss Code of Best Practice for Corporate Governance<\/a> published by economiesuisse on 6 February 2023 recommends at least an annual risk assessment by the board of directors, the results of which feed into the further development of the internal control system.<\/p>\n<figure class=\"rc-shot\"><img decoding=\"async\" src=\"https:\/\/swissgrc.com\/wp-content\/uploads\/sites\/2\/2026\/09\/rq-capacity-1024x837.webp\" alt=\"Risk Reporting: aggregiertes Risiko gegen Risikotragf\u00e4higkeit in der SwissGRC Plattform\" \/><figcaption>Risk Reporting: aggregiertes Risiko gegen Risikotragf\u00e4higkeit in der SwissGRC Plattform<\/figcaption><\/figure>\n<h2 id=\"a3-where-do-many-risk-reports-fail-in-pract\">Where do many risk reports fail in practice?<\/h2>\n<p>Risk reports fail their purpose when they are repetitive, too slow or too subjective to support a decision.<\/p>\n<p>A Director Analyst at Gartner stated at the Enterprise Risk, Audit &amp; Compliance Conference 2026 in London that exactly these three characteristics regularly degrade risk reporting from a basis for decision-making to a mere status update. Repeated metrics without new context, delayed information after a risk has already materialised, and subjective assessments without a traceable basis all lead to the board of directors taking note of a report without acting on it.<\/p>\n<p>As a countermeasure, Gartner suggests that ERM teams go beyond mere report streamlining and visualisation and use artificial intelligence to identify trends, uncover risk interdependencies and suggest possible responses. A growing risk register without ongoing prioritisation reinforces this pattern further.<\/p>\n<h2 id=\"a4-what-distinguishes-a-decision-ready-repo\">What distinguishes a decision-ready report from a documenting one?<\/h2>\n<p>A decision-ready report makes risk interdependencies and possible responses visible instead of merely listing the status quo.<\/p>\n<p>The IIA Three Lines Model describes the role of the board of directors as the governing body that sets vision, mission, values and risk appetite, delegates operational responsibility to management and receives reports from management on the achievement of objectives. According to this model, the interaction of the three lines is intended to ensure the reliability, coherence and transparency of the information needed for risk-based decisions.<\/p>\n<p>Applied to reporting practice, this means a report must identify which risks reinforce each other, which risk appetite is affected and what courses of action exist. Monetary magnitudes help make risks comparable with one another, for example through risk quantification, rather than describing them only in words.<\/p>\n<h2 id=\"a5-how-can-risk-reporting-be-improved-in-pr\">How can risk reporting be improved in practice?<\/h2>\n<p>The board of directors checks for each report whether it can derive a decision from it, and sends back reports lacking this quality with a specific query.<\/p>\n<p>A first, verifiable step: the risk function presents the board of directors, at the next ordinary meeting, with a list of the risk reports submitted during the current year and marks which report led to a concrete decision, a follow-up query or no response at all. This overview immediately shows which type of report actually has an effect and which merely documents.<\/p>\n<p>The second step concerns the structure itself: reports that are to move from status reporting to steering require a logic that prioritises risks instead of merely listing them. The transition from evidence to a steering instrument concerns not individual metrics but the entire reporting logic.<\/p>\n<div class=\"rc-bridge\">\n<div class=\"rc-bridge-mark\"><\/div>\n<div>\n<div class=\"rc-bridge-label\">Related<\/div>\n<h3>Risk in figures for the board of directors<\/h3>\n<p>The solution for risk quantification translates risks into monetary magnitudes. It makes risk reports comparable and decision-ready for the board of directors.<\/p>\n<p><a href=\"https:\/\/swissgrc.com\/en\/risk-quantification\/\">RiskQuant <\/a><\/p>\n<\/div>\n<\/div>\n<aside class=\"rc-takeaways\">\n<div class=\"rc-takeaways-label\">For practice<\/div>\n<h2>Key points<\/h2>\n<ul>\n<li>The board of directors should check every risk report to determine whether it leads to a concrete decision or merely conveys status.<\/li>\n<li>For banks, FINMA Circulars 2017\/1 and 2023\/1 set out specific requirements for the content and frequency of reporting to the board of directors.<\/li>\n<li>The Swiss Code recommends at least an annual risk assessment by the board of directors for listed companies.<\/li>\n<li>Risk reports gain decision value when they show risk interdependencies and courses of action rather than just metrics.<\/li>\n<li>A list of decisions already made in response to risk reports reveals which reporting format actually has an effect.<\/li>\n<\/ul>\n<\/aside>\n<section class=\"rc-faq\">\n<div class=\"rc-faq-head\">\n<div class=\"rc-faq-label\">FAQ<\/div>\n<h2>Frequently asked questions<\/h2>\n<\/div>\n<div class=\"rc-faq-list\">\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">What legal basis governs risk oversight by the board of directors in Switzerland?<\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>Art. 716a CO obliges the board of directors to provide overall direction of the company and overall supervision of management. According to legal interpretation, this also includes setting the strategy and assessing the risk situation. The law itself does not prescribe how this duty is implemented in practice.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">Are there specific rules on risk reporting for banks?<\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>Yes. FINMA Circular 2017\/1 requires the governing body to approve the risk policy and to receive at least annual compliance reports. The fully revised Circular 2023\/1 additionally requires at least annual reporting on operational resilience to the board of directors and executive management.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">What does the Swiss Code recommend regarding risk reporting for listed companies?<\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>The Swiss Code of Best Practice for Corporate Governance recommends at least an annual risk assessment by the board of directors for listed companies. Its results are meant to feed into the further development of the internal control system, although the Code does not prescribe a specific reporting format.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">Why do many risk reports to the board of directors merely get noted rather than lead to decisions?<\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>Gartner names three causes: repetitive metrics without new context, delayed information after a risk has already materialised, and subjective assessments without a traceable basis. These characteristics degrade a report to a mere status update that the board of directors does not act on.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">How can it be checked whether a risk report to the board of directors actually has an effect?<\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>The risk function compiles a list of all risk reports submitted during the current year and marks which report led to a concrete decision, a follow-up query or no response at all. This overview immediately shows which type of report has an effect and which merely documents.<\/p>\n<\/div>\n<\/details>\n<\/div>\n<\/section>\n<section class=\"rc-sources\">\n<div class=\"rc-sources-label\">Sources<\/div>\n<ol>\n<li><a href=\"https:\/\/www.finma.ch\/de\/~\/media\/finma\/dokumente\/dokumentencenter\/myfinma\/rundschreiben\/finma-rs-2017-01-20200101.pdf?la=de\" target=\"_blank\" rel=\"noopener nofollow\">FINMA Circular 2017\/1 Corporate Governance &#8211; Banks<\/a><span class=\"rc-source-pub\">FINMA<\/span><\/li>\n<li><a href=\"https:\/\/backend-api.economiesuisse.ch\/sites\/default\/files\/2025-12\/SwissCode_DE_RZ.pdf\" target=\"_blank\" rel=\"noopener nofollow\">Swiss Code of Best Practice for Corporate Governance 2023<\/a><span class=\"rc-source-pub\">economiesuisse<\/span><\/li>\n<\/ol>\n<\/section>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Risk reporting provides the board of directors with a basis for decision-making when it goes beyond the statutory duty under Art. 716a CO and makes risk interdependencies, courses of action and the risk appetite affected visible. FINMA circulars specify this for banks, and the Swiss Code recommends an annual risk assessment. What matters is whether a report triggers a response or is simply filed away.<\/p>\n","protected":false},"author":5,"featured_media":71068,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"_eb_attr":"","_swissgrc_real_author":"Daniel Arnold","real_author_title":"Chief Product Officer","real_author_bio":"Tracks how requirements from governance, risk and compliance translate into features and modules of the SwissGRC Plattform. This perspective keeps customers across Europe, MEA and APAC in view, for whom new releases need to hold up in daily practice.","real_author_photo":54969,"footnotes":"","_links_to":"","_links_to_target":""},"categories":[105],"tags":[239,240,212,237,238],"class_list":["post-70969","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-regulation-supervision","tag-swiss-code-risk-assessment","tag-risk-appetite-board-of-directors","tag-three-lines-model","tag-art-716a-co-risk-oversight","tag-finma-circular-risk-management"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO Pro 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"Risk reporting to the board of directors: how reports show risk interdependencies and courses of action instead of simply being filed away.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"superadmin\"\/>\n\t<meta name=\"google-site-verification\" content=\"google-site-verification=BAztS2wKP0jEfbvHt4_mrvvD17WwzZg1w1A6R9uoQRU\" \/>\n\t<link rel=\"canonical\" href=\"https:\/\/swissgrc.com\/en\/risk-reports-board-of-directors-decision-basis\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO Pro (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_GB\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Swiss GRC | Governance, Risk &amp; Compliance (GRC)\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Risk Reports the Board of Directors Actually Uses\" \/>\n\t\t<meta property=\"og:description\" content=\"Risk reporting to the board of directors: how reports show risk interdependencies and courses of action instead of simply being filed away.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/swissgrc.com\/en\/risk-reports-board-of-directors-decision-basis\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/10\/Blogbild-2048x1075-EN.png\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/10\/Blogbild-2048x1075-EN.png\" \/>\n\t\t<meta property=\"og:image:width\" content=\"2048\" \/>\n\t\t<meta property=\"og:image:height\" content=\"1075\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-10-30T15:33:52+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-10-31T07:35:13+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@SwissGRC\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Risk Reports the Board of Directors Actually Uses\" \/>\n\t\t<meta name=\"twitter:description\" content=\"Risk reporting to the board of directors: how reports show risk interdependencies and courses of action instead of simply being filed away.\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@SwissGRC\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/10\/Blogbild-2048x1075-EN.png\" \/>\n\t\t<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t\t<meta name=\"twitter:data1\" content=\"superadmin\" \/>\n\t\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/risk-reports-board-of-directors-decision-basis\\\/#blogposting\",\"name\":\"Risk Reports the Board of Directors Actually Uses\",\"headline\":\"Risk Reports the Board of Directors Actually Uses\",\"author\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/author\\\/superadmin\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2026\\\/10\\\/Blogbild-2048x1075-EN.png\",\"width\":2048,\"height\":1075,\"caption\":\"Bar chart with rising bars that stay below the risk capacity line until the last one exceeds it and is marked as a decision. Headline: Acknowledged is not decided.\"},\"datePublished\":\"2026-10-30T16:33:52+01:00\",\"dateModified\":\"2026-10-31T08:35:13+01:00\",\"inLanguage\":\"en-GB\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/risk-reports-board-of-directors-decision-basis\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/risk-reports-board-of-directors-decision-basis\\\/#webpage\"},\"articleSection\":\"Regulation &amp; Supervision, Swiss Code risk assessment, risk appetite board of directors, Three Lines Model, Art. 716a CO risk oversight, FINMA circular risk management\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/risk-reports-board-of-directors-decision-basis\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/category\\\/regulation-supervision\\\/#listItem\",\"name\":\"Regulation &amp; Supervision\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/category\\\/regulation-supervision\\\/#listItem\",\"position\":2,\"name\":\"Regulation &amp; Supervision\",\"item\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/category\\\/regulation-supervision\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/risk-reports-board-of-directors-decision-basis\\\/#listItem\",\"name\":\"Risk Reports the Board of Directors Actually Uses\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/risk-reports-board-of-directors-decision-basis\\\/#listItem\",\"position\":3,\"name\":\"Risk Reports the Board of Directors Actually Uses\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/category\\\/regulation-supervision\\\/#listItem\",\"name\":\"Regulation &amp; Supervision\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#organization\",\"name\":\"Swiss GRC AG\",\"description\":\"Swiss GRC delivers Software Solutions for GRC, CLM &amp; BPM, helping businesses worldwide manage risks, ensure compliance, and drive success.\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/\",\"telephone\":\"+41412207500\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2023\\\/06\\\/Logo_V1_Original_mit_Claim.png\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/risk-reports-board-of-directors-decision-basis\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/risk-reports-board-of-directors-decision-basis\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/www.twitter.com\\\/SwissGRC\",\"https:\\\/\\\/www.instagram.com\\\/swissgrc\\\/\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCy4QuXYekCQrA4n5oEwJSJg\",\"https:\\\/\\\/ch.linkedin.com\\\/company\\\/swissgrc\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/author\\\/superadmin\\\/#author\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/author\\\/superadmin\\\/\",\"name\":\"superadmin\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/risk-reports-board-of-directors-decision-basis\\\/#authorImage\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2023\\\/01\\\/logo-red.svg\",\"width\":96,\"height\":96,\"caption\":\"superadmin\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/risk-reports-board-of-directors-decision-basis\\\/#webpage\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/risk-reports-board-of-directors-decision-basis\\\/\",\"name\":\"Risk Reports the Board of Directors Actually Uses\",\"description\":\"Risk reporting to the board of directors: how reports show risk interdependencies and courses of action instead of simply being filed away.\",\"inLanguage\":\"en-GB\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/risk-reports-board-of-directors-decision-basis\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/author\\\/superadmin\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/author\\\/superadmin\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2026\\\/10\\\/Blogbild-2048x1075-EN.png\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/risk-reports-board-of-directors-decision-basis\\\/#mainImage\",\"width\":2048,\"height\":1075,\"caption\":\"Bar chart with rising bars that stay below the risk capacity line until the last one exceeds it and is marked as a decision. Headline: Acknowledged is not decided.\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/risk-reports-board-of-directors-decision-basis\\\/#mainImage\"},\"datePublished\":\"2026-10-30T16:33:52+01:00\",\"dateModified\":\"2026-10-31T08:35:13+01:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/\",\"name\":\"Swiss GRC - Software Solutions for GRC, CLM &amp; BPM\",\"description\":\"Governance, Risk & Compliance (GRC)\",\"inLanguage\":\"en-GB\",\"publisher\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO Pro -->\r\n\t\t<title>Risk Reports the Board of Directors Actually Uses<\/title>\n\n","aioseo_head_json":{"title":"Risk Reports the Board of Directors Actually Uses","description":"Risk reporting to the board of directors: how reports show risk interdependencies and courses of action instead of simply being filed away.","canonical_url":"https:\/\/swissgrc.com\/en\/risk-reports-board-of-directors-decision-basis\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"google-site-verification":"google-site-verification=BAztS2wKP0jEfbvHt4_mrvvD17WwzZg1w1A6R9uoQRU","miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/swissgrc.com\/en\/risk-reports-board-of-directors-decision-basis\/#blogposting","name":"Risk Reports the Board of Directors Actually Uses","headline":"Risk Reports the Board of Directors Actually Uses","author":{"@id":"https:\/\/swissgrc.com\/en\/author\/superadmin\/#author"},"publisher":{"@id":"https:\/\/swissgrc.com\/en\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/10\/Blogbild-2048x1075-EN.png","width":2048,"height":1075,"caption":"Bar chart with rising bars that stay below the risk capacity line until the last one exceeds it and is marked as a decision. Headline: Acknowledged is not decided."},"datePublished":"2026-10-30T16:33:52+01:00","dateModified":"2026-10-31T08:35:13+01:00","inLanguage":"en-GB","mainEntityOfPage":{"@id":"https:\/\/swissgrc.com\/en\/risk-reports-board-of-directors-decision-basis\/#webpage"},"isPartOf":{"@id":"https:\/\/swissgrc.com\/en\/risk-reports-board-of-directors-decision-basis\/#webpage"},"articleSection":"Regulation &amp; Supervision, Swiss Code risk assessment, risk appetite board of directors, Three Lines Model, Art. 716a CO risk oversight, FINMA circular risk management"},{"@type":"BreadcrumbList","@id":"https:\/\/swissgrc.com\/en\/risk-reports-board-of-directors-decision-basis\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/#listItem","position":1,"name":"Home","item":"https:\/\/swissgrc.com\/en\/","nextItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/category\/regulation-supervision\/#listItem","name":"Regulation &amp; Supervision"}},{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/category\/regulation-supervision\/#listItem","position":2,"name":"Regulation &amp; Supervision","item":"https:\/\/swissgrc.com\/en\/category\/regulation-supervision\/","nextItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/risk-reports-board-of-directors-decision-basis\/#listItem","name":"Risk Reports the Board of Directors Actually Uses"},"previousItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/risk-reports-board-of-directors-decision-basis\/#listItem","position":3,"name":"Risk Reports the Board of Directors Actually Uses","previousItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/category\/regulation-supervision\/#listItem","name":"Regulation &amp; Supervision"}}]},{"@type":"Organization","@id":"https:\/\/swissgrc.com\/en\/#organization","name":"Swiss GRC AG","description":"Swiss GRC delivers Software Solutions for GRC, CLM &amp; BPM, helping businesses worldwide manage risks, ensure compliance, and drive success.","url":"https:\/\/swissgrc.com\/en\/","telephone":"+41412207500","logo":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2023\/06\/Logo_V1_Original_mit_Claim.png","@id":"https:\/\/swissgrc.com\/en\/risk-reports-board-of-directors-decision-basis\/#organizationLogo"},"image":{"@id":"https:\/\/swissgrc.com\/en\/risk-reports-board-of-directors-decision-basis\/#organizationLogo"},"sameAs":["https:\/\/www.twitter.com\/SwissGRC","https:\/\/www.instagram.com\/swissgrc\/","https:\/\/www.youtube.com\/channel\/UCy4QuXYekCQrA4n5oEwJSJg","https:\/\/ch.linkedin.com\/company\/swissgrc"]},{"@type":"Person","@id":"https:\/\/swissgrc.com\/en\/author\/superadmin\/#author","url":"https:\/\/swissgrc.com\/en\/author\/superadmin\/","name":"superadmin","image":{"@type":"ImageObject","@id":"https:\/\/swissgrc.com\/en\/risk-reports-board-of-directors-decision-basis\/#authorImage","url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2023\/01\/logo-red.svg","width":96,"height":96,"caption":"superadmin"}},{"@type":"WebPage","@id":"https:\/\/swissgrc.com\/en\/risk-reports-board-of-directors-decision-basis\/#webpage","url":"https:\/\/swissgrc.com\/en\/risk-reports-board-of-directors-decision-basis\/","name":"Risk Reports the Board of Directors Actually Uses","description":"Risk reporting to the board of directors: how reports show risk interdependencies and courses of action instead of simply being filed away.","inLanguage":"en-GB","isPartOf":{"@id":"https:\/\/swissgrc.com\/en\/#website"},"breadcrumb":{"@id":"https:\/\/swissgrc.com\/en\/risk-reports-board-of-directors-decision-basis\/#breadcrumblist"},"author":{"@id":"https:\/\/swissgrc.com\/en\/author\/superadmin\/#author"},"creator":{"@id":"https:\/\/swissgrc.com\/en\/author\/superadmin\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/10\/Blogbild-2048x1075-EN.png","@id":"https:\/\/swissgrc.com\/en\/risk-reports-board-of-directors-decision-basis\/#mainImage","width":2048,"height":1075,"caption":"Bar chart with rising bars that stay below the risk capacity line until the last one exceeds it and is marked as a decision. Headline: Acknowledged is not decided."},"primaryImageOfPage":{"@id":"https:\/\/swissgrc.com\/en\/risk-reports-board-of-directors-decision-basis\/#mainImage"},"datePublished":"2026-10-30T16:33:52+01:00","dateModified":"2026-10-31T08:35:13+01:00"},{"@type":"WebSite","@id":"https:\/\/swissgrc.com\/en\/#website","url":"https:\/\/swissgrc.com\/en\/","name":"Swiss GRC - Software Solutions for GRC, CLM &amp; BPM","description":"Governance, Risk & Compliance (GRC)","inLanguage":"en-GB","publisher":{"@id":"https:\/\/swissgrc.com\/en\/#organization"}}]},"og:locale":"en_GB","og:site_name":"Swiss GRC | Governance, Risk &amp; Compliance (GRC)","og:type":"article","og:title":"Risk Reports the Board of Directors Actually Uses","og:description":"Risk reporting to the board of directors: how reports show risk interdependencies and courses of action instead of simply being filed away.","og:url":"https:\/\/swissgrc.com\/en\/risk-reports-board-of-directors-decision-basis\/","og:image":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/10\/Blogbild-2048x1075-EN.png","og:image:secure_url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/10\/Blogbild-2048x1075-EN.png","og:image:width":2048,"og:image:height":1075,"article:published_time":"2026-10-30T15:33:52+00:00","article:modified_time":"2026-10-31T07:35:13+00:00","twitter:card":"summary_large_image","twitter:site":"@SwissGRC","twitter:title":"Risk Reports the Board of Directors Actually Uses","twitter:description":"Risk reporting to the board of directors: how reports show risk interdependencies and courses of action instead of simply being filed away.","twitter:creator":"@SwissGRC","twitter:image":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/10\/Blogbild-2048x1075-EN.png","twitter:label1":"Written by","twitter:data1":"superadmin","twitter:label2":"Est. reading time","twitter:data2":"7 minutes"},"aioseo_meta_data":{"post_id":"70969","title":"Risk Reports the Board of Directors Actually Uses","description":"Risk reporting to the board of directors: how reports show risk interdependencies and courses of action instead of simply being filed away.","keywords":null,"keyphrases":{"focus":{"keyphrase":"risk reporting board of directors","score":76},"additional":[{"keyphrase":"Art. 716a CO risk oversight","score":69},{"keyphrase":"FINMA circular risk management","score":74},{"keyphrase":"Swiss Code risk assessment","score":94},{"keyphrase":"risk appetite board of directors","score":74},{"keyphrase":"Three Lines Model","score":74}]},"primary_term":null,"canonical_url":null,"og_title":"Risk Reports the Board of Directors Actually Uses","og_description":"Risk reporting to the board of directors: how reports show risk interdependencies and courses of action instead of simply being filed away.","og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":"Risk Reports the Board of Directors Actually Uses","twitter_description":"Risk reporting to the board of directors: how reports show risk interdependencies and courses of action instead of simply being filed away.","schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"BlogPosting","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"seo_analyzer_scan_date":"2026-10-31 07:35:29","breadcrumb_settings":null,"limit_modified_date":false,"open_ai":null,"ai":{"faqs":[],"keyPoints":[],"schemas":[],"titles":[],"descriptions":[],"socialPosts":{"email":{"subject":"","preview":"","content":""},"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"created":"2026-10-26 16:41:17","updated":"2026-10-31 07:35:29","focus_keyword":"risk reporting board of directors","additional_keywords":[{"word":"Art. 716a CO risk oversight","score":69,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":6},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":6}}},{"word":"FINMA circular risk management","score":74,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":6}}},{"word":"Swiss Code risk assessment","score":94,"items":{"introductionKeyword":{"score":9},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":9},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":6}}},{"word":"risk appetite board of directors","score":74,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":6}}},{"word":"Three Lines Model","score":74,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":6}}}],"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/swissgrc.com\/en\/\" title=\"Home\">Home<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/swissgrc.com\/en\/category\/regulation-supervision\/\" title=\"Regulation &amp; Supervision\">Regulation &amp; Supervision<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\tRisk Reports the Board of Directors Actually Uses\n<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/swissgrc.com\/en\/"},{"label":"Regulation &amp; Supervision","link":"https:\/\/swissgrc.com\/en\/category\/regulation-supervision\/"},{"label":"Risk Reports the Board of Directors Actually Uses","link":"https:\/\/swissgrc.com\/en\/risk-reports-board-of-directors-decision-basis\/"}],"_links":{"self":[{"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/posts\/70969","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/comments?post=70969"}],"version-history":[{"count":2,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/posts\/70969\/revisions"}],"predecessor-version":[{"id":71069,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/posts\/70969\/revisions\/71069"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/media\/71068"}],"wp:attachment":[{"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/media?parent=70969"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/categories?post=70969"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/tags?post=70969"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}