Successful operational risk reporting

The three barriers to effective risk reporting

The challenge with operational risk reporting often goes beyond the commonly cited “blame culture”. Through years of industry experience, we identified three distinct barriers that prevent effective reporting: 

Barrier 1: not knowing what to report 

The first and most fundamental barrier is simply lack of clarity about what is a reportable incident. When you are building your risk culture and you want to encourage your staff to report operational risks, don't assume they are trying to hide information. More often, they simply don't know what criteria determine whether something should be reported. 

This uncertainty creates hesitation and inconsistency. Without clear guidelines, your staff may either under-report (missing valuable risk insights) or over-report (creating noise that obscures important signals). The solution begins with providing specific, actionable guidance on what makes a reportable event in your organisation. 

Barrier 2: complex processes with no perceived value 

Even when people know what to report, they often face reporting processes that are overly complex or time-consuming. When reporting requires navigating complicated systems or filling out lengthy forms, people naturally hesitate – especially if they perceive no direct benefit from their effort. 

As one risk professional aptly described it: “asking the business to report centrally without feeding back the results is like asking people to type on a keyboard without a screen.” The absence of visible outcomes naturally leads to disengagement and reduced reporting quality. 

Barrier 3: fear of blame and additional workload 

The final barrier involves the anticipated consequences of reporting. This includes the often-discussed “blame culture,” where people fear being held responsible for incidents they report. However, it also includes concerns about the extra work that reporting might generate: investigations to conduct, documentation to complete, or corrective actions to implement. 

This barrier remains significant even in organisations that have established a positive risk culture. The solution involves not only creating a supportive environment but also designing efficient follow-up processes that don't unnecessarily burden those who report incidents.

Designing an effective reporting system

Overcoming these barriers requires thoughtful design of your reporting system. Before launching any campaign to encourage staff reporting, consider these three critical design decisions: 

Making reporting easy and valuable 

To overcome the first two barriers – uncertainty about what to report and cumbersome processes – focus on simplification and clear guidance.

Be economical in the information you collect. Follow the golden rule of reporting: the value of information must exceed the cost of collection. 
Collect only the minimum meaningful information needed for effective risk management. This typically includes: 

• Date and time 
• Location or business unit 
• Event description 
• Event type 
• Impact (actual and potential) 
• Immediate response actions 
• Causes and control failures  
• Action plan when needed 

Use structured formatted files like drop-down menus based on your risk taxonomy rather than free-text fields. This not only speeds up reporting but also creates more comparable data for analysis. Consider limiting free-text fields to just one comment section. 

Integrate with existing sources where possible. Rather than creating entirely new reporting processes, leverage data from sources like: 

• General ledger entries 
• Event logs in other services 
• Legal provisions 
• Customer complaints 
• IT incident logs 
• Quality assurance reviews 

This approach not only reduces the reporting burden but can also demonstrate to regulators that your incident database is comprehensive rather than relying solely on voluntary reporting. 

Creating value through effective feedback

To overcome the perception that reporting provides no value to those doing the reporting, implement a robust feedback loop: 

Return analysed information to business units regularly. Show them not only their own incident trends but also comparative data from peer units. This creates value by: 

• Allowing the business departments to verify the information they reported 
• Providing insights from comparison with peers 
• Creating healthy competition between departments for quality 
• Demonstrating that their reporting efforts lead to tangible outcomes 

A simple periodic report showing the number of incidents, their financial impact, and loss-to-income ratios can be highly effective. The loss income ratio – operational losses as a percentage of operating income – provides a useful benchmark for comparison. A typical benchmark across industries is approximately 2%, though this tends to decrease with greater business automation. 

Different approaches for different incidents

Operational risk has a distinct distribution pattern that requires different approaches for different types of incidents: 

Managing mass losses: the power of pattern detection 

"Mass losses" are the numerous small incidents that occur frequently in most organisations. 
For these: 

• Look for patterns that might signal structural problems – the “leaking taps” in your organisation 
• Consider using artificial intelligence for pattern detection across large datasets 
• If no concerning patterns emerge, treat these small incidents as a normal cost of business to be factored into pricing 

Addressing max losses: learning from significant events 

“Max losses” are the rare but significant incidents that can have material impact. For these: 

• Ensure immediate reporting, though this typically happens naturally as these events are too big to hide 
• Conduct thorough root cause analysis (which we will explore further in our article on bow-tie analysis) 
• Develop and track specific action plans to address identified weaknesses 

This dichotomy in operational risk – many small losses and few large ones – demonstrates why average-based metrics can be misleading. Your approach should reflect this reality rather than treating all incidents equally. 

Roles and responsibilities in operational risk reporting 

Clear accountability is essential for effective reporting. Within the Three Lines of Defence model we discussed previously: 

First Line (Business Operations): 

• Has primary responsibility for alerting and reporting incidents 
• Analyses incidents to identify appropriate action plans 
• Implements improvements to address identified weaknesses 

Second Line (Risk Function): 

• Provides guidance and support to business units 
• Ensures consistent reporting standards
• Aggregates and contextualises information for management 
• Provides feedback to business units on reporting trends and insights 

Third Line (Internal Audit): 

• Provides independent assurance and oversight of the reporting process 
• Validates the effectiveness of the reporting system 

This clear categorisation of responsibilities ensures your reporting is comprehensive without creating unnecessary duplication of effort.