ERM Dashboard Reporting: From Data to Decisions (Chapter 25)
Book: Enterprise Risk Management: From Incentives to Controls
Author: James Lam
ISBN: 978-1-118-41361-6
Chapter 25 closes the implementation section with dashboard reporting. Risk transparency is a core ERM goal. A 2011 Deloitte survey of 1,500 executives ranked “risk information reporting” as the #1 priority among 13 risk initiatives (86% said high or moderate priority).
But most companies build reporting from the bottom up. They start with data sources and models, then try to produce reports. Lam says flip it. Start from the top. Define what decisions need to be made, then build the metrics and systems to support them.
Five Questions a Dashboard Should Answer
A board-level ERM dashboard should answer these in minutes, not weeks:
1. Are any business objectives at risk? Organize risk information (metrics, assessments, early warnings) around strategic objectives. Green/yellow/red indicators show whether each objective is on track, threatened, or off track. Drill down for details.
2. Are we in compliance with policies, regulations, and laws? A compliance monitor with traffic-light signals. Full compliance (green), near violation (yellow), in violation (red). Drill down to detailed compliance metrics.
3. What risk incidents have been escalated? Real-time escalation of critical incidents based on thresholds (customer impact, financial exposure, reputational impact). Sensitive incidents push alerts to computers and phones.
4. What KPIs, KRIs, or early warnings need attention? Quantitative metrics with thresholds and risk tolerance levels. Trend analysis and expert commentary on the most important ones.
5. What risk assessments need review? Executive summaries of top-down assessments, RCSAs, regulatory exams, and audit reports. Green/yellow/red vs. board expectations. Full reports available for drill-down.
Traditional vs. Dashboard Reporting
| Feature | Traditional | Dashboard |
|---|---|---|
| Analysis | Siloed by risk type or business unit | Integrated by objective or scenario |
| Information | Historical, internal | Forward-looking, internal + external |
| Flexibility | Trade-off between summary and detail | Drill-down eliminates the trade-off |
| Questions | “What if commodity prices drop?” | “So what? What should we do?” |
| Interaction | Reading a book (page by page) | Searching Google (filter and find fast) |
Traditional reporting is data-driven. Dashboard reporting is action-driven.
Real-World Dashboard Examples
CNN Magic Map (2008+): Election night map showing state-by-state voting. Click a state for district data, demographics, historical patterns. High-level view plus granular detail on demand.
GE’s Cockpit: GE Capital runs multiple customized dashboards per business unit. Managers see daily/weekly/monthly sales, loan defaults, customer service lags. Campbell at GE Consumer and Industrial checks his dashboard first thing every morning for a global view.
By 2006, roughly 40% of the 2,000 largest companies had some form of dashboard reporting.
Implementation Steps
1. Assess Decision-Making Needs
Review risk policies, committee charters, existing reports, and performance goals. Interview board members and managers. Build a paper prototype dashboard and circulate for feedback.
2. Develop KRIs
Sources for effective KRIs:
- Policies and regulations (exposures vs. limits)
- Strategies and objectives (downside risk, not just expected performance)
- Previous losses and incidents (loss/event databases)
- Stakeholder requirements (rating agencies, analysts, customers)
- Risk assessments (RCSAs, audit findings, SOX tests)
Ten characteristics of good KRIs:
- Consistent methodologies
- Incorporate exposure, probability, severity, correlation
- Quantifiable ($, %, or #)
- Time series tracked against limits
- Tied to objectives, owners, and risk categories
- Balance of leading and lagging indicators
- Useful for management decisions
- Benchmarkable internally and externally
- Timely and cost effective
- Simplify risk without being simplistic
Quality over quantity. VaR and economic capital incorporate all four risk drivers.
3. Define Dashboard Functionality
- Basic and advanced statistics (mean, max, min, std dev, correlations, regressions)
- Linkage between qualitative and quantitative data
- Risk accountability tracking (escalation violations, ownership, mitigation projects)
- Role-based customized reporting (board vs. executives vs. business managers)
4. Avoid Four Common Pitfalls
Don’t just integrate risks. Break down silos. Dashboards should unify oversight functions (risk, audit, compliance, legal, treasury) into one enterprise view.
Don’t boil the ocean. You can’t identify all risks (the list is infinite). Focus on critical risks for key decision makers. Success means “we identified the major risks requiring management attention,” not “we documented 720 risks.”
Don’t just tell me, show me. Balance qualitative assessments with quantitative KRIs showing trends, risk-adjusted metrics, and compliance with limits.
Don’t produce 50-page reports. Board members can’t see the forest for the trees. High-level view first, drill-down on demand. Advanced dashboards could even run real-time scenario analysis (“What if oil prices rise 30%?”).
Where Reporting Is Headed
The last decade focused on risk quantification (VaR, credit models, etc.). The next shift is risk communication. Enterprise-wide reporting will move from monthly to weekly to daily to real-time.
The value of risk information isn’t in creating it. It’s in applying it. Deliver the right information to the right decision makers at the right time.
That wraps up the implementation chapters. The final post in this series pulls together the whole book.
Previous: Risk-Based Decision Making | Next: Enterprise Risk Management Series Wrap-Up