Build a supplier-risk board report around decisions

An insurer's supplier-risk pack can be accurate and still leave the Board uncertain about what needs its attention. A list of review completions says little about whether claims processing has become more fragile or whether management needs a decision on an unresolved dependency.

Start the report with the changes that matter to the insurer's operations. Then distinguish matters for decision, challenge and information. The supporting inventory can remain available without taking over the front of the pack.

The Australian Institute of Company Directors' guide to reporting to the board (access may be limited) recommends concise executive summaries, clear decision requests and identification of unverified information. Applied to supplier risk, those principles help readers distinguish a change in exposure from a change in the volume of review activity.

This article proposes an internal reporting structure. It is not an APRA template or a complete statement of Board responsibilities.

Write the decision request first

Before compiling metrics, ask the report owner what the Board or committee needs to do. A genuine decision request identifies an action, its consequences and the relevant authority. “Note the report” may be appropriate for an update, but should not conceal a matter management has not resolved.

For example, a fictional insurer has identified a shared dependency across two claims suppliers. Management needs a decision about resources for testing its fallback approach. The pack should state the exposure, what the proposed exercise would establish, the alternatives considered and what remains uncertain.

Avoid implying that the Board's agreement removes management's responsibility to execute and verify the work. Record the accountable executive and how progress will return to the committee.

Build the first page around changed exposure

A useful opening page can contain four short sections:

1. What changed. New or changed arrangements, significant service issues, test findings or dependencies that affect the risk picture.
2. What that means. The critical operations affected, existing controls and important uncertainty.
3. What requires attention. Decisions sought, overdue material actions and matters outside the relevant risk appetite or tolerance settings.
4. Who will act. Accountable owners, milestones and the next evidence expected.

This arrangement follows a reader's questions. It also makes it harder for a high review-completion percentage to obscure a significant unresolved issue.

CPS 230 requires the Board to review material-provider risk and performance reporting. CPG 230 supports targeted, timely information for Board decisions. The specific sections above are an editorial suggestion for delivering useful information.

Give every metric a definition

“Assessments complete” needs a denominator, reporting period and definition of completion. Does completion mean a questionnaire was received, a reviewer reached a decision or required actions were verified? Each measures something different.

Use a small set of metrics that answer a decision-relevant question. Examples include material arrangements with overdue significant remediation, dependencies with untested fallback assumptions, or recurring service issues affecting a critical operation. The selection and thresholds should follow the insurer's own risks and governance.

Alongside each metric, specify the population, treatment of missing information, comparison period and reason for any change in methodology. If the register has been cleaned up and the denominator changed, explain that before presenting a trend.

Do not average unlike scores into a reassuring overall number. One unresolved issue in a highly relied-on claims service can deserve more attention than many completed low-consequence reviews. The report should allow that issue to remain visible.

Work one issue from signal to decision

In the fictional insurer, two suppliers report satisfactory individual service performance. A dependency review finds they use the same external scheduling platform. Neither supplier has demonstrated how it would allocate work if that platform were unavailable.

The report should avoid claiming that both suppliers will fail together; the evidence does not establish that. It can state that a shared dependency has been identified and that the fallback assumption remains untested.

The proposed action is a scoped exercise with the suppliers and the insurer's claims team. Management explains the intended learning, the resources requested and how it will assess the result. It also identifies the interim monitoring and escalation arrangements while the question remains open.

In the next pack, progress should be measured against that question. “Meeting held” is useful activity information, but the Board still needs to know whether a practicable fallback was demonstrated and what gaps remain.

Keep the appendix traceable

Give significant issues stable identifiers. Link them to the affected arrangement, supporting evidence, management response and decision history. Readers should be able to move from a front-page statement to the underlying record without searching several folders.

Summarise sensitive details at the appropriate level and control access to supporting material. A committee pack may not need raw supplier security findings or customer-level information to understand the operational consequence.

The evidence checklist can help organise those supporting records. The Board report should interpret their significance rather than reproduce every document name.

Review the pack as a reader

Before circulation, ask someone outside the drafting process to identify the three matters requiring most attention and explain why. If they select different matters from the accountable executive, examine whether the structure or wording is obscuring the intended message.

Check that every requested decision has a recommendation, options where relevant, uncertainty and a clear owner. Remove stale issues that have genuinely closed, while preserving the evidence of closure in the underlying record. Bring recurring concerns forward when their consequences have changed.

Where review capacity is part of the decision, the review-prioritisation guide shows how to make urgency, consequences and deferrals explicit.

The finished pack should make the next meeting easier to prepare for: members can see what changed, what they are being asked to decide and what evidence management will bring back.