Risk reports tend to grow. Each new regulation adds a table, each incident adds a chart, and before long the pack is thirty pages that nobody has time to read before the meeting. Yet the board’s responsibility has not changed: it must be able to show that it understood the fund’s risks and challenged the people managing them. Supervisors are increasingly looking for evidence of that challenge in the minutes.
The questions below are designed to be asked of any risk report. They are grouped roughly in the order a director would read the pack: position first, then models, then liquidity, then the quality of the information itself.
Are we inside every limit, and which limits are they?
The summary page should list every regulatory limit and every internal limit the board has approved, with current usage against each. The distinction matters: a fund can be well within its UCITS limits while breaching its own internal caps, and the board set those caps for a reason.
Look for: one table covering both regulatory and internal limits, with headroom shown.
What is getting closer to a limit?
A limit at 70% of its cap is fine; a limit that has moved from 40% to 70% in two months is a conversation. Good reports show direction of travel, not just a snapshot, so the board can act before a breach rather than after one.
Look for: trend indicators or prior-period comparisons on the key limits.
What happened between meetings, and who knew when?
The report should record every breach, warning-level event and near miss since the last meeting, when each was identified, who was told and what was done. A breach reported for the first time in a quarterly pack suggests the escalation process is not working.
Look for: an events log with dates of identification, escalation and resolution.
Does the VaR model actually work?
Value at risk is only useful if it is tested. Backtesting compares the model’s predicted losses with what actually happened. At a 99% confidence level, a model should be exceeded on roughly one day in a hundred. Too many exceptions mean the model understates risk; the report should say how many there were, how that compares with what was expected, and what the risk manager concluded.
Look for: the number of backtesting exceptions, the expected number and a clear conclusion.
Do the different measures agree, and if not, why not?
Most reports show more than one risk measure, for example historical and parametric VaR. They will rarely match, and the gap is informative: if historical losses are larger than a normal-distribution model predicts, the fund has fatter tails than the model assumes. The commentary should explain the difference rather than simply present both numbers.
Look for: commentary that interprets differences between measures, not just reports them.
What would hurt us most?
Stress tests should be relevant to the fund’s strategy, not a generic list. A fund concentrated in one sector or currency needs scenarios that hit that exposure. The most useful single number is often the reverse stress test: what move would breach our hard limits? If the answer is a move the market has seen before, the board should know.
Look for: strategy-specific scenarios, a reverse stress test, and a clear statement of which scenarios breach which limits.
Could we meet redemptions in a bad week?
Liquidity stress testing should combine both sides of the balance sheet: how quickly the assets could be sold under stress, and how concentrated the investor base is. For open-ended funds, the report should also show which liquidity management tools the fund has selected and how they would be triggered. From April 2027, all existing EU UCITS and open-ended AIFs need that calibration evidenced.
Look for: asset liquidity buckets, largest investors or nominees, stress results, and the LMT activation thresholds.
Do the numbers agree with everything else we see?
Boards receive figures from several sources: the risk report, the factsheet, the investment manager’s presentation, the administrator’s NAV pack. The same concentration, exposure or performance figure should not appear with different values in different documents. Inconsistencies are usually innocent, a different date or share class, but each one should be explained.
Look for: stated valuation dates, share classes and sources on every figure.
Where did the data come from, and who checked it?
A risk report is only as good as its inputs. Directors should know whether positions come from the administrator or the portfolio manager, whether they are reconciled to the custodian, and whether prices are tested for staleness. Independence matters here: figures calculated by the team managing the portfolio are not independent risk measurement.
Look for: a data sources note, reconciliation status and confirmation of independence from portfolio management.
What does the risk manager actually think?
The most valuable page in a risk report is often the shortest: the risk manager’s own view of what has changed, what they are watching and what, if anything, they recommend the board does. A report that is all charts and no judgement leaves the board to do the risk manager’s job.
Look for: a signed commentary with a clear view and, where needed, a recommendation.
Using the questions in practice
Few reports will answer all ten perfectly, and that is not the point. The questions give a board a consistent way to challenge, and a record in the minutes that it did so. If the current report cannot answer several of them, that is itself a finding worth raising with the risk manager, and, for Maltese fund managers, worth including in the gap analysis the MFSA has asked for following its September 2026 outsourcing review.
Further reading
- MFSA, Dear CEO letter on outsourcing by fund managers, 14 September 2026.
- ESMA, Guidelines on liquidity stress testing in UCITS and AIFs.
- ESMA, Guidelines on liquidity management tools of UCITS and open-ended AIFs.
This article is for professional investors, fund boards and service providers. It is a general commentary, not legal, regulatory or investment advice, and does not reproduce the full text of any regulatory document; readers should refer to the source documents and take their own advice. ACM Europe Limited, trading as Navigate Portfolio Advisers, is authorised and regulated by the Malta Financial Services Authority. Company number C 26673. Registered office: Nu Bis Centre, Mosta Road, Lija LJA 9012, Malta.
