A risk committee report on stress testing should tell the committee five things: which scenarios were run and on what positions, what each cost every portfolio against its limit, which limits were breached and what the portfolio managers propose, what changed since the last meeting, and what the committee is being asked to decide. Behind every figure in it should sit three identifiers a reader can open: the run that produced it, the approved version of the scenario and the date of the positions. That trail is the difference between a report and a slide. Botminds' Stress Testing and Scenario Analysis drafts the committee papers from signed runs only, so every number links to its run, scenario version and as-of date, and the CRO signs before anything is sent.
The examples come from the solution's fictional sample firm, Quillfield Capital, three days before its third-quarter risk committee. The case law is real, and it is the reason the trail matters.
One committee figure and the trail behind it
Figure
Global Balanced Fund loses 312bp of NAV, $443.0M, in the Japan policy shock: 104% of its 300bp limit.
Scenario version
SC-2026-041 version 3, hypothetical, 10-day horizon, 12 factor shocks, each citing a source passage or a historical window.
Approval
Approved into the official set by the CRO on 19 October with reason code A1; drafted by the analyst, who cannot approve.
Run
Preview PR-2026-0419 on all 300 portfolios; the figure is marked provisional until the scenario is approved.
Positions and prices
Positions as of the 16 October close from portfolio accounting; prices from two market data vendors; totals reconciled to NAV.
Limit
300bp of NAV, from the limit register; a change needs the CRO and the committee chair.
Drivers
Short-yen forward overlay −126bp, global equity sleeve −118bp, JGB 20-year −41bp: 285bp of the 312bp.
Seal
Run, scenario version and decision each sealed with a hash on the audit trail, exportable as one evidence file.
What should a risk committee report include?
It should include what the committee needs to judge risk against appetite and nothing it cannot trace. For stress testing that means the official scenario set and any changes to it, the results for every portfolio against its own limit, the breaches with the portfolio manager's response and the CRO's decision, the trend since the last meeting, and the assumptions that drive the numbers. A report that leaves out the assumptions invites the committee to approve a number it cannot challenge.
Rules phrase the same idea as information "reasonably necessary." Under Rule 18f-4 the derivatives risk manager's regular report to the board covers exceedances of the fund's risk guidelines, the results of the stress tests and the results of backtesting since the last report, and "must include such information as may be reasonably necessary for the board of directors to evaluate the fund's response to exceedances and the results of the fund's stress testing" (17 CFR 270.18f-4(c)(3)(iii)). The board sets the frequency; the rule sets the content.
A stress testing section of a risk committee report, in the order a member reads it
- What the committee is asked to decide
Scenarios to approve or retire, limit changes, breaches that reached the committee. On the first page, not the last.
- The official scenario set and what changed
Scenarios added, revised and retired since the last meeting, with the approver and the reason for each.
- Results against limits, every portfolio
Worst loss per portfolio across the set, as basis points of NAV and as a share of its limit, ranked by share of limit, not by size.
- Breaches and the answer to each
The driver positions, the portfolio manager's proposed action and date, the CRO's decision and reason, and anything still open at the committee's escalation point.
- Trend since the last meeting
The same figures for each weekly run in the period, so a member sees a portfolio drifting toward its limit before it gets there.
- Assumptions and their changes
Horizons, correlation windows, how private assets and stale prices were treated, and any override of a challenged shock with its written reason.
- The trail
For every figure: run ID, scenario version, position date. Nothing pasted, nothing rounded by hand.
Board risk report example: one scenario on one page
A worked page makes the template concrete. In the sample firm's third-quarter paper, the page for the new Japan scenario opens with the decision asked of the committee: note the CRO's approval of the scenario into the official set, which replaces a 2024 scenario on yield-curve-control band widening and keeps the set at 40. Below it, the scenario in one line: twelve factor shocks over ten days, the largest a JGB 10-year rise of 80bp, each linked to its source.
Then the results: one portfolio over its limit and six at 90% or more, ranked by share of limit. Global Balanced loses 312bp against 300bp, driven by its short-yen forward overlay; the portfolio manager has two business days to answer and the CRO five more to decide. Then the challenge: two shocks were disputed, one changed and one kept, with the analyst's reason in a sentence and its effect on the breach, which would have remained at the smaller shock. Every number on the page is underlined, and each opens its run, scenario version and position date. Until the scenario was approved, the page was marked provisional, so the committee could see which figures were final.
The Allianz case: stress results changed between the risk system and the reader
The SEC's 2022 order against Allianz Global Investors U.S. is the clearest public account of what goes wrong when stress results can be edited after they are produced. The Structured Alpha strategy's risk reports, prepared by an affiliate, "contained various stress test results that modelled the impact of changes in the market on Structured Alpha," including the scenario the team called its touchstone (SEC order 34-94927). Certain investors asked for the reports and, the order found, relied on them. Then the portfolio management team changed them before they went out.
The order's numbers are specific. The alterations "were generally designed to limit losses to approximately -10%"; one market-crash loss went from about −25.74% to −9.74%. "Bond-Nelson made over 200 alterations to data contained in IDS Risk Reports, and the portfolio management team caused at least 87 altered reports to be sent to certain investors or prospective investors." AGI US admitted the facts in the order, with stated exceptions, and agreed to pay more than $1 billion to settle the SEC's charges as part of a global resolution (SEC press release 2022-84).
The Allianz order in three numbers
200+
alterations to data in the stress risk reports
87
altered reports sent to investors or prospective investors, at least
$1B+
paid by AGI US to settle the SEC's charges, within a wider global resolution
Defendants reduced losses under a market crash scenario in one risk report sent to investors from negative 42.1505489755747% to negative 4.1505489755747% -- by simply dropping the single digit 2.
SEC press release 2022-84, describing the complaint's allegations
Those were reports to investors, not to a committee, but the mechanism is the same one a risk committee depends on: a number produced by a risk system, copied into a document by a person, and read by someone who cannot see the system. Every copy is a chance to change it, by error or by design. The defence is not a more careful copier. It is a paper whose figures are pulled from a sealed run and carry its identifiers, so that an edited number no longer matches anything.
What do the rules require a board or committee to receive?
The rules differ by fund type and jurisdiction, but they converge on three things: regular results, the assumptions behind them, and records that outlast the meeting. None of them prescribes a template; all of them assume the figures can be reconstructed later.
Stress testing reports that fund rules require, and what each must carry
| Rule | Who reports to whom | What the report must carry | How long the records last |
|---|---|---|---|
| SEC Rule 18f-4 (funds using derivatives) | The derivatives risk manager to the fund board, at a frequency the board sets | Analysis of guideline exceedances, stress test results and backtesting results since the last report, with what the board needs to evaluate them | Stress test results and board reports: at least five years, the first two easily accessible |
| SEC Rule 2a-7 (money market funds) | The adviser to the board, at its next regularly scheduled meeting, or sooner if the results warrant | Test dates, an assessment of the fund's ability to hold its liquidity and limit principal volatility, events reasonably likely within the following year, and a summary of the significant assumptions | Board considerations and actions: six years, the first two easily accessible |
| CESR/10-788 (UCITS using VaR) | The risk management function to senior management | Stress test results monitored and analysed by risk management; completed tests and results clearly documented; reasons for any deviation from the program | Documented and traceable; the guidelines set no period |
| EU MMF Regulation, Art. 28 (money market funds) | The manager to the board, then to the national regulator, which sends it to ESMA | Where a test reveals a vulnerability: an extensive report with the results and a proposed action plan, which the board may amend and must approve | Report and action plan: at least five years |
The money market fund rule asks for the most specific content: an assessment of "the fund's ability to withstand the events (and concurrent occurrences of those events) that are reasonably likely to occur within the following year," and "a summary of the significant assumptions made when performing the stress tests" (17 CFR 270.2a-7(g)(8)(ii)). It is a useful standard for any fund's paper, not only a money market fund's: a result without its assumptions cannot be challenged, and a committee that cannot challenge is only taking notes. Money market fund stress testing covers that regime in full.
How do you prove which run produced a figure?
By making the identifier part of the figure rather than a footnote someone adds. A figure is provable when a reader can open, from the figure itself, the run that produced it, the scenario version it used, the positions date, and the record that the run was not changed afterwards. Anything less depends on someone remembering which spreadsheet was final.
CESR's guidelines put the standard plainly for UCITS: there should be a documented program for each fund, and "the execution the program (including the concrete implementation, the results and consequences) should be traceable documented" (CESR/10-788, explanatory text 71). Traceable is the operative word. In practice it needs four things: immutable run identifiers, scenario versions that never change once approved (a revision is a new version), position and price snapshots stored with the run, and a seal, such as a hash, that would break if a stored result were edited.
Stress Testing and Scenario Analysis: one export with every version, run and decision
Quarterly risk management report to the board: show what changed
A quarterly report earns its place by showing change: which scenarios entered or left the official set, which limits moved, which portfolios drifted toward a limit, and which challenged shocks were kept against the challenge. A report that shows only this quarter's numbers asks the committee to remember last quarter's.
Scenario changes deserve their own discipline. CESR's guidelines ask that "each time the design of the stress tests is changed, both the previous and the modified stress tests should be conducted simultaneously, at least once and the results compared" (CESR/10-788, explanatory text 70). The point is not ritual: without the parallel run, a committee cannot tell whether a portfolio's loss fell because the portfolio changed or because the scenario did. In the sample, the new Japan scenario replaces a 2024 scenario on yield-curve-control band widening, retired because the Bank of Japan ended yield-curve control in March 2024, so the official set stays at 40 and the paper says which scenario left and why.
Who signs the risk committee report, and who must not edit it?
The CRO, or whoever the committee's charter names, signs the report; the people whose portfolios it describes should not be able to change it. That is the plainest lesson of the Allianz order, where the alterations were made by the portfolio management team that the reports were meant to describe. Segregation has to be enforced by the system, not just written in a policy.
In Stress Testing and Scenario Analysis the roles are set as permissions: the analyst drafts and submits scenarios but can never approve one; only the CRO approves, returns or rejects, each with a reason code; a portfolio manager answers breaches on their own funds but never decides them; administrators change settings but approve nothing; and a limit change needs both the CRO and the committee chair. The agent that drafts the committee papers works from signed runs only, flags what changed since the last quarter, never includes an unsigned number and never sends the papers.
The decision the paper reports, made where the evidence is
Where Stress Testing and Scenario Analysis fits, and where it does not
The solution drafts the stress testing sections of the committee papers and the regulatory extracts from the same signed weekly runs: in the sample, thirteen weekly runs from the third quarter feed one paper, and every underlined figure opens its run, scenario version and as-of date. A committee member can ask a question inside the paper before the meeting and see the answer cited to a run. Internal audit can export the whole quarter as one sealed file.
It does not write the committee's other business, decide the committee's agenda or replace the minutes. Firms whose committees cover operational, liquidity and counterparty risk in the same meeting will still assemble those sections from their own sources; the stress testing section is the one this solution makes reproducible. For the weekly mechanics behind the figures, how to stress test a portfolio walks through the seven steps from event to committee.
Questions people ask
What is a risk committee report?
It is the paper a risk committee reads before it meets: the firm's risk positions against its approved appetite and limits, the breaches and how they are being handled, and the decisions the committee is asked to take. For an asset manager, stress testing usually takes one section, alongside liquidity, counterparty and operational risk.
Is there a risk committee report template regulators expect?
The SEC's fund rules and the EU guidelines set content, not a template: Rule 18f-4 requires the stress test results and what the board needs to evaluate them, and Rule 2a-7 adds a summary of significant assumptions. A template built around those requirements, with a trail behind every figure, answers the questions the rules themselves raise.
How long must stress test records be kept?
Under Rule 18f-4, stress test results and the written reports to the board must be kept at least five years, the first two in an easily accessible place. EU money market funds keep the extensive report and action plan for at least five years under Article 28 of the MMF Regulation. Firms may keep them longer by policy; the sample firm keeps seven years.
Should portfolio managers see the report before the committee?
They should see and answer the breaches on their own portfolios, but not be able to change the figures. The Allianz order is the cautionary case: the alterations were made by the portfolio management team, over 200 of them, before the reports reached investors.
How often should a risk committee review stress test results?
The committee's charter sets that; the sample firm's committee meets quarterly, with weekly results available between meetings. The rules set minimums for the tests, not the meetings: weekly stress tests under Rule 18f-4, at least monthly for VaR UCITS under CESR's guidelines, and a board-set interval for US money market funds.