Rationalizing an inventory of hundreds of indicators, automating the reporting built on top of it, and leaving a model that is ready for AI

The challenge

The Non-Financial Risk function of an international bank maintained roughly 400 key risk indicators. Most were populated manually, few of them drove a decision, and committee packs were rebuilt by hand every reporting cycle. The team spent its time collating numbers rather than interpreting them.

At the same time, boards and examiners were asking for three things the existing base could not easily demonstrate: risk appetite expressed at divisional level with measurable limits, a lean set of forward-looking indicators with thresholds that trigger escalation, and every figure in a committee paper traceable back to its source, calculation and owner.

The function needed to be able to answer, on demand, why a risk sits outside appetite and what specifically has to change to bring it back. It also wanted a foundation it could later put AI to work on, without that becoming a separate programme.

Our approach

We structured the work in three phases, with the first results produced entirely within the risk management group’s own access, so the function saw value before any platform dependency was on the critical path.

Discover and rationalize. Every indicator was inventoried and assessed against criteria agreed with the client: source accessibility, granularity fit and decision relevance. Each one came out with a clear disposition, whether to retain, redefine or retire it. Survivors were mapped to their systems of record and defined once, consistently, covering definition, calculation, owner, frequency, granularity and thresholds. Thresholds stayed with the business, with metric owners proposing and the risk function agreeing, and both the process and the rationale documented.

Build. A single governed dataset, aligned to the conventions already used for the institution’s enterprise risk reporting, with each calculation defined once and carrying a description, a formula and an owner. Indicator values arrive systematically wherever the source allows, and manual capture is limited to the cases where a person genuinely is the right source. The analytical layer and the risk appetite calculation were built on top, together with the templating and automation of the function’s standing management and committee reporting.

Automate. With the data flowing and the calculations documented, the reporting cycle itself was automated. Monitoring dashboards give a firm-level view by risk type and division, indicator detail with threshold bands and breach history, and a page showing data freshness and completeness, so the state of the data is visible rather than assumed. Committee and board packs are generated from the same dataset as the analysis, which removed the rebuild from every reporting cycle. A quarterly thematic analysis cuts across events, issues, assessments and indicators to show where control weaknesses cluster and which divisions are deteriorating. Around all of it sits the operating layer that turns a build into a function: the indicator lifecycle from proposal to annual threshold review, quality assurance checks, data freshness controls and a model change log.

AI readiness. Because every measure carries a business definition, a formula, a source and an owner, the model is intelligible to more than the people who built it. We extended that into the semantic layer with descriptions and synonyms so that the terms the business uses resolve to the right measures, and validated the model against a question set agreed with the function. The result is a model a natural language assistant can answer from reliably, running on the institution’s own approved tooling and inside its own environment. It is the same discipline that makes the model audit-ready, which is why AI readiness came as an extension of good data governance rather than a project of its own.

Built on what the client already owned

No new licences and no new platform. The analytics layer runs on Power BI against the existing data platform, and was built so the source can move underneath it, from Snowflake today to Databricks when ready, without rebuilding the reporting. The governance layer uses Microsoft Lists for the indicator register, threshold versions and the override log, Power Apps for threshold proposal and approval and for residual manual capture, and Power Automate for routing and reminders. Every decision about an indicator leaves a record.

What it delivers

• A lean, governed indicator set in place of an inventory nobody could defend, with a documented rationale for every indicator retained, redefined or retired.
• Indicator values sourced systematically rather than collected by hand, with data freshness and completeness visible rather than assumed.
• A risk appetite assessment that can be walked backwards, from a divisional rating to the indicators, calculations and source tables behind it, with every expert-judgement override recorded alongside its reason and its approver.
• Committee and board reporting generated from the same dataset as the analysis, rather than rebuilt each cycle.
• Reporting that reconciles with the enterprise-level risk view, because it is built to the same conventions by the same practice.
• A documented, AI-ready model that the business can question in its own language, on the institution’s approved tooling.
• A team whose time shifts from collating data to interpreting it.

Why this worked

Three things made the difference. The business side moved first, so the function saw analytical output in weeks rather than waiting on a platform programme. Delivery was iterative and released wave by wave as sources came online, so nothing waited for a big-bang release. And the work was done by the same practice that supports the institution’s enterprise and financial risk reporting, to the same conventions, which is what makes the numbers hold up next to the firm-level view instead of sitting apart from it.