Operational Risk Dashboard: Incidents and Losses

An operational risk dashboard compares recorded incidents, losses, and overdue actions across business units. It should make the reporting boundary clear enough that a manager can move from a summary number to the underlying incident, loss posting, or action record.

Define what the dashboard measures

The dashboard describes supplied records. Incident count measures reported events. Gross loss measures recognized loss amounts under the company's reporting policy. Recovery measures amounts recognized as recovered, and net recorded loss is their difference. Open and overdue actions describe the follow-up workload at a stated cutoff.

Those measures do not establish the probability of the next incident. NIST's risk glossary describes risk in terms of potential events, adverse impact, and likelihood. A table of recorded incidents provides evidence for a discussion, but cannot supply those judgments on its own.

Use an operational dashboard for broader process performance. A risk management dashboard has a wider brief than this descriptive review of recorded incidents and their follow-up work.

Keep incidents, money, and actions at separate levels

The incident export needs a distinct incident ID, business unit, event category, occurrence date, and reporting date. A near miss can remain in the incident count with no recognized loss, provided its classification is visible.

The loss export needs a posting ID, incident ID, posting date, amount in USD, and a flag distinguishing gross loss from recovery. Keep estimates and recognized amounts separate. If an incident has several postings, sum the money but count the incident ID once.

The action export needs an action ID, incident ID, owner, due date, status, and closure date. Several actions can belong to one incident. Joining every action to every loss posting and then summing the resulting table can multiply both the dollars and the workload.

Choose the time basis before the review. Incidents reported during a period are a flow; open actions at the cutoff are a stock. Recognized losses by posting month and losses attached to incidents reported that month are different views. Label them separately when older incidents receive new postings.

Work the recorded losses by unit

Consider a fictional US distributor reviewing October 1 through October 23, 2026. In this compact example, all listed incidents were reported during that window, all associated amounts were recognized during the same window, and there are no postings for older incidents. The table consolidates each incident's recognized amounts before any action records are considered.

Net recorded loss = Gross recognized loss - Recognized recovery

The check is 25,000 - 3,500 = 21,500. There are five distinct incidents, including four with recognized gross loss and one near miss. Keeping the near miss visible avoids treating a zero-dollar record as a missing event.

Distribution's net loss is 10,000 + 3,000 = $13,000. Its share of the total is 13,000 / 21,500 = 60.5%, rounded to one decimal place. That identifies a concentration of recorded loss in this file; it does not prove Distribution has the greatest future exposure.

Measure overdue work using a fixed cutoff

The following action export is reviewed at the end of October 23, 2026. An open action is overdue when its due date is earlier than the cutoff date. An action due on the cutoff is due today. An action without a due date has unknown timeliness.

For an open action with a known due date, overdue days equal the greater of zero and cutoff date minus due date. Days are whole calendar days, counted after the due date. Closed actions leave the current open-action denominator, but remain available for a separate completion review.

There are six actions: five open and one closed. Of the five open actions, four have due dates and two are overdue. The overdue rate among open actions with known due dates is 2 / 4 = 50.0%. Show the remaining open action with a missing due date beside that rate; including it as on time would hide uncertainty.

Put the measures together without repeating records

Reconcile each column to its source independently. Incident counts tie to distinct incident IDs, money ties to recognized postings, and actions tie to distinct action IDs. The extra action attached to I01 must not create an extra incident or another copy of its loss.

Use the summary to assign review work. Distribution's owner explains the shipment error and delayed action; Finance resolves the missing due date and its overdue item. Finance also confirms the loss and recovery postings before the reporting owner circulates the review.

NIST's risk-response glossary distinguishes responses such as accepting, avoiding, mitigating, sharing, and transferring risk. Marking an action complete records a task outcome; the responsible people still judge what response is appropriate and whether it worked. Use the distinction between a dashboard, report, and list to pair the summary with the action detail managers need.

Where it goes wrong

• Counting joined rows as incidents. Multiple postings and actions can repeat one event. Count distinct IDs at the correct level.
• Mixing recognition dates with event dates. A later recovery can change a posting-month total without changing the original incident count.
• Treating missing dates as on time. Show unknown timeliness separately and assign someone to resolve it.
• Comparing counts without reporting coverage. A unit that records more events may have better reporting. Confirm coverage before ranking units.
• Treating green status as assurance. A completed action or a quiet month is not evidence by itself that future losses are controlled.

Review your own records in Covirage

Bring your incident register, recognized-loss export, and action file with their IDs and reporting cutoff. Covirage maps the columns; its tools compute and check the figures, and the external AI model explains the results with every figure traced to its rows. Create a free Covirage account and bring a sample of your own data; creating the account takes about a minute.

See Covirage for compliance teams for the supporting business context.