The firm should report a more detailed and extensive set of key risk indicators to the board of directors than it does to business line managers to support the board's strategic risk review.

The operational risk committee should be responsible for executing all necessary changes to the firm's risk exposures after risk reports are reviewed.

The central operational risk function should be responsible for aggregating information from each of the business units about operational risk exposures.

The firm should emphasize forward-looking risk indicators and avoid the use of backward-looking indicators in its risk reporting.