Curriculum·G406 Audit, Reporting, and the Board·about 33 min

Communicating risk to a board

By the end of this lesson you can

  • Explain that a board can only govern a risk it has been given an accurate picture of
  • Describe how Wells Fargo's sales-practice risk was minimized on its way up to the board
  • Reason that risk communication must convey scale and consequence, not a reassuring summary
  • State that whoever reports risk upward owes the board the true picture, not the comfortable one

Graduate · enrolled learners

This lesson opens with Wells Fargo sales-practice failures, surfacing 2016.

What happened
For years Wells Fargo pushed employees to hit aggressive sales targets, and to meet them staff opened large numbers of accounts customers had not authorized. The problem was known inside the bank well before it became public in 2016, but as it moved up the organization it was minimized: framed as an issue of a few bad employees rather than a systemic consequence of the sales pressure, and its scale was not conveyed to the board with the seriousness it warranted. An independent investigation commissioned by the bank's own directors later found that management had downplayed the matter and been slow to give the board an accurate picture, so the board could not govern a risk it had not truly been shown. When it surfaced, the cost was enormous: reputational damage, leadership removal, and, in 2020, a 3 billion dollar resolution with US authorities. The risk had existed and been visible internally the whole time; what failed was its communication upward in a form the board could act on.
The decision point
A board governs an institution's risks, but it can only govern a risk it has been given an accurate picture of, which makes the communication of risk upward a control in its own right, as load-bearing as the risk management beneath it. The failure Wells Fargo teaches is not that the risk was unknown; it was known inside the bank for years. The failure is that as it traveled upward it was minimized, reframed as small, and stripped of its true scale, so the board received a reassuring summary instead of the real picture and could not act on what it did not truly see. So the discipline is that risk communication to a board must convey scale and consequence honestly, what could go wrong, how large it is, and what it would cost, rather than a comfortable version that protects the messenger or the quarter. Whoever reports risk upward owes the board the true picture and not the palatable one, because a board governing on a minimized account is governing a different, smaller risk than the one the institution actually carries, and the gap between them is exactly where a Wells Fargo happens.
Recorded loss
$3,000,000,000

What you will be able to answer

  • What failed in Wells Fargo, regarding the board?
  • Why is communicating risk to a board a control in its own right?
  • What must risk communication to a board convey?
  • What does whoever reports risk upward owe the board?

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.

Sources and review

Confidence high·Volatility low·Reviewed 2026-09-16·Owner unassigned

Contested

The 3 billion dollar figure is the 2020 resolution with US authorities; other fines, remediation and civil settlements added to the total cost, and the reputational cost is not captured by any figure. The lesson uses the resolution for scale, not as the complete cost.

The finding that management minimized the risk on its way to the board comes from an investigation commissioned by the bank's own independent directors; the precise degree of board knowledge at each stage was examined in detail there and the lesson uses the finding at that level, not a claim about any individual.