What an incident review shows that an annual report cannot

An annual report is a statement of outcome. An incident review is a record of choice. This distinction matters more than most boards recognise. When a breach occurs, when a trade fails, when a client complaint escalates beyond normal handling, the firm produces two documents. The annual report will not mention it. The incident review will describe it in forensic detail. The report tells you what the firm did. The review shows you how the firm thinks.

I have sat through incident reviews where the timeline was so precise, the handover so clearly documented, and the decision-making so transparent that I knew immediately this was a firm that had spent years building real discipline. I have sat through others where the narrative collapsed at critical moments, where key people could not remember who said what, where accountability scattered like smoke. The difference between these two firms was not their size, their capital base, or their age. It was the quality of their operating habit when things went wrong.

The FCA Approved Person framework requires senior leadership to take responsibility for the firm's management of risk. The words are familiar to anyone in a regulated environment. But the substance lives in incident reviews. How quickly does the firm identify what happened. What does it decide to escalate and why. Does it spot a systemic issue or treat the event as an isolated lapse. Does it ask the question that matters: what was the condition that allowed this to happen in the first place.

The annual report will show you board composition, dividend policy, and the regulatory ratios the firm must hit. An incident review will show you whether the people on that board actually speak to each other when the stakes matter. It will show you whether a junior trader feels safe raising a concern or whether fear runs downward. It will show you whether the compliance function has teeth or is managed around like an inconvenience. These are the questions that determine whether a firm is genuinely governed or merely compliant.

I have learned to ask for incident reviews before I join a board or accept an advisory role. Not all of them. The ones that touch the core of the business. The ones where something material went wrong and the firm had to respond. What I am looking for is not perfection. No firm is perfect. I am looking for whether the response was honest. Whether the analysis was thorough. Whether the firm asked itself hard questions about its own culture and came back with real answers. That tells me more about the board's actual quality than any presentation of financial metrics.

The work of governance lives in small moments. A board pack that is honest about weakness. A management team that does not hide bad news. A compliance officer who is heard when she disagrees. An incident review is the moment when all of this either shows up or disappears. It is where the gap opens between the firm the annual report describes and the firm that actually operates. Read it carefully. That gap is where the real risk lives.

What stays constant across regulated firms is their need to report. What differs entirely is the integrity of their thinking when the rules are tested. The annual report is what the firm wants you to see. The incident review is what you need to understand.