Risk appetite
Also called risk appetite statement, risk appetite framework
Risk appetite is the amount and type of risk a firm's board is willing to accept to achieve its strategy. It is written down in a risk appetite statement with qualitative principles and measurable limits. Management then runs the business inside those limits and reports breaches back to the board.
How it works
The board approves a risk appetite statement each year, usually on the advice of the chief risk officer. It covers credit, market, liquidity, operational, conduct and compliance risk. Each statement is turned into metrics with limits and early warning triggers, such as a capital ratio floor or a maximum number of high-risk customers. Business lines get their own cascaded limits.
Risk appetite links strategy to day-to-day decisions. A bank that states a low appetite for financial crime risk will set tighter onboarding rules and exit customers that fall outside it. Supervisors review whether the framework is used in practice, whether limits are breached and how the board responds. Key risk indicators feed the monitoring.
The rules
Defines risk appetite, risk capacity and risk limits, and sets roles for the board, CEO, CRO and internal audit.
Systemically important financial institutions and their supervisorsRequires bank boards to approve and oversee the risk appetite statement as part of the bank's risk governance framework.
Banks and banking supervisorsCommon questions
What is the difference between risk appetite and risk tolerance?
Risk appetite is the level of risk a firm wants to take in pursuit of its strategy. Risk tolerance is usually the acceptable variation around that level, often expressed as specific limits. Risk capacity is the maximum a firm can absorb before breaching regulatory constraints.
Who sets a firm's risk appetite?
The board sets and approves it. The chief risk officer and risk function draft the statement and metrics. Management runs the business within it, and internal audit tests whether the framework works as designed.
What goes in a risk appetite statement?
A statement typically sets out the firm's principal risks, a qualitative view of how much of each it will accept, quantitative limits and triggers, and who must be told when a limit is breached.
How often is risk appetite reviewed?
Most boards review the statement at least once a year, alongside strategy and capital planning. Metrics are monitored monthly or more often, and limits can be changed sooner after major events.
