By the end you will be able to
- 1Describe the board's duties for risk in a bank or insurer.
- 2Explain the role of the board risk committee and how it differs from the audit committee.
- 3Tell board work from management work, and choose how a board should respond to a risk report.
- 4Compare unitary and two-tier boards in the US, EU, UK and Asia-Pacific.
Why it matters
Silicon Valley Bank had a board of experienced directors and a board risk committee. In April 2023 the Federal Reserve concluded that its board and management had failed to manage the bank's risks. Having a board is easy. Having one that does its job is not.
Core explanation
Oversee, challenge, hold to account
A company's board of directors is elected by its shareholders to set direction and to oversee the people who run the business day to day. Some directors are executives, such as the chief executive (CEO) and the chief financial officer. Most, in a bank, are non-executive directors, and many of those are independent.
Think of a ship. Management steers and runs the engines. The board decides where the ship is going, how rough a sea it may sail into, and who the captain is, and it checks the course regularly. A common shorthand is “noses in, fingers out”: directors should know what is going on, but should not run the business themselves.
Banks are special. A bank's failure hurts depositors, other banks and the economy, not only its shareholders. So the Basel Committee's Corporate governance principles for banks (2015) ask bank boards to weigh the interests of depositors and the wider system too. The board's risk duties, in short:
| Duty | What it means in practice |
|---|---|
| Approve strategy and risk appetite | Decide, with the CEO and CRO, what risks the firm takes and how much. |
| Approve the risk framework | Make sure there are clear roles, limits and policies, and that they are followed. |
| Oversee management | Appoint the CEO, approve the appointment and removal of the CRO, and hold executives to account. |
| Set the tone | Lead the firm's values and risk culture, by example as well as by policy. |
| Resource the control functions | Make sure risk, compliance and internal audit have the stature, people and access they need. |
| Oversee pay | Make sure pay rewards sound risk-taking, not short-term revenue alone. |
Sort itBoard or management?
Who should do each task in a well-governed bank?
Approve the bank's risk appetite statement.
Set the daily value-at-risk limit for the euro rates desk.
Approve the dismissal of the Chief Risk Officer.
Decide whether to lend €20 million to a property developer.
Ask why the risk function has not grown while the business doubled.
Write the procedure for escalating a limit breach.
Effective challenge. A board that nods everything through is worse than useless: it gives false comfort. Directors need enough knowledge of banking and risk, collectively, to ask hard questions, and enough independence to keep asking when the answers are vague. Supervisors call this effective challenge, and they look for evidence of it in board minutes.
Committees. A full board cannot read every report, so it delegates detailed work to committees. The BCBS principles require audit, risk and compensation committees at systemically important banks and strongly recommend them elsewhere. Most banks also have a nomination committee for board appointments.
Risk committee
Looks forward. Advises the board on risk appetite and strategy, reviews risk reports against appetite, oversees the CRO and the risk function, and challenges management on emerging risks.
Audit committee
Looks back. Oversees financial reporting, internal controls, internal audit and the external auditor.
Remuneration committee
Sets pay policy and senior pay, ideally with input from the risk committee on whether risk was managed well.
Nomination committee
Finds and proposes new directors, and checks the board's mix of skills.
What the BCBS asks of a bank's risk committee (2015, paragraph 71)
- Distinct from the audit committee.
- Chaired by an independent director who is not the board chair or the chair of any other committee.
- A majority of independent members, with experience in risk management.
- Receives regular reports from the CRO, who has direct access to it.
Your turnYou chair the board risk committee
Four items in this quarter's pack. Choose the committee's response.
Liquiditygreen
The liquidity coverage ratio has stayed well above the board's appetite all quarter. No trend change.
Commercial property lendingamber
Exposure has risen for three quarters in a row and is close to its appetite limit. Management says demand is strong and the loans are well secured.
Risk function resourcesred
The business has grown 40% in two years; the risk function's headcount is flat and two senior risk roles are vacant.
Request from the CROamber
The Chief Risk Officer asks to meet the committee without executives present at the next meeting.
0 of 4 answered · 0 as a strong committee would
Board models around the world. The duties are the same everywhere; the structures differ.
ExploreFour ways to organise a board
Click a model to see where it is used and how risk oversight fits in.
Unitary, chair separate
One board of executives and non-executives. Codes of practice expect the chair and the CEO to be different people, and most directors to be independent. Bank supervisors expect a separate board risk committee.
Worked example
A risk committee meeting, step by step
A mid-sized Australian bank has grown its lending to property developers quickly. Follow its board risk committee through one quarter.
From report to decision
Step 1 of 5- 1
Read the pack
The CRO's report shows developer lending at its amber threshold, up for the third quarter in a row. Everything else is green.
Regulatory lens
- Global: BCBS Corporate governance principles for banks (2015), principles 1 to 3 on the board, its qualifications and its committees. The IAIS Insurance Core Principles set similar expectations for insurers' boards.
- EU: the Capital Requirements Directive requires significant institutions to have a risk committee of non-executive members; EBA guidelines on internal governance fill in the detail.
- UK: the chair of the risk committee is a Senior Manager Function under the Senior Managers and Certification Regime, so one named person is accountable for that role.
- US: the Federal Reserve's enhanced prudential standards (Regulation YY, 2014) require large bank holding companies to have a risk committee chaired by an independent director, with at least one member experienced in risk management at large firms.
- Asia-Pacific: APRA's CPS 510 requires Australian banks and insurers to have a board risk committee; the Monetary Authority of Singapore and the Hong Kong Monetary Authority set similar expectations in their corporate governance guidelines.
Sparks
SparkBoards that could not add up
SparkWorkers in the boardroom
Key takeaways
- The board sets direction and oversees management; management runs the business. Noses in, fingers out.
- Board risk duties: approve strategy and risk appetite, approve the framework, oversee and resource the control functions, set the tone, oversee pay.
- The board risk committee looks forward at risks against appetite; the audit committee looks back at reporting and controls.
- BCBS (2015): the risk committee should be separate from audit, chaired by an independent director, mostly independent, with direct access from the CRO.
- Structures differ (unitary in the UK and US, two-tier in Germany, a choice in Japan), but the duties are the same.
Reaction
Check what stuck
Question 1 · objective 1
Which of these is a job for the board rather than for management?
Question 2 · objective 2
Under the BCBS 2015 principles, who should chair a bank's board risk committee?
Question 3 · objective 2
How does the risk committee's focus differ from the audit committee's?
Question 4 · objective 4
In a German bank with a two-tier board, who oversees the executives?
Question 5 · objective 3
A risk report shows commercial property lending close to its appetite limit after three quarters of growth. What should the risk committee do first?
Glossary
- Board of directors
- The group of directors, elected by shareholders, that sets a company's direction and oversees its management.
- Non-executive director
- A director who is not an employee of the firm and does not run any part of it.
- Independent director
- A non-executive director with no material ties to the firm, its management or major shareholders that could cloud their judgement.
- Board committee
- A smaller group of directors that does detailed work for the board in one area and reports back to it.
- Risk appetite
- The amount and types of risk a firm is willing to take to meet its goals.
- Effective challenge
- Questioning management's proposals and assumptions with enough knowledge and independence to change them.
- Two-tier board
- A structure with a management board of executives and a separate supervisory board of non-executives that oversees it.
Deep Dives & Origins
Deep Dives
- Basel Committee on Banking Supervision, Corporate governance principles for banks, BIS, July 2015, principles 1 to 3. Intermediate.
- Walker, D., A review of corporate governance in UK banks and other financial industry entities: Final recommendations, HM Treasury, November 2009. Intermediate.
Origins
- Basel Committee on Banking Supervision, Corporate governance principles for banks, BIS, July 2015.
- Basel Committee on Banking Supervision, Principles for effective risk data aggregation and risk reporting (BCBS 239), BIS, January 2013.
- Directive 2013/36/EU (Capital Requirements Directive), Article 76; EBA, Guidelines on internal governance.
- Board of Governors of the Federal Reserve System, Regulation YY, Enhanced Prudential Standards, 12 CFR part 252.
- Australian Prudential Regulation Authority, Prudential Standard CPS 510 Governance.
- Board of Governors of the Federal Reserve System, Review of the Federal Reserve's Supervision and Regulation of Silicon Valley Bank, April 2023.
Watch this lesson
Video version
Prefer to watch? The same lesson as a 10-minute video will sit here, made from this page's script.