Risk appetite frameworks · RiskAtoms Academy

By the end you will be able to

1Write a risk appetite statement with metrics, early-warning triggers and limits.
2Tell apart risk capacity, risk appetite, risk limits and risk profile.
3Measure headroom against appetite, in percentage points and in money.
4Explain who owns the framework and how it links strategy, capital and limits.

Why it matters

A bank's capital ratio is 13.2%. Is that good? Comfortably above the rules, but the answer depends on something only the board can say: how much risk the bank is willing to run. Until that is written down, no one can tell whether 13.2% is a success or an early warning.

Core explanation

Saying how much risk is enough

Think of driving on a mountain road. The cliff edge is the most you can survive: your capacity. You choose to drive well inside it, in your lane: your appetite. Lines and kerbs warn you before you drift: early warnings. The crash barrier is the limit. Where the car actually is right now is your profile.

After 2008, supervisors found that many banks had no clear, shared statement of how much risk they would take. In November 2013 the Financial Stability Board published Principles for an effective risk appetite framework, which set out the terms most firms now use.

ExploreFrom capacity to profile (FSB, 2013)

Click each term.

Risk capacity

The most risk the firm can take before it breaches its regulatory capital or liquidity requirements or its obligations to depositors, policyholders and others.

The whole system of statement, limits, roles, monitoring and reporting is the risk appetite framework (RAF). The board approves the statement; the CEO, CFO and CRO develop it and turn it into limits; the CRO monitors the profile against it; internal audit checks that the framework works.

What goes in the statement. A good statement mixes qualitative lines (“we do not trade for our own account”, “we have no appetite for breaching sanctions law”) with quantitative metrics. Each metric has three numbers, which turn it into green, amber and red zones:

Metric	Appetite (green from)	Early warning (amber)	Limit (red)	Capacity
CET1 capital ratio	≥ 12.5%	< 12.5%	< 11.5%	10.0%
Liquidity coverage ratio (LCR)	≥ 130%	< 130%	< 115%	100%
Largest exposure to one client, % of Tier 1 capital	≤ 8.0%	> 8.0%	> 10.0%	25.0%
Insurer's Solvency II coverage ratio	≥ 150%	< 150%	< 130%	100%

Illustrative thresholds. The capacity column shows the regulatory floor or cap; the LCR minimum of 100%, the Basel large exposures limit of 25% of Tier 1 capital and the Solvency II requirement of 100% are real rules. The 10% CET1 figure stands for a typical total requirement once buffers and supervisory add-ons are included; it differs by bank.

Sort itUsable or too vague?

Could a risk committee tell, from each line, whether the firm is within appetite?

We have a moderate appetite for credit risk.
Our CET1 ratio will stay at or above 12.5%, and above 10% after our severe stress scenario.
We have no appetite for breaches of sanctions law.
We aim to maximise returns for shareholders.
No exposure to a single client group above 8% of Tier 1 capital.

The formal version

The maths is percentages (M-A01: Percentages), so it is shown in full. For a floor metric, where higher is safer, such as a capital ratio, headroom is the distance above a threshold in percentage points:

\text{headroom (pts)} = \text{current ratio} - \text{threshold}

Multiply by the denominator to turn it into money. For a CET1 ratio, the capital that could be lost before the threshold is reached, with risk-weighted assets (RWA) unchanged, is:

\text{capital headroom} = \frac{\text{headroom (pts)}}{100} \times \text{RWA}

For a ceiling metric, where lower is safer, such as a concentration, headroom is threshold minus current, and limit use is often shown as a utilisation:

\text{utilisation} = \frac{\text{current}}{\text{limit}}

Try it

Pick a metric and write its line of the statement. Move the current value towards the limit and watch the zone change. Then try setting the limit on the wrong side of the early warning.

Try itBuild a risk appetite statement

Metric

CET1 capital ratio. Capacity: 10.0% (illustrative regulatory requirement, including buffers and supervisory add-ons).

Early warning (amber)12.5%

Limit (red)11.5%

Current value13.2%

8.0%← less safe · safer →18.0%

Your statement

We will keep our CET1 ratio at or above 12.5%. If it falls below 12.5%, the CRO alerts the risk committee and management proposes actions. If it falls below the limit of 11.5%, the board is told at once and the agreed actions start. We never plan to go near 10.0%.

ZoneGREEN

Headroom to amber0.7 pts

Headroom to limit1.7 pts

Within appetite.

Worked example

A euro area bank checks its appetite

A bank has €50bn of risk-weighted assets, €6.6bn of CET1 capital, €7.5bn of Tier 1 capital, and its largest exposure to one client group is €640m. Its appetite uses the CET1 and single-client thresholds in the table above.

Where does the bank stand?

Step 1 of 5

1
CET1 ratio
$6.6 \div 50 = 13.2\%$ . That is at or above the 12.5% early warning, so the bank is green.

Regulatory lens

The FSB's 2013 principles are the global reference, and the BCBS 2015 governance principles make the board responsible for approving appetite. Supervisors then apply them in their own way: the ECB's 2016 supervisory statement on governance and risk appetite for significant euro area banks; the OCC's heightened standards in the US, which require a written risk appetite statement; APRA's CPS 220 in Australia, which requires a board-approved risk appetite statement; and, for insurers, Solvency II's own risk and solvency assessment (ORSA), which links appetite to capital. Recovery plans use triggers beyond the appetite limits, set out in Level 4: Regulation, Capital & Accounting.

Sparks

SparkZero appetite is not zero risk

Many firms say they have “no appetite” for things like sanctions breaches or mis-selling. That does not mean such events can never happen. It means the firm will not knowingly accept them, will invest in controls to prevent them, and treats any occurrence as a breach to escalate.

SparkAppetite can be too low

An appetite is not only a ceiling. A bank that takes far less risk than its appetite allows may be failing its strategy, for example by refusing sound loans. Some firms set a lower bound too, so the board asks why risk is unusually low as well as unusually high.

Key takeaways

Capacity is the most risk a firm can bear; appetite is how much the board chooses to take; limits share appetite out; the profile is where the firm actually is (FSB, 2013).
A usable risk appetite statement names metrics and thresholds that can be measured and acted on, plus clear qualitative lines.
Each metric has green, amber and red zones: early warning inside the appetite, a limit, and capacity beyond.
Headroom = current − threshold in points; times the denominator (such as RWA) it becomes money.
Check the stressed position too: a bank green today can be amber after a plausible shock.
The board approves; the CEO, CFO and CRO develop and cascade; the CRO monitors; internal audit checks.

Reaction

Check what stuck

Glossary

Risk appetite framework: Risk appetite framework: the policies, processes, controls and systems through which risk appetite is set, communicated and monitored.
Risk appetite statement: Risk appetite statement: the written statement of how much risk, and which types, the firm will accept to meet its goals.
Risk capacity: Risk capacity: the most risk a firm can take before breaching its regulatory capital or liquidity needs or its obligations to customers.
Risk appetite: Risk appetite: the amount and types of risk a firm is willing to take, within its capacity, to meet its strategy.
Risk limits: Risk limits: quantitative measures that allocate the overall appetite to businesses, risk types or counterparties.
Risk profile: Risk profile: a point-in-time measure of the risks the firm actually has.
Early-warning trigger: Early-warning trigger: a threshold inside the appetite that prompts escalation before a limit is reached.
CET1 ratio: Common equity tier 1 capital: mainly ordinary shares and retained profits, divided by risk-weighted assets to give the CET1 ratio.
LCR: Liquidity coverage ratio: high-quality liquid assets divided by the net cash outflows of a 30-day stress; at least 100%.

Deep Dives & Origins

Deep Dives

Financial Stability Board, Principles for an Effective Risk Appetite Framework, 18 November 2013. Beginner.
European Central Bank, SSM supervisory statement on governance and risk appetite, June 2016. Intermediate.

Origins

Financial Stability Board, Principles for an Effective Risk Appetite Framework, November 2013.
Basel Committee on Banking Supervision, Corporate governance principles for banks, BIS, July 2015.
Basel Committee on Banking Supervision, Supervisory framework for measuring and controlling large exposures, BIS, April 2014.
Australian Prudential Regulation Authority, Prudential Standard CPS 220 Risk Management.
Office of the Comptroller of the Currency, heightened standards, 12 CFR part 30, appendix D, 2014.

Watch this lesson

Video version

Prefer to watch? The same lesson as a 12-minute video will sit here, made from this page's script.