Policies and the risk framework · RiskAtoms Academy

By the end you will be able to

1Explain how a risk management framework is written down, from the framework to policies, standards and procedures.
2Tell a policy, a standard and a procedure apart.
3Describe how a policy is owned, approved, attested, reviewed and departed from.
4Name the reference frameworks (COSO ERM, ISO 31000) and the rules that require a written framework.

Why it matters

Every bank has a credit policy. Ask a loan officer what it means for the loan on her desk this morning. If she can answer, the bank has a framework. If she says “it's on the intranet somewhere”, it has a document.

Core explanation

From principle to practice, in writing

The board, the CRO, the three lines and the appetite (L2.3.02: The board and its risk committee to L2.3.06: Limits and escalation) only work if everyone knows the rules. So firms write them down in layers, from a few pages the board approves to detailed instructions for daily work. Think of a country: a constitution, then laws, then regulations, then the forms you fill in at the post office.

ExploreThe document hierarchy

Click each layer: who approves it and what it says.

Framework

The risk management framework, with the risk appetite statement. Sets principles, the risk taxonomy, roles across the three lines, committees and reporting. Approved by the board; a few dozen pages at most.

Names and approval levels differ from firm to firm (some call standards “guidelines” or “minimum requirements”), but the layers are much the same everywhere.

Sort itWhich layer does it belong in?

Each line comes from a bank's written rules. Place it in the right layer.

The board approves the risk appetite and the bank's list of risk types every year.
The bank does not lend to companies whose main business is thermal coal mining.
Loans above €5m need the approval of the credit committee.
Commercial property collateral must be revalued at least every three years by an approved valuer.
Step 4: upload the valuation report to the loan system and tick 'collateral verified'.

What every policy needs. Whatever its topic, a good policy states:

Element	Why
Owner	One named person keeps it up to date and answers for it.
Scope	Which entities, businesses and activities it covers.
Link to appetite	Which appetite metrics and limits it supports.
Requirements and roles	What must happen, and who does it in each line.
Approval authorities	Who may approve what, up to which size.
Exceptions	How to ask for a departure, who approves it, for how long.
Review date	Usually at least yearly, sooner if the business or rules change.

Living documents. A policy is only as good as its use. Staff confirm each year that they have read the policies that apply to them (attestation); the second line monitors compliance; internal audit tests it. When someone needs to depart from a policy, they ask for an exception: recorded, approved by the right person, and with an end date. A few exceptions are healthy. Many are a warning sign.

Policy health check: what is wrong? Guess, then reveal.

Reference frameworks. Firms rarely start from a blank page. Two widely used references are COSO's Enterprise Risk Management: Integrating with Strategy and Performance (2017) and ISO 31000:2018 Risk management: Guidelines. Both describe principles, a framework and a process (identify, assess, treat, monitor, report) that you will follow step by step in M2.4: The risk management process.

Worked example

Updating a credit policy

A Canadian bank's board has just lowered its appetite for commercial property lending (L2.3.05: Risk appetite frameworks). Follow the change through the documents.

One appetite change, through the hierarchy

Step 1 of 5

1
Framework and appetite
The board approves the lower appetite. The framework itself does not change.

Regulatory lens

Australia: APRA's CPS 220 requires a board-approved risk management framework and strategy, a comprehensive review of the framework at least every three years by operationally independent people, and an annual risk management declaration by the board.
US: the OCC's heightened standards (2014) require large banks to have a written risk governance framework approved by the board.
EU: EBA guidelines on internal governance expect a documented framework; for insurers, Solvency II requires written policies on risk management, internal control, internal audit and, where relevant, outsourcing, reviewed at least once a year.
UK: under the SM&CR, firms keep a management responsibilities map showing who is responsible for what.

Sparks

SparkThe law says: write it down

For EU insurers, writing policies is not just good practice. The Solvency II Directive itself requires written policies for key areas, approved by the management body and reviewed at least annually.

SparkBorn from a fraud inquiry

COSO was set up in 1985 to sponsor the US National Commission on Fraudulent Financial Reporting, known as the Treadway Commission. Its 1992 Internal Control: Integrated Framework became the standard reference for internal control, and its enterprise risk management framework followed in 2004, revised in 2017.

Key takeaways

Firms write risk management down in layers: framework (board), policies (board or committee), standards (risk executives), procedures (the teams doing the work).
Policies say what must be done and who decides; standards say how much and how often; procedures say how.
Every policy needs an owner, scope, link to appetite, roles, approval authorities, an exceptions process and a review date.
Attestation, second line monitoring and internal audit keep policies alive; frequent exceptions are a warning sign.
COSO ERM (2017) and ISO 31000 (2018) are common reference frameworks; APRA CPS 220, the OCC's heightened standards and Solvency II require written frameworks or policies.

Reaction

Check what stuck

Glossary

Risk management framework: Risk management framework: the board-approved document that sets the firm's risk principles, roles, risk types, appetite and governance.
Policy: A binding statement of what must be done for one risk or activity, who is responsible and who may approve what.
Standard: A more detailed, binding requirement that says how much or how often, under a policy.
Procedure: Step-by-step instructions for carrying out a task in line with the policies and standards.
Exception: A recorded, approved and time-limited permission to depart from a policy, also called a waiver or dispensation.
Attestation: A confirmation, often yearly, that a person has read a policy and follows it.
Risk taxonomy: The firm's agreed list of risk types and how they are grouped.

Deep Dives & Origins

Deep Dives

International Organization for Standardization, ISO 31000:2018 Risk management: Guidelines, 2018. Beginner.
Committee of Sponsoring Organizations of the Treadway Commission (COSO), Enterprise Risk Management: Integrating with Strategy and Performance, 2017. Intermediate.

Origins

Australian Prudential Regulation Authority, Prudential Standard CPS 220 Risk Management.
Office of the Comptroller of the Currency, Guidelines Establishing Heightened Standards, 12 CFR part 30, appendix D, 2014.
Directive 2009/138/EC (Solvency II), Article 41.
European Banking Authority, Guidelines on internal governance under Directive 2013/36/EU.

Watch this lesson

Video version

Prefer to watch? The same lesson as a 8-minute video will sit here, made from this page's script.