Is Your Bank’s Risk Appetite Framework Working?

Assessing the effectiveness of your risk appetite framework is critical to ensuring that it aligns with your institution’s strategic objectives and risk culture. The recently updated RMA Risk Appetite Workbook highlights key elements of an effective framework, offering guidance to evaluate whether yours is functioning as intended. Here are a few signs that your framework is on the right track—and some that may signal the need for improvement. 

Signs Your Risk Appetite Framework is Effective 

• Comprehensive Policies and Procedures: Your institution has a formal risk appetite statement that is updated annually, approved by the board, and integrated into policies for monitoring and managing risk limits. 

• Clear Roles and Responsibilities: The roles and responsibilities for managing risk appetite are clearly defined across all three lines of defense, and staff accountability matches the institution’s size and complexity. 

• Embedded in Strategic Planning: Your risk appetite statement is fully aligned with the strategic planning process, with documented communication between risk, finance, and stress-testing teams prior to issuing guidance. 

• Governance and Reporting: Regular and timely reporting ensures performance stays within approved limits and thresholds, with breaches escalated and resolved according to policy. 

• Supportive Risk Culture: Risk appetite is consistently reflected in the organization’s culture, influencing decisions across all lines of defense and aligning with compensation policies. 

Signs Your Risk Appetite Framework Needs Improvement 

• Lack of Formal Policies: There is no formal risk appetite statement, or it is not reviewed and updated regularly by the board. 

• Unclear Accountability: Roles and responsibilities for managing risk appetite are vague or insufficiently communicated throughout the organization. 

• Disconnected Planning Process: Risk appetite is not integrated into strategic planning, or there is insufficient communication between key risk and stress-testing teams. 

• Inadequate Reporting: Reports on risk appetite performance are delayed or incomplete, and breaches are not escalated or resolved effectively. 

• Weak Alignment With Culture: Risk appetite is not embedded in decision-making processes or reflected in employee incentives, weakening its influence across the organization. 

For a deeper dive into assessing your framework, including detailed self-assessment questions, explore the full Risk Appetite Workbook.