The governance of risk management is the set of structures and processes that decide which risks a firm takes and who checks them: the board, its audit, risk and compensation committees, the chief risk officer, the limits that turn a board-approved risk appetite into daily decisions, and the internal audit function that tests whether any of it works. A bank can have excellent risk models and still fail if a dominant chief executive can override them, which is why risk governance, and not only risk measurement, became a central concern of regulators after 2008.
This third chapter of FRM Part 1 traces how risk governance developed, from the accounting scandals and the Sarbanes-Oxley Act to the crisis-era reforms of Basel III, Dodd-Frank and European supervision. It then works through the board’s duties, the risk appetite statement, the board committees, the senior risk committee and the CRO, Tier 1 and Tier 2 limits and how breaches are escalated, the incentive problems in banker pay, the interdependence of the units that manage risk day to day, and the role of internal audit.
Key Takeaways
- The governance of risk management is the infrastructure of people, policies and committees through which a firm decides which risks to take, sets limits on them and verifies that the limits are respected.
- After the 2007 to 2009 crisis, Basel III added higher-quality capital, the LCR and NSFR liquidity ratios and a macroprudential overlay including a 3 percent leverage ratio, while Dodd-Frank and the European SREP made stress testing part of capital planning.
- The board of directors is responsible for risk oversight: it sets the risk appetite, checks that strategy and major transactions fit it, ensures pay is based on risk-adjusted performance, and is ultimately accountable when risk policy is ignored.
- A risk appetite statement sets out in writing the level and types of risk a firm will accept or avoid; appetite sits below risk capacity and is cascaded into business unit limits that the chief risk officer monitors.
- Tier 1 limits are specific and their breaches must be cleared immediately; Tier 2 limits are more general and can be cleared within days, and both are reported on daily exception reports that no manager can override.
- Option-like bonuses reward excess risk, so post-crisis reforms favor deferral, clawbacks and pay in shares or bonds, while internal audit, reporting to the audit committee and independent of the risk function, tests whether the whole structure works.
Why Risk Governance Became a Board Matter
Corporate governance is the way a company is run: the roles and responsibilities of its shareholders, board and senior management. Risk management once sat a level below that conversation, as a technical function. Over two decades it has moved into it, and risk governance, meaning how a firm decides which risks to take and how it oversees them, has become a defined set of best practices and a central part of banking regulation.
The change came in two waves. The first was a run of accounting frauds: Enron in 2001, WorldCom and Global Crossing in 2002, and Parmalat in late 2003. Executives committed the frauds, but auditors and boards failed to stop them, and complex products, derivatives among them, were sometimes used to hide how weak the firms had become. The failure was one of disclosure and accountability.
The Sarbanes-Oxley response
The United States answered with the Sarbanes-Oxley Act (SOX), signed in July 2002, which tightened the legal duties of boards, senior managers and auditors. Its main provisions for risk governance:
- The chief executive and chief financial officer must certify that reports filed with the Securities and Exchange Commission are accurate and complete and fairly present the firm’s financial condition.
- They are responsible for internal controls, and must disclose significant control deficiencies, and fraud by anyone with a material role in the controls, to the external auditors, internal audit and the audit committee.
- The effectiveness of reporting procedures and controls must be reviewed every year.
- Audit committee members must be named, and are expected to understand accounting principles and financial statements and how internal audit and an audit committee work.
Europe relied instead on governance codes applied on a “comply or explain” basis: a firm follows the code or explains publicly why not. Both approaches dealt with controls, governance and disclosure. Neither addressed risk management directly.
The crisis that exposed the gap
The second wave, the 2007 to 2009 crisis, was a failure of risk management itself. Mortgages went to borrowers who could not repay, investment banks packaged them into complex securities that institutions and rating agencies failed to value, and inside many banks risk managers were sidelined while executives chased returns. Enquiries afterward kept returning to five governance concerns specific to banks:
- Whose interests come first. Depositors, debtholders and taxpayers, through the implicit government guarantee, care far more about avoiding failure than shareholders pressing for short-term returns, so the usual cure of empowering shareholders may not help in banking.
- Who sits on the board. Failure showed no clear link to whether boards were dominated by insiders or outsiders; Northern Rock, which suffered a run in 2007, had several banking experts on its board.
- How actively the board oversees risk. Boards were pressed to understand risk and keep a direct line to the chief risk officer (CRO).
- Whether the bank states its risk appetite. Regulators pushed for a formal, board-approved appetite that can be turned into firm-wide limits.
- How pay shapes behavior. Boards were expected to check whether compensation rewarded excessive risk, using deferral and clawbacks.
The Post-Crisis Regulatory Response: Basel III
The Basel Committee on Banking Supervision (BCBS) writes international standards for bank prudential regulation; according to the Bank for International Settlements it has 45 members, central banks and supervisors, from 28 jurisdictions. Its standards are not legally binding, but members and many other jurisdictions adopt them voluntarily. Each accord answered the failure before it, as Exhibit 1 shows.
| Accord | Prompted by | Main features |
|---|---|---|
| Basel I (1988) | The Latin American debt crisis of the early 1980s | Uniform capital adequacy rules focused on credit risk; minimum capital of 8 percent of risk-weighted assets |
| Basel II (work began 1999, finalized 2006) | Basel I’s crude risk weights and the growth of trading and financial innovation | Kept the 8 percent minimum but refined the risk weights and added trading activity; introduced supervisory review and disclosure rules to strengthen market discipline |
| Basel III (from 2010) | The 2007 to 2009 crisis | Higher-quality capital, new liquidity ratios, wider coverage of capital markets risks, and a macroprudential overlay aimed at systemic risk |
Basel III targets the risk in each firm and systemic risk, the danger that one major failure brings down connected institutions and harms the economy. Most reforms still concern capital, now judged by quality as well as quantity: core Tier 1 capital is limited to common equity and retained earnings, which absorb losses, unlike hybrid debt. Two liquidity ratios were added. The Liquidity Coverage Ratio (LCR) requires enough liquid assets for 30 days of stressed outflows, and the Net Stable Funding Ratio (NSFR) requires stable funding over one year, which also counters procyclicality by reducing reliance on short-term wholesale funding that vanishes in a crisis. Capital charges were widened to exposures to central counterparties, margin on non-centrally cleared derivatives, counterparty credit risk and securitization.
On top sits a macroprudential overlay with five elements: a 3 percent leverage ratio; a countercyclical capital buffer; total loss-absorbing capacity (TLAC) standards for global systemically important banks (G-SIBs); rules for systemically important markets and infrastructures, including a push to move over-the-counter (OTC) derivatives into central clearing and trade reporting; and capturing systemic risk and tail events in models and stress tests. Market risk was rebuilt separately through the Fundamental Review of the Trading Book (FRTB), first issued in January 2016, which also expanded disclosure.
where the total exposure measure covers on-balance-sheet assets and off-balance-sheet exposures without any risk weighting. Because nothing is risk weighted, the ratio is a backstop against a bank whose risk-weighted ratios look healthy only because its models assign low weights.
Halvorsen Bank holds Tier 1 capital of USD 18 billion. Its risk-weighted assets are USD 200 billion, and its total exposure measure for the leverage ratio is USD 720 billion, mostly low-risk-weight mortgages and repo lending. Check both ratios, and work out what the bank would need to do to meet a 3 percent leverage ratio.
Step 1. Risk-weighted Tier 1 ratio.
Step 2. Leverage ratio.
Step 3. The two ways to close the gap.
Answer: the bank looks well capitalized at 9.0 percent on a risk-weighted basis but fails the leverage ratio at 2.5 percent. It must either raise USD 3.6 billion of Tier 1 capital or cut its exposures by USD 120 billion, a sixth of its balance sheet. This is exactly the case the leverage ratio was designed for: a large balance sheet of assets that the risk weights treat as nearly riskless.
Basel turns to governance
The BCBS issued corporate governance principles for banks in October 2010, on the board’s duties, directors’ qualifications and an independent risk function, and revised them in July 2015 to stress the board’s active, collective oversight. The 2015 principles cover the board, senior management, group structures, a risk function led by a CRO with stature, independence, resources and board access, risk identification and communication, compliance, internal audit, compensation, disclosure and the role of supervisors.
A bank has Tier 1 capital of USD 9 billion, risk-weighted assets of USD 75 billion and a leverage exposure measure of USD 250 billion. Does it meet a 3 percent leverage ratio, and what does the comparison with its risk-weighted ratio tell you?
Show answer
It meets the 3 percent leverage ratio with 0.6 percentage points to spare, and its risk-weighted ratio is a healthy 12 percent. The much lower leverage ratio shows that risk weighting reduces its exposures to less than a third of their size, so the leverage ratio is the constraint to watch if the bank grows low-risk-weight assets.
Dodd-Frank, SREP and the Rise of Stress Testing
Basel III set the international floor; the United States and Europe added their own regimes, both built around stress testing.
Restructuring of US banking
The Glass-Steagall Act of 1933 separated commercial from investment banking until the Gramm-Leach-Bliley Act of 1999 let bank holding companies become financial services holding companies combining banking, insurance and broker-dealer activities. In practice investment banks stayed outside prudential regulation, thought marginal to banking stability. The crisis proved otherwise. In 2008 Bear Stearns and Merrill Lynch were absorbed by banks under duress, Lehman Brothers failed, and Goldman Sachs and Morgan Stanley converted to bank holding companies, gaining access to Federal Reserve lending in exchange for full banking regulation.
The Dodd-Frank Act
The Dodd-Frank Act, signed in July 2010 and running to some 2,300 pages, aimed at consumer protection and systemic stability:
- A stronger Federal Reserve, supervising systemically important financial institutions (SIFIs), originally bank holding companies with more than USD 50 billion of assets, with a macroprudential role.
- Ending too-big-to-fail through an orderly liquidation authority.
- Resolution plans: SIFIs submit a “living will” to the Fed and the Federal Deposit Insurance Corporation.
- Derivatives reform focused on transparency and counterparty risk.
- The Volcker Rule, banning proprietary trading by banking entities and their ownership of hedge funds and private equity funds, effective from July 2015.
- Consumer protection through a new Consumer Financial Protection Bureau.
- Stress testing: top-down macroeconomic scenarios over several quarters, covering credit, liquidity, market and operational risk together, computationally demanding because risk drivers are not stationary, integrated with capital and liquidity planning, and run across all large banks so supervisors see the system-wide effect of a common shock.
The Fed ran two exercises. The Dodd-Frank Act Stress Test (DFAST) covered banks above USD 10 billion of assets. The Comprehensive Capital Analysis and Review (CCAR), for banks above USD 50 billion, combined three supervisory scenarios with two of the bank’s own, a baseline and an adverse. Each bank submitted a nine-quarter capital plan including every planned dividend, buyback and major acquisition, and had to stay above minimum ratios, such as a 4.5 percent common equity ratio, throughout; the Fed also judged the quality of the processes behind the plan.
The US regime has since been recalibrated. A 2018 law raised the systemically important threshold to USD 250 billion and exempted banks under USD 10 billion from the Volcker Rule, and in March 2020 the Fed’s stress capital buffer turned stress test results into bank-specific capital buffers, ending CCAR’s pass or fail quantitative objection. The governance logic is unchanged: capital planning is driven by stress, and the board owns the plan.
where stressed losses are net of pre-provision revenue under the scenario and planned distributions are the dividends and buybacks in the capital plan. The test is the lowest ratio over the horizon, not the ending one.
Cardinal Financial starts the planning horizon with common equity of USD 40 billion and risk-weighted assets of USD 400 billion. Under the severely adverse scenario its losses, net of revenue, accumulate to USD 14 billion by the worst quarter, when risk-weighted assets have risen to USD 420 billion. Management proposes dividends and buybacks of USD 3 billion up to that quarter. The board is also considering a larger plan of USD 8 billion. Test both plans against a 4.5 percent minimum.
Step 1. Starting ratio.
Step 2. Trough ratio under the USD 3 billion plan.
Step 3. Trough ratio under the USD 8 billion plan.
Answer: the smaller plan keeps the trough ratio at 5.48 percent, about one percentage point above the minimum, while the larger plan drops it to 4.29 percent and fails. The bank’s ratio looks strong at 10.0 percent today, but the plan is judged at its weakest point under stress. That is why stress testing sits inside capital planning: the payout decision is a risk appetite decision.
Europe: SREP and the EBA stress tests
For banks under the euro area’s Single Supervisory Mechanism, the Supervisory Review and Evaluation Process (SREP) brought three principles: a forward-looking focus on whether each business model is sustainable, including under stress; assessment based on industry best practice; and common standards for all banks. Its pillars are the internal capital adequacy assessment process (ICAAP), using stress tests to support capital planning, and the internal liquidity adequacy assessment process (ILAAP), capturing losses from forced asset sales and higher funding costs. Banks with EUR 30 billion or more of assets also run the European Banking Authority (EBA) stress test, at consolidated group level with insurance excluded. Exhibit 2 compares it with the original CCAR design.
| Feature | CCAR (as designed under Dodd-Frank) | EBA stress test |
|---|---|---|
| Horizon | Nine quarters | Three years |
| Scenarios | Three supervisory plus two bank-generated | Two supervisory: baseline and adverse |
| Balance sheet | Dynamic: banks may manage portfolios and must include planned capital actions | Static: banks look at the impact of the cumulative shocks on today’s balance sheet |
| Scope | Large US bank holding companies | EU banking groups with EUR 30 billion or more of assets, insurance excluded |
| Link to governance | Capital plan reviewed quantitatively and for the quality of internal processes | Feeds into SREP and the ICAAP and ILAAP |
A static test isolates the damage the scenario does to the bank as it stands, which makes banks comparable; a dynamic test is more realistic but lets each bank’s assumptions about its own reactions shape the answer.
Why is a static balance sheet assumption, as in the EBA stress test, less realistic than the dynamic approach in CCAR, and why might a supervisor still prefer it?
Show answer
A static balance sheet ignores the actions management would take during a three-year downturn, such as cutting risk or changing its funding, so it is less realistic. It isolates the effect of the scenario on the bank as it stands, which makes results comparable across banks and prevents each bank’s optimistic assumptions about its own reactions from flattering the result.
The Board’s Role in Risk Governance
Inside the firm, risk governance has to answer three questions: how corporate governance best practice relates to risk management best practice, how risk management is delegated between the executive staff and the board committees, and how risk policy reaches the managers who take risk every day. The answers below are written for banks but apply to any firm that takes material risks.
Whose interests the board protects
The board’s traditional duty is to shareholders, though a growing view holds that it answers to all stakeholders, and they want different things. Debtholders care most about extreme downside risk, because their claim is most exposed when solvency is in doubt; shareholders, whose losses stop at their investment, may welcome more risk. The board also oversees management and must understand the type and size of every major risk it takes. At the heart of that oversight is the agency problem, the conflict between managers and longer-term stakeholders, which usually appears as risk taken to boost short-term profit or flatter performance. Stock options, worth something only if the share price rises above a set level, can tempt executives into actions that lift the price briefly and harm the firm later. No pay scheme removes the temptation, which is the main argument for a board independent of management and for separating the roles of chief executive and chair.
MF Global shows what happens when that independence is missing. Jon Corzine became chief executive in March 2010 and also chaired the board of a firm already struggling with liquidity and compliance. Despite repeated warnings from its CRO, MF Global built European sovereign debt positions reported at more than USD 6 billion; as the euro area crisis deepened, they drained liquidity and confidence, and the firm filed for bankruptcy on 31 October 2011. Customer funds had been used to plug the cash gap, and in January 2017 the Commodity Futures Trading Commission announced a USD 5 million penalty against Corzine, saying nearly USD 1 billion of customer money had been mishandled.
What the board must do
Post-crisis rules raised the bar for risk governance: building the infrastructure of people, systems and formal procedures to define, implement and oversee risk management, with channels of communication inside the firm and with stakeholders and regulators. How much of this is written into law varies; in 2012 the International Finance Corporation, part of the World Bank Group, published risk governance standards for financial institutions.
The board’s central duty is to assess the risks and rewards in the firm’s strategy. It takes part in strategic planning, sets the risk appetite, checks that major transactions fit the approved risk and strategy, ensures disclosures are adequate and compliant, and confirms that procedures exist to identify, assess and handle every major risk type: business, operational, reputational, market, liquidity, compliance and credit. It is ultimately accountable when risk policy is ignored. Many failures come from deliberately taking too much risk; many others from failing to see or measure a risk in time.
Every risk decision reduces to four strategic choices: whether to undertake an activity at all; whether to transfer all or part of its risk, through insurance or hedging; whether to mitigate it in advance through early detection and prevention; and whether to assume it, fully aware of the upside and the downside. These choices should be made enterprise-wide under one set of policies, the idea behind enterprise risk management, covered later in FRM Part 1.
A practical test of how seriously a firm takes risk is the standing of its risk managers. Are they part of the executive staff, with a path to other senior roles? How independent are they, what authority do they hold and to whom do they report? Are they paid well compared with traders and others rewarded for performance? Is the firm’s ethical culture strong enough to resist bad actors, with standards that are enforced?
The board must also see that executives are paid on risk-adjusted performance, gather information from several sources, including internal and external auditors, and know enough to understand the answers to its hard questions. It oversees rather than runs the business: its role is to make sure delegation and implementation work as planned. Directors need training to judge the firm’s risk capacity over a horizon given its business mix, earnings goals and competitive position, and the board needs a risk committee with real analytical skill, separate from the audit committee because the two jobs need different skills.
A bank’s board is chaired by its chief executive, its CRO reports to the head of trading, and the board’s audit committee also acts as its risk committee. Identify three governance weaknesses.
Show answer
First, combining chair and chief executive weakens the board’s independence from management, which is the main defense against agency risk, as MF Global showed. Second, a CRO reporting to the head of trading is not independent of the risk-takers; best practice is a direct line to the chief executive and a seat on the board risk committee. Third, the risk and audit committees should be separate, because each needs different skills and the audit committee must independently verify the work the risk function does.
The Risk Appetite Statement
Publishing a risk appetite statement (RAS) is an important part of corporate governance. The Financial Stability Board (FSB), in its 2013 principles for an effective risk appetite framework, describes an RAS as “the articulation in written form of the aggregate level and types of risk that a financial institution is willing to accept, or to avoid, in order to achieve its business objectives.” It combines qualitative statements with quantitative measures and should also cover hard-to-quantify risks such as reputation, conduct, money laundering and unethical practices.
Typical objectives include balancing risk and return, a prudent attitude to tail and event risk, protecting reputation, meeting regulatory expectations and keeping a target credit rating. The FSB adds that an effective statement records the assumptions behind the strategic and business plans and links to the firm’s strategic, capital and financial plans and its compensation programs. Appetite shapes strategy from the outset: some activities are off-limits for a firm whatever their size, others are acceptable only up to a scale that makes sense against its total assets, and the appetite and current risk position must be communicated across the firm so sensible limits can be set.
Capacity, appetite, tolerance and profile
- Risk capacity is the most risk the firm could bear before failing or breaching a binding constraint such as a capital minimum.
- Risk appetite is the aggregate risk it is willing to take, set well below capacity.
- Risk tolerance is the range of acceptable outcomes around one business objective: tactical and narrow, where appetite is broad.
- Risk profile is the risk the firm actually carries now.
The aim is to keep the profile within the tolerance bands, inside the appetite, so management can pursue its risk-adjusted return targets without drifting toward capacity. The RAS sets measures for business units as well as the whole firm and makes return objectives subject to limits on the amount at risk, and a summary of the key policies, limits and oversight for each risk type should be transparent to shareholders.
Marlowe Bancorp estimates that it could lose USD 12 billion before breaching its minimum capital requirement. The board sets its risk appetite at 60 percent of that capacity, measured in economic capital. The senior risk committee allocates USD 3.6 billion to retail lending, USD 2.0 billion to corporate lending and USD 1.0 billion to markets, and holds the rest in reserve. Current usage is USD 3.0 billion in retail, USD 1.5 billion in corporate and USD 0.62 billion in markets. Find the appetite, the reserve, each unit’s utilization and the firm’s position against appetite and capacity.
Step 1. Appetite and the unallocated reserve.
Step 2. Utilization of each unit’s allocation.
Step 3. Firm-wide risk profile.
Answer: the appetite is USD 7.2 billion, with USD 0.6 billion held in reserve. The firm as a whole uses 71 percent of its appetite and 43 percent of its capacity, which is comfortable. The unit picture is less even: retail is at 83 percent of its allocation and is the unit most likely to need an exception or a reallocation from the reserve. Expressing every limit in the same unit, economic capital, is what makes this comparison across very different businesses possible.
Classify each as risk capacity, risk appetite, risk tolerance or risk profile: (a) the bank currently uses USD 4.1 billion of economic capital; (b) the board will accept up to USD 6 billion; (c) the bank could lose USD 10 billion before breaching its capital minimum; (d) the mortgage unit’s loss rate must stay between 0.3 and 0.6 percent.
Show answer
(a) is the risk profile, the risk carried today. (b) is the risk appetite, the aggregate risk the board is willing to take. (c) is the risk capacity, the most the bank could bear. (d) is a risk tolerance, a range of acceptable outcomes for one business objective.
Board Committees and the Risk Advisory Director
At most firms the board’s audit and risk management committees approve the key risk policies, review how they work, and break the appetite into practical limits that executives pass through the organization. Exhibit 3 compares the board-level bodies.
| Body | Core job | What sets it apart |
|---|---|---|
| Audit committee | Accuracy and completeness of financial and regulatory disclosures; compliance with best practice in regulatory, legal, compliance and risk management matters | Independent verification that the firm does what it says it does, judging quality as well as accuracy |
| Board risk management committee | Sets the risk appetite and independently reviews the governance of all material risks, including policies, methods and infrastructure | Approves and reviews risk levels on the board’s behalf; monitors financial, operational, business, reputational and strategic risk |
| Compensation committee | Sets executive pay | Independence from the executives whose pay it sets; aligns pay with performance and risk |
| Risk advisory director | A risk specialist on the board, often non-voting, who strengthens the risk and audit committees | Brings expertise that general directors may lack and keeps the board current on best practice |
The audit committee’s distinctive contribution is independent verification that the firm does what it says. It judges quality as well as accuracy: reviewing financial statements, it confirms they are right and that the firm addresses the risk of material misstatement. In the crisis many audit committees missed the excess risk in proprietary trading and outsized structured credit positions. Members must be financially literate, independent in judgment, of the highest integrity and willing to challenge management; in most banks the chair and most members are independent, yet the relationship with management must stay productive with every line of communication open.
Not every director can analyze a complex financial firm, especially independent directors recruited, often by design, from other industries, and executives have historically found it easy to confuse non-executives. Training helps, and so does a risk advisory director: an independent specialist, not necessarily voting, who strengthens the risk and audit committees, keeps the board current on best practice and gives a view on the risks of the business model and of planned new activities. The board risk management committee sets the appetite, reviews the governance of all material risks, approves and reviews risk levels on the board’s delegated authority, keeps direct contact with internal and external auditors, and reports to the board on matters such as special credit extensions beyond board limits.
From Appetite to Daily Decisions: the Senior Risk Committee and the CRO
The link between the board’s appetite and a trader’s position runs through a short chain:
- The board risk committee approves the risk appetite each year, through broad but clearly defined metrics such as the total interest rate risk the bank will carry.
- The senior risk committee, led by the chief executive and typically including the CRO, chief financial officer, treasurer, chief compliance officer and business unit heads, is empowered by the board to implement and oversee the framework.
- It sets the limits for financial risks, such as credit and market risk, and non-financial risks, such as business and operational risk, often through sub-committees; a credit risk committee, for example, limits the size and type of credit risk and oversees its reporting.
- It reports back to the board risk committee with recommendations on the total risk it considers prudent, for approval.
The senior risk committee also establishes, documents and enforces all risk policies and hands the CRO the limits for specific activities.
The chief risk officer
The CRO designs the firm’s risk program, its policies, methods and infrastructure, and makes day-to-day decisions delegated by the senior risk committee, including approving exceptions to activity limits as long as they stay within the board-approved totals. Each business unit receives authority to take risk up to a ceiling, usually approved for one year by the senior risk committee and monitored by the CRO, who may extend it briefly to fit the committee’s schedule.
Because CROs sit in management, their independence has to be protected deliberately, as the crisis and MF Global showed. Best practice is for the CRO to help set risk strategy as well as carry it out, report directly to the chief executive, hold a seat on the board risk committee, have a voice in approving new products and business lines, and, above all, have a clear right to raise any threat to the appetite with management at every level and with the board. The CRO is often the liaison between board and management, and can order units to cut or close positions.
A business risk committee for each major business line, made up of business and risk staff, aligns that line’s decisions with the firm’s chosen trade-off between risk and reward, decides how particular risks are handled there, and reviews its limits in detail.
Limits, Monitoring and Escalation
Good risk governance ties appetite and limits to specific business practices, with limits for each business, each risk in it and the whole portfolio. Market risk limits constrain exposure to prices, rates and currencies; credit risk limits cap exposure to defaults and credit deterioration from loans or derivatives; banks also set policy on asset-liability management, liquidity and even catastrophe risk. The processes for setting limits, reviewing exposures and approving exceptions should all be documented. Risk-sensitive measures such as value at risk (VaR) suit typical portfolios in normal markets but not stressed conditions, so best practice builds scenario analysis and stress testing into the limit framework. Most banks set two types of limit, compared in Exhibit 4.
| Feature | Tier 1 limits | Tier 2 limits |
|---|---|---|
| Nature | Specific | More general |
| Typical examples | An overall limit by asset class, an overall stress test limit, a maximum drawdown limit | Limits on areas of business activity and on aggregated exposures by credit rating, industry, maturity or region |
| When breached | Must be cleared or corrected immediately | Less urgent; can be cleared within a few days or a week |
| Reporting of excesses | Both are recorded on the daily limit exception report, identified by tier, and then on the CRO’s enterprise exception report | |
The CRO proposes the metrics and the internal risk committee approves them. Limits should be calibrated, using the unit’s history, so that breaches are rare in the normal course of business: a desk might normally use around half its market risk limit, with peaks well short of the ceiling. Expressing all limits in one unit, such as economic capital, lets Tier 2 limits apply across business lines.
Setting limits starts the process; monitoring them is the rest of it. Market risk, the most time-sensitive, needs daily valuation of positions; profit and loss prepared outside the trading department for non-trading executives; independent verification of valuation assumptions; written procedures separating acceptable exceptions from violations; regular comparison of actual with predicted volatility; and stress tests of earnings. Intraday exposure may be tracked from front-office data such as accumulated client orders, but data for monitoring limits should come from consolidated feeds independent of the front office and reconciled to the official books.
Units must disclose expected breaches in advance; a planned excess the CRO hears about early is more likely to be approved. A unit head may have to raise an alert at a set share of the limit, after which the CRO and the unit head can ask the business risk committee, and then the senior risk committee, for a temporary increase. Any breach goes on a daily limit exception report, separated by tier with its causes and remedy, and onto the CRO’s enterprise exception report for the daily risk meeting. No manager, the chief executive included, may remove an exceedance from the report.
where the exposure and the limit are measured the same way, for example daily VaR in USD. Utilization drives escalation: a pre-set threshold triggers an alert, and anything above 100 percent is an exceedance that must be reported.
Ostrava Capital’s rates desk has a Tier 1 VaR limit of USD 20 million. Policy says normal usage should run between 35 and 60 percent of the limit, and the desk head must alert the CRO at 80 percent. Over five days the desk’s VaR is USD 9.5, 11.0, 14.2, 16.8 and 21.0 million. Find the utilization each day and the action each one calls for.
Step 1. Utilization each day.
Step 2. The alert threshold.
Step 3. The size of the day 5 excess.
Answer: days 1 and 2 are inside the normal range. Day 3, at 71 percent, is above normal and worth watching but needs no formal action. Day 4, at 84 percent, triggers the alert: the desk head tells the CRO, and if the desk expects to need more room, the two can ask the business risk committee, and then the senior risk committee, for a temporary increase. Day 5 is a Tier 1 exceedance of USD 1.0 million. Unless a temporary increase has already been approved, it goes on the daily limit exception report and the enterprise exception report, and the desk must cut risk at once, because Tier 1 breaches are cleared immediately.
Limits have an opportunity cost, since stopping a desk early can mean giving up profitable trades, so as a limit nears the bank should run a cost, benefit and risk analysis before granting an exception.
A credit desk’s limit is USD 50 million and its alert threshold is 85 percent. Exposure is USD 44 million today and the desk plans a trade that would take it to USD 53 million. What should happen before and after the trade?
Show answer
The desk has already crossed its alert, so the CRO should be told now, and the planned excess disclosed in advance. The CRO and the unit head can ask the business risk committee, then the senior risk committee, for a temporary increase. If the trade goes ahead without approval, the USD 3 million excess goes on the daily limit exception report and the enterprise exception report, and no one, including the chief executive, can remove it.
Incentives and Risk-Taking
Pay schemes at many institutions encouraged short-term risk-taking before the crisis. Bonuses tied to short-term profit or business volume encouraged staff to bring income forward and push risk into the future, and they worked like call options: unlimited upside, downside capped at zero. With high leverage, staff could quite literally bet the bank.
A trader at Brightwater Bank earns a bonus of 10 percent of any positive annual profit and nothing on a loss. Strategy A has an equal chance of making or losing USD 40 million; strategy B, which is riskier, has an equal chance of making or losing USD 100 million. Both have an expected profit of zero for the bank. Compare the trader’s expected bonus under each strategy, then repeat the comparison under a scheme that pays 10 percent of profit but takes back up to USD 6 million from the trader’s deferred bonus pool, at 10 percent of any loss.
Step 1. Option-like scheme: nothing on a loss.
Step 2. Scheme with a deferred pool exposed to losses (malus capped at USD 6 million).
Step 3. The trader’s gain from choosing the riskier strategy.
Answer: under the option-like scheme the trader expects USD 5 million from the risky strategy against USD 2 million from the safer one, although the bank expects to make nothing from either. Exposing a deferred pool to losses removes the payoff from the safer strategy altogether and cuts the reward for gambling from USD 3 million to USD 2 million. Some incentive remains because the pool, and so the malus, is capped at USD 6 million; the larger the share of pay that is deferred and at risk, the closer the trader’s payoff comes to the bank’s.
The post-crisis pay reforms
Many jurisdictions now require a board compensation committee to set executive pay, because shareholders have almost no say and chief executives could otherwise sway boards. Pay is now seen as part of risk culture: aligned with long-term stakeholder interests and risk-adjusted return on capital, rewarding calculated rather than reckless risk. Firms will still compete for revenue-generating “rainmakers”, and without international cooperation the talent market invites regulatory arbitrage.
At the Pittsburgh summit in September 2009, the G-20 endorsed the FSB’s compensation standards: no multi-year guaranteed bonuses; downside exposure through deferral, share-based pay and clawbacks that recover bonuses if losses emerge later; limits on variable pay relative to net revenues; disclosure; and independent pay committees. The FSB reported implementation essentially complete in almost all member jurisdictions by 2014. The EU went further, capping bonuses at 100 percent of fixed pay, or 200 percent with shareholder approval; the United Kingdom removed that cap for its banks from 31 October 2023, while it remains in the EU.
Share-based pay does not fully solve the problem. Lehman Brothers’ employees owned a large stake in the firm before it collapsed, and shares themselves have an option-like payoff, with unlimited gains and losses capped at the investment. A stronger remedy makes employees creditors, paying part of their bonus in bonds that lose value if the bank weakens. UBS, for example, began in 2013 paying part of senior bonuses in bonds forfeited if its capital ratio falls below a trigger or it needs public support. The European Banking Authority had argued in December 2012 that senior bankers should receive part of their bonuses in bonds that take losses in a crisis.
Why does paying senior staff partly in bonds that are written off if the bank’s capital falls below a trigger reduce risk-taking more than paying them in shares?
Show answer
A shareholder’s losses stop at the investment while gains are unlimited, so shares keep an option-like payoff that can still reward risk. A bond that is written off when the bank weakens gives the employee a stake in the downside, the outcome debtholders care about, so the employee loses precisely when excessive risk damages the bank.
How the Organizational Units Depend on Each Other
Board committees oversee risk, but staff carry out risk management at almost every level, and no single unit can do it alone. Exhibit 5 shows how the work is shared.
| Function | Main responsibilities | Why the others depend on it |
|---|---|---|
| Senior management | Sets risk tolerances at business level, designs and manages policy, evaluates performance | Translates the board’s appetite into tolerances each business can act on |
| Risk management | Develops and implements risk policy, monitors limits, controls the risk of how models are implemented, gives senior management independent risk assessments | Provides the independent view that the business line cannot give about itself |
| Business line | Takes on and manages exposure to approved risks; checks valuations; verifies timely, accurate and complete deal capture and confirms the official profit and loss | Knows the positions and the market best, so its data and judgment feed every control |
| Operations | Executes, records and settles trades independently; reconciles front- and back-office positions; records all transactions; prepares earnings reports and independent valuations such as mark-to-market | Gives an independent record that the positions and profits reported are real |
| Finance | Develops valuation and finance policies; ensures reported earnings are accurate and complete; reviews independent valuation methods; manages business planning and supports the business lines’ financial needs | Sets the rules by which positions are valued and earnings are reported |
Each unit checks something another produces: the business line takes the risk, operations records and settles it independently, finance sets valuation policy, risk management measures exposure against limits, and senior management judges the result against tolerance. A trader who could book, value and report their own positions would face none of these checks.
Assessing the Bank’s Audit Function
Risk governance cannot certify its own compliance with board policy and regulation. That is the job of internal audit, which confirms that risk management and governance are properly set up, implemented and effective. Regulators typically require it to review all risk-related processes, policies and procedures, including the organization and documentation of the risk control unit and how well risk measures are built into daily management. Internal auditors review monitoring procedures, track upgrades to risk systems and the adequacy of controls over generating and securing data, confirm that vetting processes work, check compliance documentation against regulatory standards, and give an opinion on the reliability of VaR reporting.
In market risk, auditors review how front- and back-office valuation models are vetted, sign off on significant changes to risk quantification, validate the range of risks the models capture and check the reliability of systems and the completeness of data. Beyond regulatory requirements, they evaluate the design and conceptual soundness of risk measures: back-testing market risk models, reviewing the risk management information systems (risk MIS), including coding and controls over position data, and testing assumptions on volatility and correlation and the market data behind VaR. Risk functions can also be rated, internally or by outside parties such as rating agencies, and the Institute of Internal Auditors sets mandatory and recommended standards through its International Professional Practices Framework.
The industry has long debated whether internal audit should oversee operational risk management. Audit has a natural interest in internal controls, but implementing risk management must stay separate from auditing it. Auditors must be independent of what they audit for the board to trust their assurance, and without that separation conflicts of interest would weaken both functions.
The CRO’s function and internal audit both report upward, but they do different jobs. Risk management designs, implements and monitors the controls; internal audit tests whether those controls are well designed and actually work, and reports to the audit committee. If the same people did both, nobody would be checking the checkers.
Chapter Summary
- Risk governance became a board duty in two waves: the frauds behind Sarbanes-Oxley in 2002, and the 2007 to 2009 crisis, a failure of risk management itself.
- Basel III raised capital quality, added the LCR and NSFR and a macroprudential overlay with a 3 percent leverage ratio; Basel governance principles followed in 2010 and 2015.
- Dodd-Frank and Europe’s SREP made stress testing part of capital planning, judged at the weakest point of the scenario.
- The board sets the appetite, controls agency risk through independence from management and owns oversight without running the business.
- A risk appetite statement records the risk a firm will accept, below capacity, and is cascaded into business unit limits.
- The audit committee verifies independently, the risk committee sets and reviews risk levels, and the CRO monitors limits with direct board access.
- Tier 1 breaches are cleared at once and Tier 2 within days, and every breach is escalated and reported.
- Option-like pay rewards risk; deferral, clawback and debt-like pay give staff a share of the downside, and internal audit independently tests the whole system.
Frequently Asked Questions
What is the governance of risk management?
The governance of risk management, or risk governance, is the organizational infrastructure through which a firm defines, implements and oversees risk management. It includes the board and its committees, the risk appetite statement, the senior risk committee and chief risk officer, the limit framework and its escalation rules, compensation policy, and internal audit, together with the channels of communication inside the firm and with regulators.
What is the role of the board of directors in risk governance?
The board assesses the risks and rewards in the firm’s business strategy, sets the risk appetite, checks that major transactions fit the approved risk and strategy, ensures that disclosures are adequate, and makes sure executives are paid on risk-adjusted performance. It oversees rather than manages, and it is ultimately accountable when risk policy is ignored or violated.
What is a risk appetite statement?
A risk appetite statement is a written statement of the aggregate level and types of risk a firm is willing to accept, or to avoid, to achieve its business objectives. It contains qualitative statements and quantitative measures, covers hard-to-quantify risks such as reputation and conduct, and is linked to the firm’s strategy, capital plans and compensation.
What is the difference between Tier 1 and Tier 2 limits?
Tier 1 limits are specific, such as an overall limit by asset class, an overall stress test limit or a maximum drawdown limit, and a breach must be cleared immediately. Tier 2 limits are more general, covering business activities and aggregated exposures by rating, industry, maturity or region, and a breach can be cleared within a few days or a week.
Why should the chief risk officer be independent?
The CRO must be able to challenge business decisions that could breach the risk appetite. Best practice is for the CRO to report directly to the chief executive, hold a seat on the board risk committee, have a voice in approving new products and businesses, and have a clear right to raise any concern with management at every level and with the board. MF Global, where repeated CRO warnings were overridden, showed the cost of weak independence.
How did compensation contribute to the financial crisis?
Many bonuses were tied to short-term profit or business volume and worked like call options, paying out on gains with no penalty on losses. That rewarded staff for taking more risk and pushing losses into the future. Post-crisis standards endorsed by the G-20 in 2009 call for deferral, clawbacks, share-based pay, limits on variable pay and independent compensation committees.
What does the audit committee do in risk governance?
The audit committee is responsible for the accuracy and completeness of financial and regulatory disclosures and for compliance with best practice in regulatory, legal, compliance and risk management matters. Its distinctive role is independent verification that the firm is doing what it claims, judging the quality as well as the accuracy of reporting, controls and risk processes, supported by an internal audit function independent of risk management.
