Risk Management Fundamentals and Governance
Core Concepts
Risk is the effect of uncertainty on objectives, usually expressed as a combination of likelihood and impact. Candidates must distinguish risk appetite (the amount of risk an organization is willing to accept in pursuit of its objectives) from risk tolerance (the acceptable variation around that appetite) and risk capacity (the maximum risk the organization can bear before breaching constraints such as capital or liquidity). Governance defines who owns risk: the board sets appetite, senior management implements policy, and business units own risks. The three lines model is central: the first line owns and manages risk, the second line provides oversight and challenge (risk, compliance), and the third line provides independent assurance (internal audit).
Traps in Questions
- Confusing risk appetite with risk tolerance: appetite is the high-level statement; tolerance is the operational limit.
- Assuming the risk function owns all risks; ownership sits with the business.
- Mixing up the second and third lines: internal audit is third line, not second.
- Forgetting that governance includes culture and incentives, not just committees.
Worked Example
A bank states it has a "moderate" appetite for credit risk. Its retail division proposes a new product with expected loss of 2% of the portfolio. The risk committee compares this to the tolerance limit of 1.5% and rejects it. Here, appetite is the moderate statement; tolerance is the 1.5% limit; the decision follows governance escalation.
Rule of thumb: Appetite is what you say; tolerance is what you measure; capacity is what you can survive.