Risk Appetite That Bites
A retail bank has a risk appetite statement that says it is 'conservative' and seeks to 'avoid material losses.' Business lines complain it gives no guidance: a treasury desk wants to know how much interest-rate risk it may take, and a lending team wants a concentration limit for a single sector. The CRO argues the statement is unusable because it has no metrics, thresholds, or escalation triggers. The CEO likes the statement because it is broad and 'gives us room.' Last year a sector concentration built up quietly to 22% of the loan book before anyone flagged it, and the board was surprised. The CRO has one chance at the next board meeting to propose a revised appetite framework, and the CEO has signaled he will resist anything that looks like a hard constraint on growth.
1. Explain why a qualitative-only risk appetite statement failed here, and what properties a usable statement must have.
Read the worked answer
A statement that says 'conservative' and 'avoid material losses' is a sentiment, not a constraint. It failed because it could not be operationalized: no one could test a proposed transaction against it, so it provided no decision rule and no trigger for escalation. The 22% sector concentration grew because no threshold existed to define 'too much,' and no one was accountable for monitoring it. A usable appetite statement needs four properties. Specificity: it names the risk and the dimension being limited (e.g., sector concentration as a share of the loan book). Measurability: it has a metric that can be computed from existing data. Thresholds: it defines appetite (target), tolerance (trigger for escalation), and limit (hard boundary), ideally with a buffer. Ownership and response: it names who monitors and what happens at each threshold. It should also be forward-looking enough to catch drift, not just a point-in-time cap. Broad language can remain as a preamble, but it cannot substitute for quantified tolerances where the risk is material.
2. The CEO resists hard constraints on growth. Recommend how the CRO should design the framework to be usable yet politically viable.
Read the worked answer
Reframe constraints as decision rights and escalation, not prohibitions. Design a three-tier structure: a green zone where business proceeds without approval; an amber zone where growth is allowed but requires documented sign-off and a remediation plan; a red zone that triggers mandatory escalation to the risk committee, not an automatic ban. This gives the CEO room-growth continues into amber with visibility-while ensuring nothing grows silently to 22% again. Use the past concentration as the design case: a 15% amber trigger and 20% red trigger would have surfaced the issue at 15%, long before the board was surprised. Set thresholds with a buffer so normal business is not constantly tripping them, and calibrate to the bank's capital and earnings volatility. Present the framework as enabling growth within known bounds rather than blocking it. Emphasize that the cost of the old approach was a board surprise, which is a governance risk in itself. Offer to review thresholds annually so the CEO sees flexibility built in.
3. How should the CRO handle the treasury desk's request for an interest-rate risk limit within this framework?
Read the worked answer
Translate the desk's request into a metric the framework can govern. Interest-rate risk is multi-dimensional: earnings sensitivity (e.g., change in net interest income for a 100bp shift), economic value sensitivity, and duration mismatch. Pick one or two primary metrics that are computable and meaningful, set appetite and tolerance levels, and define the escalation response. Avoid a single blunt limit that the desk can game by shifting to another dimension. Set the limit with a buffer above normal operating ranges so the desk is not perpetually in amber, and require the desk to propose its own operating range within the approved tolerance-this builds ownership and reduces resistance. Specify monitoring frequency (e.g., monthly, with daily monitoring if near amber), the owner, and the reporting line to the risk committee. Document the rationale for the calibration so it survives staff turnover. The goal is a limit the desk understands, can manage to, and that gives the board early warning-consistent with the tiered structure used for sector concentration.