The Risk Appetite That Nobody Owned
A mid-sized insurer's board approved a risk appetite statement 14 months ago. It contains 9 qualitative statements ('we are conservative on underwriting risk') and 2 quantitative limits: a 200% regulatory solvency coverage floor and a 5% cap on any single reinsurer's share of ceded premium. The CRO reports quarterly to the Audit Committee, not the Board Risk Committee, because the Risk Committee charter was never updated after a 2023 restructuring. In Q3 the company breached the 5% reinsurer concentration limit for six weeks before anyone noticed; the breach was found by an external actuary during a separate project. The CFO argues the limit is 'operational, not strategic' and should sit with management. The internal audit head has flagged that no one can show evidence the board ever discussed the two quantitative limits after approval.
1. Assess the governance failures revealed here. Which are structural (charter/design) and which are behavioural (practice), and why does the distinction matter for remediation?
Read the worked answer
Structural failures are defects in how accountability is wired:
- The CRO's reporting line runs to Audit Committee while a Board Risk Committee exists - the charter never caught up with the reorganisation. This is a design gap, not a person failing.
- The risk appetite statement mixes 9 unmeasurable qualitative statements with 2 hard limits but assigns no owner, no monitoring frequency, and no escalation trigger to the limits.
Behavioural failures are how people actually operate within that design:
- A six-week undetected breach found by an outsider, not by the second line.
- No board record of discussing the limits post-approval - approval without ongoing oversight.
- The CFO reframing a board-approved limit as 'operational' to move it out of board sight.
The distinction matters because remediation differs. Structural gaps are fixed by charter amendment, a defined risk-appetite ownership matrix, and a monitoring calendar with named owners. Behavioural gaps need escalation protocols, board minutes discipline, and consequences for non-escalation. Fixing only the charter leaves the CFO's reframing unchallenged; fixing only behaviour leaves the reporting line ambiguous. Note also that the CFO's 'operational vs strategic' argument is itself a governance risk: a limit the board approved cannot be reclassified by management unilaterally. The board owns appetite; management owns operation within it.
2. The CFO proposes moving the 5% reinsurer limit to management ownership. Evaluate this proposal against good governance principles.
Read the worked answer
The proposal conflates who operates a limit with who owns the appetite behind it. Management can and should monitor and operate the limit day to day; that is normal. But the board set 5% because it reflects a strategic tolerance for counterparty concentration - a decision about how much loss the organisation is willing to absorb from a single reinsurer failure. That is an appetite decision, and appetite is a board reserve.
A defensible compromise: management owns monitoring, data quality, and first-line escalation; the board (via the Risk Committee) retains ownership of the threshold and must approve any change. The CFO's framing should be tested - if the limit genuinely needs to move because it is mis-specified (e.g., it should measure exposure net of collateral, or apply per legal entity), that is a legitimate recalibration request routed through the Risk Committee with rationale. What is not legitimate is reclassifying it to escape oversight after a breach.
Governance test: would the board still learn of a breach within a defined window? If the answer becomes 'only if management chooses to tell them', the proposal fails.