Risk Management Fundamentals and Governance
Core definitions and the risk vocabulary
Risk is the effect of uncertainty on objectives, expressed as a combination of likelihood and impact. Candidates must distinguish inherent risk (before controls), residual risk (after controls), and target risk (the level the board is willing to accept). Risk appetite is the amount of risk the organisation chooses to pursue; risk tolerance is the acceptable variation around that appetite; risk capacity is the maximum risk it could bear before breaching capital or solvency constraints. Confusing appetite with capacity is the most common trap.
Governance architecture
Governance assigns authority and accountability. The board sets appetite and oversees the risk framework; the board risk committee provides detailed challenge; the chief risk officer leads the second line; business units own risk in the first line; internal audit provides independent third-line assurance. The three-lines model fails when the second line takes ownership of risk decisions, removing first-line accountability.
Traps to watch
- A strong control environment does not eliminate residual risk; it only reduces it.
- Risk appetite statements must be measurable; vague statements such as "we are conservative" are a governance weakness.
- Delegated limits require documented escalation triggers, not informal practice.
Worked rule of thumb
If a firm has risk capacity of 100 units of economic capital, an appetite of 60 units, and a tolerance band of plus or minus 10 units, a business line proposing 75 units is outside appetite even though it is within capacity. The correct answer in an exam question is to escalate to the risk committee for a decision, not to approve because capacity exists.