Risk Appetite, Strategy and Risk Culture
Risk Appetite
The appetite hierarchy
Risk capacity is the maximum risk the firm can bear before breaching binding constraints such as capital, liquidity or business-model viability. Risk appetite is the amount and type of risk the firm is willing to seek or accept in pursuit of its strategy. Risk tolerance is the acceptable deviation from appetite for a given risk type. Limits and triggers convert tolerance into operational thresholds, monitored through KRIs and reported to the board.
Good practice
An appetite statement should be board-approved, linked to strategy and the business plan, expressed in both quantitative terms (capital, earnings volatility, liquidity, concentration) and qualitative terms (conduct, reputational, regulatory), and should cascade into business-line and legal-entity limits. Appetite is forward-looking and dynamic; it is reviewed at least annually and after any major strategic change, acquisition or market shock.
Traps
- Treating "zero appetite" language as meaningful - absolute zero is rarely credible or operational. Better phrasing: no tolerance for deliberate or repeated breaches.
- Confusing appetite (what you want) with capacity (what you can bear) with tolerance (how much deviation is allowed).
- Setting qualitative statements with no measurable cascade to limits.
- Assuming limits equal appetite rather than being one translation of it.
- Setting an appetite that the business plan cannot be delivered within.
Worked example: a bank states appetite for credit losses of no more than 40bp of average loans through the cycle. Tolerance is 50bp; the unsecured retail limit is 45bp. Breaching 50bp triggers board risk committee escalation and a review of the lending plan. The chain appetite → tolerance → limit → trigger is what candidates must be able to reproduce.
Strategy and Risk Culture
Strategy and risk
Strategy-setting and risk management are two sides of one process: the chosen strategy determines the risk profile, and the risk profile constrains the strategy. COSO places strategy and objective-setting at the centre of ERM for precisely this reason. Strategic risk - the risk that strategic decisions, execution, or changes in the competitive and regulatory environment erode capital or franchise value - should be assessed alongside the plan, not after it.
Risk culture
Risk culture is the observable system of values, behaviours and incentives that determines how risk is actually taken, as distinct from the formal framework on paper. It is driven by tone at the top, accountability and ownership, effective challenge, incentive design, and the ability to speak up without fear of retaliation. Regulators such as the FSB emphasise that culture is assessed through behaviours and outcomes, not policy statements.
What questions test
- That incentives are the strongest cultural lever: sales-volume bonuses with no risk adjustment reliably drive mis-selling and conduct failures.
- That "tone at the top" alone is insufficient without "tone in the middle" - the business unit leaders who set day-to-day expectations.
- That culture cannot be delegated to the risk or compliance function.
- That strategic risk is not the same as operational or business risk, even when the loss occurs during operations.
- That culture is measurable through evidence, not assertion.
Rule of thumb: assess culture by triangulation - staff surveys, interviews, KRI evidence (escalations raised, near misses reported), audit findings, and incentive design review. No single indicator is decisive, and a clean survey in a firm with rising unreported incidents is a warning sign, not reassurance.