Operational risk appetite, tolerance and governance
Risk appetite is the board's statement of how much operational risk the firm will accept to pursue its strategy. The exam tests the difference between appetite, tolerance and capacity, how appetite is expressed and cascaded, and the governance that makes it real.
The three terms
- Risk appetite: the amount and type of risk the firm is willing to accept.
- Risk tolerance: the acceptable variation around appetite - the thresholds that trigger escalation.
- Risk capacity: the maximum risk the firm could bear before breaching capital, liquidity or regulatory obligations. Capacity is a hard constraint; appetite should sit well below it.
Expressing appetite
Good operational risk appetite statements are specific and measurable, combining qualitative statements ("we have a low appetite for regulatory breaches") with quantitative metrics (number of losses above £1m, percentage of key controls tested on time, critical incidents per quarter). A statement that says only "we have a low appetite for operational risk" cannot be monitored or breached, and therefore cannot be governed.
Cascade and governance
Board approves; the board risk committee oversees; the CRO owns the framework; business lines hold sub-appetites aligned to their processes. Each metric needs an owner, a reporting frequency and escalation routes. Breaches should trigger a documented response, not just a red cell on a dashboard.
Worked example
Appetite: "no more than two operational losses above £1m per financial year." By September there have been three. Reasoning: this is an appetite breach, not merely a variance. It must be escalated to the board risk committee, logged with root causes, followed by a remediation plan and a decision - accept and reset the limit, or reduce exposure. Remaining silent until year-end is the failure examiners look for.
Culture and incentives
Governance includes tone at the top, whistleblowing channels, the SM&CR (senior managers are accountable for the risks in their area) and remuneration design that does not reward volume at the expense of control.
Traps that cost marks
- Confusing appetite with tolerance, or tolerance with capacity.
- Setting appetite with no metrics, owners or escalation routes.
- Assuming "zero tolerance" is workable for all operational risk - it is credible for fraud or sanctions breaches, not for processing errors.
- Ignoring the link between risk appetite and capital planning.