Risk Appetite Without Limits at a Digital Lender
A 900-person digital lender has a board risk appetite statement that says it has “low tolerance for regulatory breach” but sets no metrics, thresholds, or escalation triggers. The product team wants to launch a buy-now-pay-later product in six weeks. The risk register contains 180 risks; business units score likelihood and impact differently, and 38% are rated high. Internal audit has 12 overdue remediation items, including two repeat findings on lending disclosures. Compliance sits in the second line but routinely drafts and approves first-line procedures. The CRO left three months ago, and the chief executive chairs the risk committee in the interim. A non-executive director asks you, as an external adviser, whether the launch should proceed and what governance fixes are needed before the next board meeting.
1. Identify the governance deficiencies in this setup and rank them by the seriousness of the accountability gap they create. Explain your ranking.
Read the worked answer
The most serious gap is the absence of an independent CRO while the CEO chairs the risk committee. Risk acceptance and challenge are compromised because the person accountable for commercial delivery controls the forum that should challenge risk. Second is the second line drafting and approving first-line procedures: compliance is reviewing its own work, so the three-lines model is structurally blurred and no one can attest to independent oversight. Third is an unmeasurable risk appetite. “Low tolerance” without thresholds gives the board no basis to approve, reject, or escalate a launch. Fourth is inconsistent risk scoring: 38% high ratings across 180 risks signals an uncalibrated register, so the board cannot compare the BNPL risk with other exposures. Fifth are overdue and repeat audit findings, which show remediation is not being enforced. I would rank the repeat disclosure findings above the scoring issue because they indicate a known regulatory breach risk that has already been tested and failed, not merely a reporting weakness.
2. Recommend decision rights, escalation triggers, and evidence the board should require before approving the BNPL launch.
Read the worked answer
Decision rights should be explicit. The product committee proposes the launch and owns first-line controls. An independent second-line compliance function assesses regulatory obligations and has a veto when a reportable breach is likely. The risk committee challenges the residual risk and recommends acceptance only within board-approved limits. The board approves any launch whose residual risk exceeds those limits or whose control evidence is incomplete. The CEO should not chair the risk committee during this decision; appoint an independent chair or a non-executive risk chair.
Escalation triggers should include any unresolved repeat audit finding touching disclosures, any launch control that has not been tested, a regulatory change affecting the product, or a complaint or breach metric above an agreed threshold. Before approval, require a product-level risk assessment mapped to the risk appetite, a control matrix with named owners and test dates, legal sign-off on disclosures, an issue-closure plan for the two repeat findings, and a pre-launch sample test of disclosure accuracy. Also require a documented residual-risk acceptance if any gap remains. A six-week timeline is not itself a reason to skip these conditions; if evidence is missing, the board should defer the launch or approve a limited pilot with strict limits.
3. Design a 90-day test of whether the risk appetite statement is operating effectively, including data sources and pass/fail criteria.
Read the worked answer
Translate the statement into eight to ten measurable appetite metrics, each with an owner, threshold, and escalation route. Examples: number of reportable regulatory breaches, disclosure defect rate in pre-launch testing, overdue high-risk audit issues, complaint rate, and percentage of launches with completed risk assessments. Do not use only lagging incident counts; include leading control evidence.
Data sources should include the risk register, issue tracker, incident log, board and risk committee minutes, compliance monitoring results, and launch approval records. The test should sample at least ten decisions, including the BNPL launch decision, and ask whether the metric was reported, whether a breach of threshold was escalated within five business days, and whether the forum challenged the evidence. Pass criteria can be: all metrics reported monthly to the risk committee; 100% of threshold breaches escalated and documented; no launch approved without a completed risk assessment; board minutes show at least one substantive challenge per quarter; and repeat audit findings reduced to zero. Fail criteria include any unreported breach, any launch approved outside authority, or any metric without an owner. Report the result independently to the board, with remediation actions and a re-test date.