Launch Commitments Before Risk Appetite
A payments fintech with 700 employees plans to launch a card-issuing product in Brazil in 90 days. The board approved a risk appetite statement two years ago that says the company has 'low tolerance for regulatory and reputational risk,' but it contains no quantified thresholds, no country risk criteria, and no product-specific limits. Legal produced a 15-page memo on licensing; compliance was not consulted until after the launch plan was approved. Sales has signed three pilot clients with contractual go-live dates and penalty clauses. A local partner will handle KYC and customer onboarding. The CEO wants a go/no-go recommendation in ten days; the board wants revenue growth. You are the newly appointed head of GRC.
1. Diagnose the alignment gaps using the Align component. Explain why the existing risk appetite statement cannot support a go/no-go decision.
Read the worked answer
The Align component requires context, objectives, risk assessment, appetite, planning, and alignment across the organization. Here the context has changed, but the appetite has not been operationalized. 'Low tolerance for regulatory and reputational risk' is a statement of preference, not a decision rule. It does not define what level of licensing uncertainty, KYC deficiency, or penalty exposure is acceptable, and it contains no country or product limits.
The process gaps are as serious as the wording. Compliance was consulted after the launch plan was approved, so risk assessment followed commitment rather than informing it. Sales signed contracts with penalty clauses before the organization knew whether the launch conditions could be met. The local partner's KYC role is central to the risk profile but has not been assessed against defined criteria. The result is an alignment failure: business objectives, risk appetite, and planning are moving on separate tracks.
A go/no-go decision needs thresholds. Without them, any recommendation is a judgment without an agreed basis, and the CEO cannot know whether accepting the risk is within board authority. The statement must be translated into product and country criteria before it can support the decision.
2. Recommend what you would put in front of the CEO in ten days. Include how to handle the signed pilot contracts and what escalation is required.
Read the worked answer
I would present a conditional recommendation, not a binary launch. In ten days, provide a rapid risk assessment covering licensing status, the local partner's KYC controls, data protection obligations, and the financial exposure in the signed contracts. Convert the appetite statement into proposed thresholds for this launch: for example, no live customer onboarding before licensing conditions are met, no high-risk customer segments until KYC testing is complete, and a maximum acceptable penalty exposure if the launch slips.
The signed contracts should be handled transparently. I would recommend notifying the three pilot clients of a controlled pilot schedule and seeking amendments to go-live dates or penalty clauses where launch conditions cannot be met. Proceeding to avoid penalties would convert a commercial commitment into a regulatory and reputational risk that the board has said it has low tolerance for.
Escalation is required because the existing appetite was board-approved and the proposed thresholds are new. The CEO cannot unilaterally redefine low tolerance. I would take the conditional recommendation to the board risk committee with the contract exposure and the partner assessment attached, and ask for explicit acceptance of the residual risk or a decision to delay.