Risk appetite, tolerance, limits and risk-reward trade-offs
What the exam tests
Risk appetite: translating appetite into tolerances, limits and risk-adjusted decisions. Questions ask you to critique appetite statements and design limit frameworks.
Core rules
- Risk capacity is the maximum risk an organisation can bear; risk appetite is the amount it chooses to seek; tolerance is the acceptable deviation around appetite; limits are operational thresholds.
- A good appetite statement is specific, measurable, linked to strategy and capital, and covers upside and downside. It should state which risks are sought, constrained or avoided.
- Cascade appetite to business units, products and legal entities; use KRIs with escalation triggers and clear breach protocols.
- Risk-reward: compare return to risk-adjusted capital (RAROC, economic profit), not just absolute profit.
Worked example
Two projects: A earns £12m on £100m economic capital; B earns £9m on £50m. RAROC: A 12%, B 18%. Hurdle rate 15%. Reasoning: A has higher absolute profit but destroys value against the hurdle; B creates value. If capital is scarce, B is preferable, subject to appetite and strategic fit. This is the core risk-reward test, not a choice based on headline revenue.
Traps
Appetite written as adjectives ('prudent', 'conservative'); tolerance set looser than appetite; limits with no owner or escalation; ignoring return; treating a breach as a reporting event rather than a decision trigger.