Framework and Risk Appetite
What the exam tests
This domain tests whether you can translate strategy into a risk appetite statement and cascade it into limits, triggers, and reporting. Questions often ask the difference between risk capacity, appetite, and tolerance, and how a breach should be handled.
Core rules and concepts
- Risk capacity is the maximum risk an institution can bear before breaching regulatory or solvency constraints. It is set by capital, liquidity, and external rules.
- Risk appetite is the amount and type of risk the board is willing to accept to pursue strategy. It is narrower than capacity.
- Risk tolerance is the acceptable variation around appetite, often expressed as a trigger or limit.
- A risk appetite statement should be specific, measurable, and linked to strategy. It covers quantitative limits and qualitative statements.
- Cascade appetite into business-line limits, risk indicators, escalation triggers, and board reporting.
- A limit breach requires escalation, remediation, and documented approval for any temporary exception.
Worked example
A firm has capital that supports maximum risk exposure of PKR 10 billion before breaching its regulatory minimum. The board sets appetite at PKR 6 billion and tolerance at PKR 7.5 billion. Current risk is PKR 6.8 billion. This is above appetite but within tolerance, so it is not an automatic regulatory breach. The correct response is to trigger remediation, report to the board risk committee, and reduce exposure or obtain a documented temporary appetite increase. Doing nothing because tolerance has not been breached weakens the framework.
Traps that cost marks
Do not treat capacity as appetite: capacity is the outer constraint. Do not set tolerance above capacity. Do not write an appetite statement as a single profit target or a vague slogan. Do not confuse a limit with a risk indicator. Do not allow business units to set their own limits outside the cascade.