Risk Governance
Risk governance tests board and senior management accountability, committee structure, risk appetite oversight, the CRO's independence, escalation, and risk culture.
Core rules and concepts
- Basel's Corporate Governance Principles for Banks (2015) require the board to approve risk appetite, oversee risk, ensure an independent risk function and CRO, and align compensation with risk.
- The board risk committee should be independent and competent; the CRO should have stature, access, and independence from revenue lines.
- Three lines: business owns risk; risk and compliance challenge; audit provides assurance. Governance must avoid blurred accountabilities.
- Risk culture is evidenced by tone at the top, incentives, speak-up, accountability, and consistent consequences, not by statements alone.
- Policies, delegated authorities, limits, and escalation paths should be documented and tested; breaches require timely reporting and remediation.
- New product, outsourcing, and model governance require sign-off before launch.
Worked example
A trading desk exceeds its VaR limit by 20% near quarter-end. The desk head asks the CRO to delay reporting until after bonus calculation. The CRO refuses and escalates to the board risk committee under the approved escalation policy. The committee requires a remediation plan, reviews whether the limit was set correctly, and adjusts compensation to reflect the breach. Independence is tested by the CRO's reporting line and board access, not personal seniority.
Traps that cost marks
CRO reporting to the CFO; board approving appetite without monitoring; treating audit as second line; unclear escalation; culture surveys used as the only evidence; no consequences for breaches.