Risk Governance, Appetite, Policies and Limits - Article

Introduction

A bank cannot manage risk effectively merely by measuring credit, market or operational risk.

It also needs a clear system for deciding:

• who is responsible for risk;

• how much risk the bank is willing to take;

• which activities are permitted;

• what limits apply;

• who monitors those limits; and

• what happens when a limit is breached.

This system is broadly called risk governance.

The current IIBF CAIIB BFM Module B syllabus begins with Risk and Basic Risk Management Framework, covering risk, risk-capital-return linkage, need for risk management and the basic risk-management framework. Risk governance, appetite, policies and limits form the practical architecture through which this framework operates.

Basel’s current consolidated corporate-governance guidance, published in 2026, similarly places strong emphasis on Board responsibility, risk appetite, risk limits, independent risk management and clearly defined lines of defence.

Learning Objectives

After studying this topic, you should be able to:

• Explain risk governance in a bank.

• Distinguish risk appetite from risk capacity.

• Understand the Risk Appetite Framework and Risk Appetite Statement.

• Explain the purpose of risk policies and limits.

• Understand Board, senior-management and CRO responsibilities.

• Explain how limit breaches and policy exceptions should be handled.

What Is Risk Governance?

Risk governance is the system through which the Board and management decide how risk will be:

• accepted;

• managed;

• monitored;

• controlled; and

• reported

across the bank.

Basel describes the risk governance framework as the part of corporate governance through which the Board and management:

• establish the bank’s risk approach;

• articulate risk appetite;

• monitor adherence to risk appetite and limits; and

• identify, measure, manage and control risks.

Risk Governance Is Wider than the Risk Department

Risk governance does not mean:

“All risk is the responsibility of the Chief Risk Officer.”

Risk is created throughout the bank.

Examples include:

• a branch sanctioning a loan;

• treasury taking a market position;

• operations processing a transaction;

• IT introducing a new system;

• management entering a new business; or

• a bank outsourcing an important activity.

Therefore, risk governance distributes responsibilities across the organisation.

Board of Directors

The Board has overall responsibility for the bank’s risk governance.

Its major responsibilities include:

• understanding the bank’s material risks;

• approving risk strategy;

• determining overall risk appetite;

• approving important risk policies;

• ensuring adequate capital and liquidity;

• overseeing senior management;

• receiving reports on significant exposures and limit breaches; and

• ensuring an effective risk culture.

Basel requires the Board to take an active role in defining risk appetite and ensuring alignment with the bank’s:

• strategy;

• capital plans;

• financial plans; and

• business objectives.

Board Risk Committee

Banks commonly use a Risk Committee of the Board to provide focused oversight of risk.

Basel’s current governance principles state that the risk committee should:

• discuss risk strategies;

• make recommendations regarding risk appetite;

• review risk policies;

• oversee management’s implementation of risk appetite; and

• interact with and oversee the Chief Risk Officer.

The committee supports the Board but does not remove the Board’s overall responsibility.

Senior Management

The Board provides direction.

Senior management converts that direction into action.

Senior management is responsible for:

• implementing Board-approved strategy;

• developing processes and controls;

• translating appetite into operational limits;

• allocating responsibilities;

• monitoring exposures;

• dealing with breaches;

• maintaining adequate systems; and

• reporting material risks to the Board.

Therefore:

Board sets direction → Management implements it.

Chief Risk Officer and Independent Risk Function

The independent risk-management function forms a key part of the governance framework.

Basel states that banks should maintain an effective independent risk-management function under a Chief Risk Officer (CRO) or equivalent officer with:

• sufficient authority;

• adequate resources;

• independence;

• access to information; and

• access to the Board.

The risk function typically:

• identifies material and emerging risks;

• independently assesses risk exposures;

• helps develop the risk framework;

• monitors compliance with appetite and limits;

• establishes early-warning mechanisms;

• challenges excessive risk taking; and

• reports important concerns to senior management and the Board.

The CRO should not normally be made responsible for generating business revenue because this could weaken independence.

Three Lines of Defence

Basel’s governance framework commonly describes three lines of defence.

First Line – Business Units

Business units:

• originate business;

• take risk; and

• remain responsible for managing the risks arising from their activities.

For example, the credit department cannot say:

“The Risk Department approved the framework, so the borrower risk is no longer our responsibility.”

The business remains responsible for the exposure it creates.

Second Line – Risk Management and Compliance

The second line independently:

• monitors risk;

• challenges business decisions;

• develops frameworks;

• checks limits;

• monitors regulatory compliance; and

• reports material concerns.

Third Line – Internal Audit

Internal Audit independently assesses whether:

• governance;

• risk management; and

• internal controls

are properly designed and functioning effectively.

Basel’s current corporate-governance guidance expressly identifies these three lines while allowing their exact structure to vary according to a bank’s size and complexity.

What Is Risk Appetite?

Risk appetite is the aggregate amount and types of risk that a bank is willing to accept in advance while pursuing its strategic objectives and business plan.

Basel defines it as risk that the bank is willing to assume within its risk capacity.

Examples of risk-appetite decisions include:

• how much concentration in one sector the bank is comfortable with;

• how much market-risk exposure it wants;

• what level of credit quality it wants in its portfolio;

• how much liquidity risk it will accept; and

• which activities it will completely avoid.

Risk appetite therefore connects:

Strategy → Risk → Capital → Return

Risk Capacity

Risk capacity is the maximum amount of risk that the bank can assume given factors such as:

• capital;

• liquidity;

• risk-management capability;

• internal controls; and

• regulatory constraints.

Basel’s current definition specifically links risk capacity with the bank’s capital base, risk-management and control capabilities and regulatory constraints.

Risk Appetite vs Risk Capacity

Risk Appetite Framework

The Risk Appetite Framework (RAF) is broader than a single risk number.

Basel defines RAF as the overall approach through which risk appetite is:

• established;

• communicated; and

• monitored.

It includes:

• the Risk Appetite Statement;

• risk limits;

• policies;

• processes;

• controls;

• systems; and

• responsibilities for implementation and monitoring.

Therefore:

Risk Appetite = desired level of risk. RAF = complete system used to put that appetite into practice.

Risk Appetite Statement

The Risk Appetite Statement (RAS) is the written articulation of:

• risks the bank is prepared to accept;

• risks it wants to limit; and

• risks it wants to avoid.

Basel states that the RAS should contain both:

• quantitative measures; and

• qualitative statements.

Quantitative Examples

The RAS may refer to measures relating to:

• capital;

• earnings;

• liquidity;

• concentration;

• asset quality;

• market risk; or

• other measurable exposures.

Qualitative Examples

Not every important risk can be reduced to one number.

The bank may establish qualitative positions relating to:

• reputation;

• conduct;

• regulatory compliance;

• money laundering;

• unethical activities; or

• business models it does not wish to pursue.

Risk Appetite Must Be Actionable

A statement such as:

“The bank has low appetite for credit risk”

is too vague by itself.

The appetite must ultimately be translated into:

• policies;

• underwriting standards;

• delegation;

• portfolio limits;

• concentration limits;

• product limits; and

• monitoring thresholds.

This creates the practical chain:

Strategy → Risk Appetite → Risk Policies → Risk Limits → Business Decisions → Monitoring

What Are Risk Policies?

A risk policy converts broad risk appetite into detailed rules for managing a particular type of risk.

Examples include:

• credit risk policy;

• market risk policy;

• liquidity risk policy;

• operational risk policy;

• investment policy;

• country-risk policy; and

• outsourcing or information-security policies.

A risk policy may prescribe:

• permitted activities;

• prohibited activities;

• eligibility standards;

• approval authorities;

• risk-measurement methods;

• exposure limits;

• monitoring requirements;

• exception procedures; and

• reporting responsibilities.

Basel requires banks to maintain detailed policies and procedures covering material risks and to ensure that these are consistent with the bank’s risk appetite.

Risk Policy vs Risk Appetite

What Are Risk Limits?

A risk limit is a specific boundary placed on risk-taking activity.

Limits translate appetite into measurable operational restrictions.

Examples include:

• borrower exposure limits;

• group exposure limits;

• sector limits;

• country limits;

• dealer limits;

• position limits;

• stop-loss limits;

• tenor limits;

• liquidity limits; and

• concentration limits.

Basel requires limits to be consistent with the bank’s:

• risk appetite;

• risk profile;

• capital strength; and

• liquidity needs.

RBI’s Basel III/ICAAP framework similarly emphasises Board oversight, detailed risk policies and internal prudential limits linked with the bank’s risk-taking appetite and capacity.

Why Limits Are Necessary

Suppose the Board states:

“The bank wants diversified corporate credit exposure.”

That is an appetite-level objective.

To make it operational, management may need limits covering:

• single counterparties;

• borrower groups;

• industries;

• geographies; and

• products.

Without limits, employees cannot easily determine when exposure becomes excessive.

Therefore:

Appetite provides direction. Limits provide boundaries.

Limit Structure

Limits may exist at several levels.

Bank-Wide Limits

Control total exposure to a major risk.

Portfolio Limits

Control concentrations in:

• sectors;

• ratings;

• products;

• countries; or

• counterparties.

Business-Unit Limits

Restrict risk-taking by a particular unit or desk.

Transaction Limits

Apply to a specific:

• borrower;

• trade;

• counterparty; or

• transaction.

The total limit architecture should remain consistent with the overall risk appetite.

Risk Limit Breach

A limit breach occurs when an exposure exceeds an approved risk limit.

The correct response is not:

“Increase the limit so that there is no breach.”

A proper governance framework requires:

• prompt identification;

• escalation;

• investigation;

• authorised decision;

• corrective action; and

• follow-up.

Basel specifically requires procedures for breaches of risk limits and significant policy deviations, including prompt attention and proportionate remedial action.

Possible responses can include:

• reducing exposure;

• hedging;

• stopping new transactions;

• obtaining specifically authorised temporary exception;

• increasing monitoring; or

• another approved remedial action.

Limit Breach vs Policy Exception

These concepts should not be confused.

Limit Breach

An approved quantitative boundary has been exceeded.

Policy Exception

A transaction or action does not comply with a policy condition but receives approval under a defined exception process.

A properly authorised exception is not the same as ignoring policy.

However, repeated exceptions can indicate:

• weak policy;

• weak risk culture;

• pressure for excessive risk taking; or

• poor enforcement.

Risk Culture

Rules and limits are effective only when people respect them.

Risk culture refers to the attitudes, behaviours and norms that influence how employees understand and manage risk.

Basel states that risk culture affects day-to-day decisions about the risks employees and management assume.

A strong risk culture encourages staff to:

• respect limits;

• report bad news early;

• challenge inappropriate transactions;

• escalate concerns;

• avoid manipulation of controls; and

• consider long-term risk rather than only short-term profit.

Practical Banking Application

Assume a bank wants to expand lending to commercial real estate.

The process should not begin simply with:

“The sector offers attractive interest income.”

Board and Strategy

The Board decides whether expansion is consistent with the bank’s strategy.

Risk Appetite

The bank determines how much exposure and concentration it is willing to accept.

Risk Policy

The credit policy specifies:

• borrower eligibility;

• appraisal requirements;

• security;

• repayment criteria;

• approval authority; and

• monitoring standards.

Risk Limits

The bank establishes limits for:

• overall sector exposure;

• groups;

• individual borrowers; and

• relevant products.

Business Unit

The business originates loans within these rules.

Risk Function

The independent risk function monitors:

• exposure;

• concentration;

• exceptions;

• limit utilisation; and

• emerging risks.

Board and Management Reporting

If exposure approaches or breaches the approved boundary, it is escalated and corrective action is considered.

This demonstrates the complete chain:

Governance → Appetite → Policy → Limits → Business → Monitoring

CAIIB Exam Focus

Remember these high-value concepts:

• Risk governance defines responsibilities and decision-making around risk.

• The Board has overall responsibility for risk governance.

• Senior management implements the Board-approved framework.

• The CRO/risk function should remain sufficiently independent from risk-taking business functions.

• Business units form the first line of defence.

• Risk management and compliance form the second line.

• Internal Audit forms the third line.

• Risk appetite is the amount and type of risk the bank is willing to assume.

• Risk capacity is the maximum risk the bank can bear.

• Risk appetite should remain within risk capacity.

• RAF is broader than the Risk Appetite Statement.

• RAS contains the written articulation of the bank’s appetite.

• Risk appetite can contain quantitative and qualitative elements.

• Policies translate appetite into detailed management rules.

• Limits translate appetite and policy into measurable operating boundaries.

• Risk limits should align with risk appetite, capital and liquidity.

• Limit breaches require escalation and corrective action.

• A formally authorised policy exception is different from an unauthorised deviation.

• Risk culture determines whether written policies actually influence employee behaviour.

Common Exam Traps

Trap 1: “Risk Governance Is the Responsibility of the CRO Alone”

Incorrect.

The Board has overall responsibility, management implements the framework, business owns its risks and independent control functions provide monitoring and assurance.

Trap 2: “Risk Appetite Means Maximum Risk the Bank Can Survive”

Incorrect.

That is closer to risk capacity. Appetite is the risk the bank chooses to accept within its capacity.

Trap 3: “Risk Appetite Framework and Risk Appetite Statement Are the Same”

Incorrect.

The RAS is one important component of the broader RAF.

Trap 4: “Risk Appetite Must Consist Only of Numerical Limits”

Incorrect.

Basel expects both quantitative and qualitative considerations.

Trap 5: “A Policy and a Limit Are the Same”

Incorrect.

A policy provides broader rules and standards. A limit establishes a specific boundary.

Trap 6: “The Business Unit Transfers Its Risk Responsibility to the Risk Department”

Incorrect.

The business is the first line of defence and remains responsible for managing the risk it originates.

Trap 7: “A Limit Breach Can Be Solved Simply by Increasing the Limit”

Incorrect.

A breach requires proper escalation, assessment and authorised remedial action.

Trap 8: “Internal Audit Is the Second Line of Defence”

Incorrect.

Independent risk management and compliance form the second line. Internal Audit is the third line.

Memory Technique

Remember G-A-P-L:

• G – Governance: Who controls and oversees risk?

• A – Appetite: How much risk are we willing to take?

• P – Policy: What rules govern that risk?

• L – Limits: What measurable boundaries must not be crossed?