Implementing Robust Risk Appetite Frameworks

to Strengthen Financial Institutions

1-16

FRMFinancial Risk Manager

Risk Appetite Framework (RAF)

A defined risk appetite statement and a properly designed RAF are both required
to properly manage a firms risk and serve as an important element of corporate
governance. They are meant to be used together to provide clear guidance in risk
management. They also attempt to achieve risk management congruence
regarding the expectations of the board of directors, senior management, the
firms risk management team, regulatory agencies, and stakeholders.
Risk appetite is defined as the amount and type of risk that a firm is able and
willing to accept in pursuit of its business objectives. The firms risk appetite
must not exceed its risk capacity (i.e., the maximum amount of risk the firm can
take).

2-16

FRMFinancial Risk Manager

Risk Appetite and Risk Culture

Risk culture is a system of values and behaviors present in employees (including
management) throughout a firm that directly impacts analysis of information
pertaining to risk and ultimately impacts decisions about which risks the firm will
take.
There is a clear connection between a firms risk culture and its risk appetite; a
strong RAF sets the stage for and reinforces a strong risk culture. In reverse, a
strong risk culture makes it easier to set an RAF.

3-16

FRMFinancial Risk Manager

RAF Implementing Challenges

Key challenges to implementing RAFs include:

Properly transmitting the RAF within the firm together with incorporating the
RAF into making day-to-day operating decisions.

Establishing a clear connection between RAFs and risk culture.

Communicating risk appetite in a manner that captures all relevant risks.

The common view that risk appetite is mainly about setting limits.

The lack of connection between risk appetite and the strategic and business
planning processes.

The role of stress testing in the RAF.

Aggregation of risks at the group level and then down to the individual
business units.

4-16

FRMFinancial Risk Manager

RAF Best practices

Best practices in terms of implementing and communicating RAFs include:

Communication to staff is done in clear language that is easy to understand

and devoid of jargon ().

Educating employees who must comply with risk limits. Those employees
should understand the background and reasons for the limits.

Business unit managers should clearly be responsible for managing risk

within their respective units.

Individuals who are entrusted with approving transactions should try to

illustrate the connection between risk appetite and specific policies and
between risk appetite and approved transactions.

5-16

FRMFinancial Risk Manager

RAF and the Firms Planning Processes

There is a crucial relationship between the RAF and the strategic and capital
planning processes that needs to be structured and constantly reinforced with
open internal communication.
The process involves the following general steps:

Step 1: Establish either a complete risk appetite statement from the board or
some fundamental risk parameters for the individual business units to
consider.

Step 2: The output from the business unit is either a divisional risk appetite
statement or the communication of a risk posture.

Step 3: Risk aggregation of all the business units in terms of the business and
budget plans to be compared with the firms overall risk appetite.

Step 4: Relevant changes are made to the business unit plans or even the
firms overall risk appetite.

6-16

FRMFinancial Risk Manager

The Role of Stress Testing with an RAF as well as Challenges in Firmwide Risk Aggregation

The board and management must understand probability distributions of the

possible outcomes for a number of extreme but plausible scenarios (done through
stress testing).In doing so, stress tests allow them to compute the loss amounts
that would be acceptable in each case. Stress tests could incorporate a wide
variety of macroeconomic scenarios and changes in market variables in order to
determine the magnitude of possible losses in each severe stress scenario.
Firm-wide risk aggregation is problematic because the separate business units
will set their risk appetite parameters, but there is no set method for the firm to
use in determining whether the sum of those parameters is acceptable for the
firms total risk appetite. In other words, when assuming that the quantitative
measures of risk are reliable and accurate, there is still the problem with properly
measuring the less quantifiable risks. This measurement uncertainty introduces a
great deal of doubt that the risk appetite levels set by the business units in
aggregate will be congruent with the firms overall risk appetite.
7-16

FRMFinancial Risk Manager

Example
1.

Lisa Tahara, FRM, is a risk specialist on the board of directors of a financial

institution. Her current task involves the implementation of a new risk appetite
framework (RAF) for the firm. Which of the following concerns is Lisa least
likely to have?
A.

The mitigation of nonquantifiable risks.

B.

The relationship between risk appetite and employee remuneration.

C.

The educating and training of top management on the details of the RAF.

D.

The development of an approach to translate risk appetite statements into

risk limits and tolerances.

8-16

FRMFinancial Risk Manager

Example
1. Answer

9-16

FRMFinancial Risk Manager

Example
2.

You are a member of the senior management team at a bank where you have
spent a significant amount of time assisting with the development of a risk
appetite framework (RAF). With regard to the RAF, which of the following
recommendations would you most likely be willing to make?
I.

In communicating the RAF to the banks employees, information on the

banks risk capacity versus current amount of risk undertaken should be
provided.

II.

An effective RAF should focus primarily on setting appropriate risk limits

within the bank and its respective business units.

A.

I only.

B.

II only.

C.

Both I and II.

D.

Neither I nor II.

10-16

FRMFinancial Risk Manager

Example
2. Answer

11-16

FRMFinancial Risk Manager

Example
3.

Which of the following statements regarding stress testing and firm-wide risk
aggregation is most accurate?
A.

One potential problem with the risk aggregation process is the

underestimation of the diversification effect.

B.

In the context of risk aggregation, stress tests are considered a more reliable
alternative than regulatory and economic capital measures.

C.

The process of stress testing can be performed in a relatively objective

manner given that many common risks are reasonably quantifiable.

D.

Using the results of stress testing, those scenarios that will result in minimal
losses with a very low likelihood of occurrence may be ignored when
considering any adjustments to risk appetite.

12-16

FRMFinancial Risk Manager

Example
3. Answer

13-16

FRMFinancial Risk Manager

Example
4.

Which of the following statements regarding the structured process involved

with risk appetite frameworks (RAF) and strategic and capital planning is most
accurate?
A.

The process concludes with making any needed changes to the business unit
plans.

B.

The process aims to transform as many of the qualitative objectives into

measurable objectives as possible.

C.

The process begins with either a divisional risk appetite statement or the
communication of a risk posture from each of the divisions within the firm.

D.

The process will differ depending on whether the firms planning process is
top down from the board/senior management or bottom up from the
business unit managers.

14-16

FRMFinancial Risk Manager

Example
4. Answer

15-16

FRMFinancial Risk Manager

FRM

16-16

FRMFinancial Risk Manager