OR 2 – Risk Governance

An operational risk management framework (ORMF) rests on a small number of load-bearing elements. Risk governance decides who is responsible for what and how decisions travel through the firm. Risk appetite states how much operational risk the firm is prepared to carry and in which activities. Risk culture describes how people throughout the organization actually behave when they meet a risk, an error or a piece of bad news. Around all three sits prudential regulation, which in the financial industry has been one of the strongest reasons why firms built formal operational risk functions in the first place.

These elements are not independent of one another. A risk appetite that the board approves but nobody in the business understands has no effect, and a governance structure full of committees achieves little if staff hide incidents because they fear blame. So, the order in which the lesson treats them (regulation, governance, appetite, culture) follows the order in which a firm usually has to put them in place, but the four only produce good outcomes when they reinforce one another.

Why culture carries more weight for operational risk

Credit risk is concentrated in lending decisions, market risk in trading positions and liquidity risk in funding and treasury. Operational risk is different because it is generated in every process, system and transaction, by every employee and every supplier. It is the most decentralized of the regulated risk types. A central risk team cannot watch every keystroke, so the effectiveness of operational risk management depends heavily on the attitudes of ordinary staff: whether they report near misses, whether they follow procedures when nobody is checking and whether they escalate a problem early. That is why the “tone from the top” set by directors and senior managers matters, and why it should be consistent with the stated risk appetite. Tone alone is not enough, though. What counts in the end is whether risk management is respected, merely tolerated or quietly resisted in the day-to-day running of the business.

The rest of the lesson moves from the outside in. It begins with what regulators require and how they check it, then turns to the internal machinery of committees, the board and the three lines of defense, and closes with risk appetite and risk culture.

Operational risk entered banking regulation with Basel II, first published in June 2004. Earlier capital rules looked almost entirely at credit risk and, later, market risk. Basel II widened the scope of supervision by organizing it around three pillars, so that minimum capital became only one of several tools available to supervisors.

Why management principles sit inside Pillar 1

For credit and market risk, Pillar 1 is mainly a calculation. For operational risk, regulators accepted from the start that a capital number cannot fully protect a bank. A catastrophic failure of systems, a large fraud or a major conduct scandal can produce losses that no reasonable capital buffer would absorb if the firm also lacks sound management. So, operational risk stands alone among risk types in having principles of good management written into the Pillar 1 regulation itself. The message to banks is that sound operational risk management is a binding requirement and not a voluntary refinement.

Pillar 2 complements this by letting supervisors charge more capital where the Pillar 1 formula misses something about a particular firm, and Pillar 3 adds outside pressure through disclosure. Together, the three pillars mean that a bank is judged on its capital, on the quality of its risk management and on how transparently it reports both.

The Basel Committee on Banking Supervision (BCBS) first set out its principles for sound operational risk management in 2003, then revised them in 2011 so that they reflected what the financial crisis had taught. In October 2014 the Committee published a review that worked like a benchmarking survey: 62 participating institutions scored themselves against 149 statements linked to the 11 principles then in force, and supervisors described what “good” practice looked like under each principle.

The current version, the revised principles known by the acronym RPSMOR, was published in March 2021 and raised the number of principles from 11 to 12. It opens with general expectations on the scope of risk management, what each of the three lines of defense is responsible for and how senior management should be involved, and then sets out the principles below. The left column groups them by theme, which is a helpful way to remember them.

Several later sections of this lesson map directly onto these principles. Principle 1 underlies the discussion of risk culture, Principles 3 and 5 describe the split between the board and senior management, and Principle 4 is the regulatory anchor for operational risk appetite. The principles also close with guidance to supervisors, covered in a later section, on how they should evaluate a bank against all of the above.

The financial crisis of 2007 to 2009 led to a partial overhaul of Basel II, but the operational risk rules were left as they were for some years. Work on a new Pillar 1 method started in 2015 and was finalized in the Basel III update of December 2017. That update ended the three-approach regime and replaced it with a single method, first called the Standardized Measurement Approach (SMA) and later renamed the Standardized Approach (SA). The Basel Committee originally set a start date of January 2022, which was postponed because of the COVID-19 pandemic. The SA applies from January 2023, with transitional arrangements until January 2025.

The SA computes operational risk capital (ORC) as the product of two pieces: a size-based component and a loss-history multiplier.

The business indicator

The business indicator (BI) is a proxy for the size of the bank’s activities and replaces the gross income measure of the older approach. It adds three components, each averaged over the latest three years, meaning the current year t and the two years before it (a bar over a term marks this average).

The interest, leases and dividend component (ILDC) captures net interest margin activity but caps it at 2.25% of interest earning assets, so a bank with an unusually wide margin is not penalized without limit. The services component (SC) takes the larger of the two sides of fee business and of other operating business, so it grows with activity whether that activity produces income or expense. The financial component (FC) uses the absolute value of net profit and loss on the trading book and the banking book, because a large loss signals as much operational activity as a large gain.

From BI to BIC: marginal coefficients

The business indicator component (BIC) is not a flat percentage of BI. It applies rising marginal percentages to successive slices: 12% on the part of BI below €1 billion, 15% on the part from €1 billion to €30 billion, and 18% on any part above €30 billion. The rising scale reflects a regulatory view that operational risk grows more than proportionally with size, since larger organizations run more complex processes, operations and interactions, and that extra complexity calls for extra capital.

The second factor in the SA, the internal loss multiplier (ILM), adjusts the size-based BIC for the bank’s own loss record. Its purpose is to charge more capital to banks whose operational losses over the previous 10 years have been heavy relative to their size, and less to banks with a cleaner history. The loss record enters through the loss component (LC), defined as 15 times the bank’s average annual operational losses over the 10 previous years.

The formula is built so that the comparison between LC and BIC drives the result. When LC equals BIC, the bracket becomes e − 1 + 1 = e and the natural logarithm of e is exactly 1, so capital equals BIC. When LC is larger than BIC, ILM rises above 1 and capital rises above BIC; when LC is smaller than BIC, ILM falls below 1. The exponent of 0.8 and the logarithm dampen the effect, so a bank whose loss component is four times its BIC does not hold four times the capital.

National discretion over the ILM

The loss multiplier has been controversial, partly because it ties capital to past losses that may no longer reflect current controls. Basel left its use to national regulators, and many may simply set ILM equal to 1, in which case capital reduces to BIC alone. A student should therefore read the SA as “BIC adjusted by loss history where the national regulator chooses to apply it”.

Until January 1, 2023, banks chose among three methods for Pillar 1 operational risk capital. They are no longer the current rules, but they explain why the SA looks the way it does, and the terminology still appears in older documents and exam questions.

In the BIA, gross income is the total of net interest income and net non-interest income, using the definitions set by national supervisors or accounting standards. Any year with zero or negative gross income is left out of both the numerator and the count of years. TSA refined this by giving riskier business lines a higher beta, but the evidence of operational losses across business lines over the past 20 years did not support the assumed ranking of riskiness, which is one reason the reform moved away from it.

The AMA let a bank estimate its own capital need, provided the regulator in every country where it was incorporated validated the model and framework. The required standard was capital sufficient for all losses up to a 99.9% confidence level over a one-year horizon, which can be read as surviving operational losses in 999 out of 1000 simulated years. Internal models were flexible but hard to compare across banks, and the SA replaced them with one formula for everyone.

Pillar 1 is a formula, and every formula misses something. Pillar 2 gives the supervisor a largely qualitative tool to correct for that, by raising the Pillar 1 requirement with an add-on that better reflects the nature and size of a particular firm’s exposure. Typical triggers are a portfolio concentrated in one market or one class of clients or counterparties, unusually fast growth (as at some FinTech banks), or an inability to demonstrate good risk management practice. In each case the supervisor judges that the formula understates operational risk and asks for extra capital to compensate.

What supervisors review under Pillar 2

A Pillar 2 assessment looks at the arrangements, strategies, processes and mechanisms the firm has put in place to meet its regulatory obligations, scaled to the nature, size and complexity of what it does. It also considers additional risks that stress testing brings to light, and it ends with a view on whether the firm’s capital is adequate for its risks. Beyond solvency, supervisors use Pillar 2 to examine governance arrangements, corporate culture and values, and whether managers can perform their duties, which in practice depends on risk reporting that is effective, comprehensive and reliable.

For any risk type, a solvency assessment requires the firm to identify its key threats, build scenarios for large loss events and test its resilience to internal and external shocks that would change its operating environment, business plan or profitability.

The labels differ, but the logic is the same everywhere: the firm assesses its own capital need first, and the regulator then validates the result or amends it, often upward.

The Basel Committee writes principles, not national law. Its guidance strongly shapes what regulators around the world require, so it is a useful single reference for expectations that are broadly shared across jurisdictions. Day-to-day supervision, however, is carried out by national and regional authorities, and firms are encouraged to read what their own regulators publish. Those publications often give practical guidance on specific operational risk topics such as outsourcing, FinTech banks, the operational effects of COVID-19, and conduct and culture.

The United States is the most fragmented case, because responsibility is shared between state regulators and three main federal bodies, and which federal body supervises a bank depends on its charter and its membership of the Federal Reserve System. The United Kingdom, after the financial crisis, separated prudential supervision (the PRA) from conduct supervision (the FCA), a “twin peaks” design that places conduct risk, a major operational risk category, under a dedicated regulator.

The Basel Framework, which brings together all BCBS standards, contains the Basel Core Principles for Effective Banking Supervision. There are 29 of them, describing what a supervisory system needs in order to work. Five are especially relevant to how supervisors look at risk management in general and at operational risk in particular.

Read together, these principles ask for four things: an assessment of the risk profile that looks forward, strong governance policies supporting a complete risk management framework, the management of all material risks within the firm’s risk appetite, and a sound control environment.

The role of supervisors under the RPSMOR

The RPSMOR ends with guidance to supervisors, which can be read as a four-step cycle. Supervisors should regularly evaluate each bank’s ORMF by examining its operational risk policies, processes and systems (Para. 69). That evaluation should cover every area set out in the principles, not a convenient subset (Para 70). Where the review finds deficiencies, supervisors should take steps to make sure the bank corrects them (Para. 71). Finally, supervisors should encourage continuing improvement by monitoring and comparing banks’ recent progress and their plans for further development (Para. 72).

The cycle matters because it shows that supervision of operational risk is not a single inspection. A bank that passes one review is still expected to keep developing its framework, and the supervisor benchmarks that progress against peers.

Regulators do not want operational risk management to exist only as a set of approved documents. Their core expectation is that risk considerations shape real business decisions at every level and that staff throughout the firm take part in them. A bank should be able to show a supervisor or an auditor how a given decision was reached and that risk was weighed properly along the way. Checking whether this actually happens is known as the use test.

Much of the evidence comes from operational risk reporting. A supervisor applying the use test typically probes six areas.

Absence of evidence is evidence of absence

Many firms fail the use test not because they do nothing but because they cannot prove what they do. Regulators work on a simple presumption: if a practice cannot be evidenced, it is treated as not taking place. Smaller firms are especially exposed, since they often lack systematic documentation and sometimes a formal governance structure. The most effective defense is disciplined record keeping, above all approved minutes in which every committee and management forum records the issues raised, the discussion and the decisions taken.

Keeping on top of regulatory requirements

Operational risk teams face a steady flow of rules, speeches, consultation papers and policy statements from many bodies. Not all of them are legally binding, but they signal what supervisors expect, and missing one can lead to a sanction, a capital add-on or an order to compensate customers. Good practice is to keep a library of the regulatory documents that govern the firm’s framework, make sure relevant staff know their contents and ask operational risk staff to confirm that awareness every year. The compliance team usually runs horizon scanning for new publications, practitioners subscribe to regulatory alerts, and when something new appears a team member summarizes it at the next team meeting so that both the letter and the intent of the rule are understood.

The BCBS expects operational risk governance to be fully built into a bank’s overall risk governance rather than run as a separate silo. Effective governance needs three things: clearly defined roles and responsibilities for every risk stakeholder, a decision process that can actually be executed, and discipline that can be enforced. In practice, operational risk decisions are taken collectively by committees, which act on reporting and escalated information at each level of the hierarchy.

What each level does

At the base sit committees organized by business type or function (for example corporate banking, investment banking or support services) or by geography. They oversee operational risk within their own perimeter, supply information that feeds the firm’s overall risk profile, and escalate significant issues, or anything that breaches a preset limit, to a firm-wide or second line committee. The group operational risk committee then oversees, manages and monitors operational risk on a consolidated basis and reports it to the executive risk committee, the management committee and the board risk committee.

The board risk committee is the board’s own enterprise-level committee and oversees all operational risk. It advises the full board on risk-based decisions, exposures and risk management, receives regular risk reports, and follows the investigation of larger incidents. Its meetings should be frequent enough for continuous oversight and timely escalation, and regulators expect its members to bring recent and relevant experience.

Size and the two common structures

The right structure depends on how large, complex and varied the firm is. A small firm may run a single operational risk committee that reports to both the management committee and the board risk committee, which is acceptable if it can be justified. Large firms often split operational risk into sub-categories, each with its own committee, and two arrangements are common, particularly in the United States and Canada. In the first, operational risk acts as the umbrella for all non-financial risks, so committees for fraud, information security, and legal and compliance report to the operational risk committee, which reports to the enterprise risk committee. In the second, these specialized risk types sit side by side with operational, credit and market risk, all coordinated directly by the enterprise risk committee.

Every committee needs a written mandate. The terms of reference (TOR), also called a committee charter, set out the authority a committee has been delegated to oversee a defined area. A typical TOR covers the committee’s role and purpose, its membership (by name or by function), the responsibilities of members, how often it meets, and a record of any later amendments together with the reasons for them. Without a TOR, it is unclear what a committee may decide, and the governance chain has a gap.

Committees review the risk information and reports produced at their level of the firm, take decisions on that basis, and examine and approve the policies that steer how operational risk is managed. The substance of each discussion, the decisions reached and the reasons behind them must be captured in minutes. Those minutes are exactly the evidence of good governance that supervisors look for, and the same documentation discipline applies to every other risk type.

Policies and procedures as directive controls

Policies state the rules and principles by which the firm runs its business and organizes its processes. Procedures and guidelines go a level deeper and explain how a particular task or process should be carried out. These documents reduce the chance of errors and serve as training material, especially when new employees join. Because they direct behavior before anything goes wrong, policies, procedures and guidelines are classed as a type of internal control known as directive controls.

A policy only works as a control if people know about it and follow it. So, policies and procedures should be communicated widely, kept current and embedded in actual operations. They must reflect how the business really works, be usable in daily practice and change when the business changes, for example when a new activity is launched or a process is redesigned. A procedure that describes a system retired two years ago gives false comfort and is worse than none.

Final responsibility for running the firm, risk management included, lies with the board of directors. Corporate governance codes around the world echo the BCBS in making the board decide which significant risks, and how much of each, the firm will accept in pursuit of its strategy, and for keeping risk management and internal control systems sound. Put simply, the board sets the risk appetite and makes sure the firm stays within it.

Board duties for operational risk

Principle 3 of the RPSMOR sets out the board’s duties in detail. Regulators expect the board to approve the ORMF, make sure it is reviewed periodically, and obtain assurance that senior management is implementing its policies, processes and systems effectively at every decision level, for example through the committee structure described earlier. It must also build a culture of risk management and make sure that culture is communicated throughout the firm. To oversee operational risk properly, as part of enterprise risk management (ERM) as a whole, board members need adequate training themselves, and they must make sure everyone with operational risk duties receives the training their role requires.

Board duties for operational resilience

Newer rules on operational resilience have extended board responsibility to overseeing how well the firm can keep operating through disruption. The expectations closely mirror those for operational risk. Principle 1 of the BCBS principles on operational resilience asks directors to work through the governance structure they already have when setting up, supervising and putting into effect a resilience approach, and to build a broad understanding of that approach across the firm by communicating its objectives clearly, much as they do for risk culture.

The resilience approach must take account of the firm’s risk appetite and its tolerance for disruption to critical operations, and of its operational capabilities across many scenarios that are severe yet still plausible. The board oversees senior management’s implementation, makes sure enough financial and technical resources are allocated, and expects timely reporting, particularly when a significant deficiency could threaten the delivery of critical operations. Firms must also be able to show that the board has been trained in operational resilience, has the knowledge, skills and experience to fulfil its resilience duties, and that training reaches all staff.

The three lines of defense (3LoD) model originated, in a somewhat different form, in military organization. Over the last decade it has become the standard way financial firms divide responsibility for risk and control. Each line has a distinct job and, in BCBS language, a distinct name.

Why the lines are harder to draw for operational risk

The model is simple on paper but has generated years of debate in practice. How formally a firm applies it depends on its size, nature and complexity. Operational risk adds its own difficulty: because it is less centralized than credit, market or liquidity risk, the boundary between the lines is harder to locate. Many control functions, finance, legal and security among them, do not belong neatly to a single line.

A key point is that a line is defined by the role and responsibilities a unit performs, not by its name on the organization chart. The BCBS also accepts that the independence of the CORF will vary. In a small bank, independence may come from separating duties and having processes reviewed independently. In a larger bank, the CORF should report separately from the risk-generating business units and should own the design, maintenance and continuing development of the ORMF. It typically draws on other control groups such as compliance, legal, finance and IT, and the bank should have a policy that clearly defines the CORF’s roles in a way that fits the organization’s size and complexity.

Hybrid functions

Small and medium-sized firms often lack the staff to run separate first and second line teams in functions such as finance, human resources, legal, ICT and information or physical security. Those teams then do both kinds of work and become hybrid functions. The BCBS accepts this but requires the bank to document and separate the first line and second line responsibilities within such a function, stressing the independence of the second line part.

The first line, or front-line risk management, normally covers all commercial and front-office operating functions, which people usually shorten to “the business”. A well-known saying in risk management is that risk is managed where it is generated. It is a useful reminder that the risk function, despite its name, does not own or manage operational risk; the business does. For that reason it is clearer to describe the first line as the risk owners: the people answerable for the consequences of the risks they create or supervise, and therefore for assessing and mitigating them. The head of IT, for example, owns IT risk in the firm.

An effective first line does four things:

• identifies operational risks inherent in the business and assesses how material they are;
• puts appropriate controls in place;
• assesses whether those controls are well designed and work effectively;
• monitors and reports the unit’s operational risk profile.

If a business unit believes it lacks the resources, tools or training to identify and assess its risks, it should say so to the second line, meaning the corporate operational risk function. In the same way, it should report residual risks that controls do not mitigate, including loss events, control deficiencies, process weaknesses and breaches of operational risk tolerances.

Risk champions and “line 1.5”

Operational risk is present in every process, but not every manager wants to become a risk specialist or master the methods and vocabulary. Many firms, particularly large ones, therefore appoint risk champions in each department to act as the link with the risk function. Also called risk specialists, stewards or risk correspondents, they are sometimes described as line “1.5” or “1.6”. Their usual tasks are:

1. acting as the department’s main contact on risk matters;
2. collecting and recording risk events and losses;
3. mapping risks and controls to the group’s definitions where relevant;
4. following up on control rules, risk action plans and audit recommendations.

The danger is that risk ownership drifts toward these specialists. Firms using champions must make sure the business managers who generate the risk keep ownership of it, and that the champion supports them with expertise rather than taking the risk off their hands.

The second line designs the risk management framework and then reviews and challenges how the first line applies it. It should not run the first line’s risk management activities itself; its contribution is guidance, oversight and challenge. To do this well, second line professionals need technical and conceptual expertise in identifying, assessing, mitigating and monitoring risk, a sound knowledge of regulation and of the business, clear visibility over business operations, and a real understanding of what drives risk in the business.

An effective second line typically:

1. develops and maintains operational risk policies, standards and guidelines, and designs and delivers training that builds risk awareness and competence;
2. forms its own independent view of the business units’ risk management, including how they identify material risks, how well key controls are designed and operate, and whether they respect risk appetite and tolerance limits;
3. challenges the relevance and consistency with which the business uses risk tools, measurement and reporting, and keeps evidence that the challenge took place;
4. reviews, and adds to, the monitoring of the operational risk profile and the reports on it.

The risk function also supports decision-making. When the business considers a new venture, a commercial agreement, an acquisition, a new product or market, an investment or a divestment, the risk function should offer an informed view of the risks and the mitigation options. For the challenge to have teeth, it needs delegated authority to veto decisions that would breach regulation or exceed the risk appetite limits approved by the board.

The independence debate

The relationship between the first and second lines is the most debated part of the model. Regulators commonly require the second line to be independent so that it can provide oversight and challenge. Pure independence, however, risks duplicating internal audit, and it is hard to challenge risk management practices that the business has not yet implemented or understood. So, particularly in young or small organizations and in units new to the discipline, the first job of the operational risk function is education. Basic training, which the BCBS also recommends, should answer four questions: what operational risk is, how incidents are recognized and reported, what good operational risk management achieves, and what goes wrong when it is poor. Training on tools for identification, assessment, root-cause analysis and scenario workshops can follow.

The second line can then keep its independence by asking questions and guiding without supplying the answers. A second line risk manager might facilitate a risk and control self-assessment workshop with a business team, prompting reflection on risks and controls while avoiding influence over the assessments themselves, and afterwards collect and challenge the answers and their justifications. Final sign-off belongs to the first line. In short, the second line owns the methodology and the first line owns the risks.

Internal audit, the third line, has the clearest boundaries of the three. It stands outside the risk management process and independently tests the firm’s control system and whether every department, the risk function included, complies with its policies and procedures. Internal audit forms its own view of the organization’s key risks and builds its audit universe around them. In some firms audit and risk coordinate their schedules so business managers are not burdened with overlapping visits and assessments, and the two may share information and findings.

How internal audit relates to other control functions

The Institute of Internal Auditors (IIA, 2017) sets out how internal audit should interact with risk management, compliance and finance. Its position can be summarized in three points:

• these functions are essential to corporate governance, but internal audit must stay independent of them, holding no responsibility for them and forming no part of them;
• internal audit should assess whether these functions are adequate and effective and must never rely only on their work; it should always test a suitable sample of the activities itself;
• internal audit may decide how far to use the others’ work in its risk assessment or test design, but any decision to scrutinize an area less intensively should follow an evaluation of how effective that function is in that area.

Internal audit provides independent assurance on the general system of operational controls to the governing body, senior management, regulators and investors. External auditors provide assurance on the financial statements and the controls over financial reporting. Internal audit should report in a solid line to a non-executive director, for instance the audit committee chair, the senior independent director or a non-executive chair. External audit too must remain independent; its task is to express an opinion on whether the financial statements are fair.

Three lines of accountability

Some institutions now speak of “three lines of accountability” to stress that each role carries personal accountability. This is a change of name and emphasis rather than a different model.

The IIA’s Three Lines Model

The IIA has published an updated Three Lines Model to reflect how risk management has evolved and to encourage closer collaboration between business functions, internal audit included. A governing body, accountable to stakeholders, provides integrity, leadership and transparency. Management takes actions, including managing risk, to achieve objectives: first line roles deliver products and services and manage risk, while second line roles bring expertise and support and also monitor and challenge, but only on matters related to risk. Internal audit gives independent, objective assurance and advice on everything related to achieving objectives.

Two features stand out. The model gives more weight to the second line’s expertise and support, and it limits its challenge to risk-related matters, since the risk function has no business interfering in commercial questions outside its competence. Some risk functions have stressed oversight so heavily that they behave like a second internal audit; the model reminds them that the second line belongs to, and reports to, management. It does not overturn the 3LoD, but it moves it toward the practice of mature firms, where risk management is seen as helping to create and protect value rather than simply policing and avoiding risk.

Corporate governance codes, such as the UK Walker report of 2009, make the board answerable for choosing which significant risks the firm takes on to reach its objectives, and how much of each. Board members therefore care about defining risk appetite, the amount of risk the organization finds acceptable. Doing it well is difficult, especially for non-financial risks, where there is no single exposure number to cap.

Defining appetite means reviewing every key risk the firm faces, deciding where acceptable incidents end and unacceptable ones begin, and then building the controls those boundaries require. Done honestly, the exercise can expose uncomfortable gaps between what the firm says officially and what actually happens in its operations. According to the BCBS, consistently defined appetite and tolerance limits set the priorities for the whole control environment, which is itself the board’s responsibility.

What Principle 4 asks for

The fourth RPSMOR principle covers risk appetite and tolerance. Statements for operational risk should be easy to communicate and understand, should explain why the firm takes, limits or avoids particular operational risks, and should be consistent with strategy and business plans. Limits should be monitored through indicators of exposure, of the control environment and of loss events. Appetite should be forward-looking, tested with scenarios and stress tests, and accompanied by a view of which events could push the bank outside its limits.

Regulators link appetite and tolerance directly to limits on exposure and expect statements to match how the firm really operates. A firm that claims “minimal tolerance for data breaches” must back that claim with strong controls and monitoring that convince the board and the regulator, on a best efforts basis, that data breach risk really is minimal. The board ultimately owns these limits and validates them periodically. In practice it often delegates this to the board risk committee, which relies on the risk function to embed the limits in controls and business exposures and to report on them regularly.

Structure of an actionable risk appetite

The BCBS expects appetite to spell out why the firm takes some risks and avoids others. Taking risk is necessary to meet business objectives, and avoiding it also has a cost, so operational risk involves real risk-return trade-offs that appetite statements must address. An actionable appetite guides decisions at business level in three ways: limits on exposure, minimum requirements for key controls, and thresholds on the frequency and severity of tolerated incidents. The metrics that track these limits are what the BCBS calls boundaries or indicators, quantitative or not, and banks usually report them as monitoring KRIs.

Statements are usually set per main risk type, but process-based firms such as payment processors or clearing houses may set them per key process, with a different appetite for each. Operational resilience rules add a further form: maximum impact tolerances for each critical business service, which express appetite for disruption risk.

For an appetite statement to be credible and usable, it must be tied to identified key controls, or systems of control, documented well enough to support it. Listing the key controls behind every main risk type helps a great deal when demonstrating to regulators, clients and other stakeholders that the organization lives up to what it says. Monitoring thresholds and indicators for control reliability, activity limits and other KRIs then tell management whether the business is operating as intended. Comparing actual incidents and near misses against the acceptable limits shows whether current risk management is strong enough to keep incident frequency and severity within tolerance.

A conduct risk example

Consider a bank’s appetite statement for conduct risk in its sales process. The bank states minimal tolerance for conduct breaches in selling. Ethical lapses or harm to customers will be punished promptly and severely, and controls and pay structures are designed so that a systematic breach affecting many customers is extremely unlikely. The bank does accept that isolated, unintentional mis-selling will happen when thousands of agents sell across a large retail network; such cases must be fixed quickly and the customer compensated.

The statement then sets concrete terms. The risk is accepted only if no more than 0.2% of the sales force is involved and errors are corrected swiftly. An agent who breaches intentionally is dismissed; an unintentional breach leads to remedial training and closer monitoring. Affected customers are compensated in full as soon as the case is identified, and every complaint needs a reply within 24 hours and a full resolution within five working days.

Other tools also express appetite, such as the rating scales used in risk assessments and heatmaps, and the tolerance thresholds placed on monitoring metrics and KRIs.

Risk appetite governance

Good practice assigns a risk owner to every risk type in the appetite structure. As appetite cascades into limits, controls and metrics, the firm should also name control owners and metrics owners. Control owners answer for the design, implementation and effectiveness of controls. Metrics owners collect, report and monitor the metrics that show how the firm is performing against its appetite. Risk owners are the managers who manage, maintain and monitor the risks within the stated appetite and tolerance limits, which places them in the first line of defense, where risk is actually managed day to day.

Regulators place risk culture in the very first principle of the RPSMOR and return to it repeatedly, because a better culture produces less operational risk and greater resilience. The BCBS view is that banks with a strong risk management culture and ethical business practices suffer fewer damaging operational risk events and handle those that occur more effectively. Supervisors connect risk culture closely to conduct and ethics and treat it as a board responsibility that applies to, and is acknowledged by, every employee. The board should set a code of conduct or ethics policy covering both staff and directors, review and approve it regularly, and have employees attest to it. Directors and senior management are also expected to promote ethical behavior that convincingly reinforces the code through compensation strategies and training.

Tone at the top, skin in the game and training

The board leads the risk culture and senior management implements it. This is the “tone at the top”: directors and senior managers set the standard by their own conduct and by making expectations and consequences for staff behavior clear. A strong culture is written down in policies and codes that apply to everyone, and because operational risk is part of every activity, risk awareness, rule-following, alertness, ethics and transparency all belong to it.

Management reinforces culture through the code of conduct, pay structures and training. Risk-takers should have “skin in the game”, a phrase popularized by Taleb, and bear the consequences of their choices. Just as passengers are safer when the pilot flies in the same plane, managers and directors who commit the firm to risk should be accountable for the losses as well as the gains. Training spreads basic risk literacy, since non-financial risk is obvious to some people but must be explained to others. Typical programs include induction training for new hires, online modules for all staff and specialist training for the risk function, and many regulators require formal, regular risk training for senior managers and the board.

No unnecessary blame

Reinforcing the code and signalling discipline shape behavior, but blame must not discourage reporting. Alongside tone from the top, a “no-blame culture” is the most common recommendation for good risk culture: people who report an incident, or who caused it, should not be punished in a way that silences escalation. The New York subway slogan introduced after the 9/11 attacks, “If you see something, say something”, captures the behavior every firm wants: vigilance and escalation. Staff will only speak up if they do not fear unfair retaliation, and whistleblowing remains one of the strongest controls for detecting misconduct and fraud. UK military guidance refines this to “no unnecessary blame”, since repeated errors and carelessness still need sanctions. The UK regulator expects openness and honesty from firms in their dealings with regulators and stakeholders, and concealing incidents will be punished if found.

Signs of good and toxic cultures

Toxic cultures tend to grow from overambitious growth and profit targets, pressure on staff and managers, and a refusal to hear bad news. Wells Fargo, sanctioned for large-scale mis-selling and fraud, is one example of a firm that chased short-term goals with severe consequences. Healthy cultures show the opposite signs, as three case studies illustrate.

Perhaps the clearest single sign of a sound risk culture is that people can discuss internal incidents openly, without excessive blame or embarrassment, so the whole organization learns from them.