Institutionalizing Risk Appetite Remains a Challenge for Banks

Risk Management Association
February 16, 2010 | COMMENTS

Articulating a risk appetite and establishing an associated risk management framework remain challenges for financial institutions, even in the current banking industry climate, according to Oliver Wyman and the Risk Management Association (RMA).

Interviews Oliver Wyman and RMA conducted with 19 global financial institutions reveal significant differences in capabilities and applications, two areas used to evaluate how effectively institutional risk appetite is transmitted throughout an organization.

The research indicated the following deficiencies among the institutions surveyed:

• Lack of leadership regarding risk appetite, especially preceding the financial crisis. Full engagement of management at all levels ensures that risk appetite is translated into a pragmatic direction for the organization, supported by practices and infrastructure.
• Chronic under-investment in data management, analytics, and people dedicated to an integrated view of the businesses, aggregated across the enterprise.

In contrast, leading organizations had made an early investment in a risk appetite supported by senior management, and used their “risk culture” to communicate risk appetite in a way that ensures it becomes part of day-to-day decision-making throughout the organization.

Although a risk appetite statement exists at all the institutions surveyed, the research showed that many have failed to execute it according to the established risk management framework. Deficiencies included inability to manage down concentrated risk exposures, a diminished role for the risk management function, and straying outside of acceptable geographic or product bounds.

George Morris, partner at Oliver Wyman, stated, “A corporate risk appetite statement is necessary but not sufficient to avoid unintended risk concentrations and the heavy damage they cause. CEOs and CROs who effectively transmitted their bank's risk appetite to those taking and managing risks outperformed their competition in the recent crisis.”

Bill Githens, CRC, RMA president and CEO, agreed. “There must be a cultural reinforcement of the risk appetite,” he said. “Everyone in the organization must understand what's acceptable as a risk and what's acceptable as a business practice. Decisions approved at the senior level must be carried out throughout the organization.”

The Risk Management Association is a not-for-profit, professional association, whose sole purpose is to advance the use of sound risk principles in the financial services industry.