A Framework for

Setting Risk Appetite

WHAT IS A RISK APPETITE STATEMENT AND
HOW IS IT USED?

Simply put, risk appetite is defined as the amount of risk (volatility of

expected results) an organization is willing to accept in pursuit of a
desired financial performance (return). The concepts of risk appetite
and risk tolerance are often used interchangeably, but they have
distinctly different meanings.

Risk tolerance encompasses the broadest expression of risk an

institution is willing to assume in executing its strategy. Risk appetite
offers a pragmatic view of risk tolerance. The annual plan and budget
is developed within the constraints of the appetite and tolerance for
risk. This ensures that the organization does not exceed its stated
bounds or limits for risk.

None of us has worked for an institution that has declared it wanted to

take a lot of risks without a representative return. In some ways, our
strategic goals and willingness to accept risks look very similar. Many of
us want to achieve double-digit earnings growth while maintaining a
“moderate risk profile.” Sound familiar? If so, then why has our industry
suffered so much loss, both monetary and reputational?

Shareholders, regulators, and other stakeholders are calling for clearly

articulated risk appetite statements that are broadly communicated,
understood, embraced, and used to manage the business. A statement of
risk appetite is as much about culture and a way of thinking and
behaving as it is about risk policies, tolerances, parameters, models,
reporting, and governance.

A Framework for Setting Risk Appetite

Copyright © 2013 by The Risk Management Association
All rights reserved. Printed in the U.S.A.
A Risk Appetite Framework Vs. a Risk Appetite
Statement
A risk appetite framework is different from a risk appetite statement.

Framework Statement
The framework provides a The risk appetite statement
structured approach to the is an expression of the
management, measurement, amount and type of risk that
and control of risk, i.e., a the institution is willing to
way that people and accept in the pursuit of its
processes ensure that business
business activities provide
an appropriate balance of
return for the risk assumed
and remain within the
stated risk appetite of the
institution.

The framework and the statement are inextricably linked.

It is important for your management and the board of directors to

understand the critical links among strategy, business plans, and risk. A
risk appetite statement is one tool that facilitates this linkage. In this
context the risk management function is an integral part of the
institution’s overall strategies and specific business objectives— an
essential part of the institution’s success, returns, and value creation.

A Framework for Setting Risk Appetite

Copyright © 2013 by The Risk Management Association
All rights reserved. Printed in the U.S.A.
What Are the Components of a Risk Appetite
Statement?
Generally speaking, the statement of risk appetite consists of two parts:

• A preamble, which states the high-level

guiding principles of the institution, why
the risk appetite statement is being
Preamble developed, how it was developed, and
how it is to be used in the planning
process.

• A set of qualitative and quantitative

Metrics metrics that articulate the institution’s
risk appetite.

A risk appetite statement is the natural evolution of many traditional

functions found within an organization. These functions have typically
been managed in individual silos. Risk appetite, when it is operating
properly, can provide the common thread running throughout such
common functions as:
• Setting strategy, goals, and objectives for the company.
• Credit origination and decision making.
• Limits and portfolio management.
• New-product introduction.
• Compliance with rules and regulations.
• Capital allocation.
• Compensation and incentives.
• Treatment of customers; product and service suitability.
• Community involvement

A Framework for Setting Risk Appetite

Copyright © 2013 by The Risk Management Association
All rights reserved. Printed in the U.S.A.
Creating the Risk Appetite Framework
Developing a statement of risk appetite requires time, discussion, debate,
and significant involvement of the key stakeholders. To create a robust
risk appetite process, you should include the following elements:
1. The institution’s strategic objectives are articulated by the board
of directors and shared with the key stakeholders.
2. The chief executive officer serves as the central point of contact
between stakeholders and articulates the importance, benefits,
and use of the statement of risk appetite.
3. The chief risk officer and/or other senior executive or delegates
responsible for coordinating the risk appetite process hold a
series of focus groups with senior management to ascertain and
document the level of risk they are willing to assume in pursuit of
value.
4. Each line of business identifies their proposed key initiatives and
capital requirements in light of their economic, risk, and
competitive outlooks.
5. A comprehensive document articulating the risk appetite
framework, identifying and reconciling the key initiatives
proposed by the businesses with the top-down corporate strategic
objectives, the amount and type of risks taken, and the capital
capacity of the institution is prepared by the risk team.
6. The document is discussed with the executive management team,
then revised and approved.
7. The document is presented to the full board of directors for
discussion and approval.
8. Once approved, the risk appetite statement is communicated
institution-wide, ahead of the budget and planning process and
linked to policies and tolerances.
9. Businesses are asked to build their plans within the context of the
risk appetite statement.
10. Businesses review their existing risk polices and limits to ensure
they are aligned with the risk appetite statement.
11. Risk appetite is monitored and reported regularly and discussed
as required with the board, external stakeholders, including

A Framework for Setting Risk Appetite

Copyright © 2013 by The Risk Management Association
All rights reserved. Printed in the U.S.A.
 external auditors, regulators, and, possibly investors, if the
company chooses to make public its risk appetite statement.
12. Risk reporting is conducted in line with the approved and
established policies and tolerances. Management reports should
routinely include risk appetite measures.

Roles and Responsibilities of Key Stakeholders

The board approves the risk appetite framework—and, by definition, the
risk appetite statement—which is typically presented by the senior risk
committee or chief risk officer. Once approved, the governance of the
institution’s risk appetite is assigned to the appropriate person(s) or
group(s). Depending upon the size of your institution, responsibility for
execution and monitoring can be assigned to the risk strategy or
enterprise risk management function or an individual within risk
management. Even though one area, typically risk, holds the day-to-day
responsibility for the risk appetite framework, your institution should
involve risk management, finance, and lines of business in the process.

Your framework should be well communicated and embraced throughout

your organization. For a successful adoption of risk appetite within the
institution, it is vital to get many people around the table. In smaller
institutions without a chief risk officer, the president, CCO, CFO, or
CEO may take on many of the CRO duties.

For in-depth information about establishing a risk appetite framework

at your organization, please learn more about RMA’s Risk Appetite
Workbook.

A Framework for Setting Risk Appetite

Copyright © 2013 by The Risk Management Association
All rights reserved. Printed in the U.S.A.
About RMA RMA University
The Risk Management Association (RMA) is a In today's rapidly changing financial services
not-for-profit, member-driven professional industry, you need practical, day-to-day
association serving the financial services industry. knowledge that will help you excel in your
Its sole purpose is to advance the use of sound risk profession. RMA provides quality education to
principles in the financial services industry. RMA advance sound risk principles in the financial
promotes an enterprise approach to risk services industry. Traditional classroom
management that focuses on credit risk, market training and online learning resources are
risk, operational risk, securities lending, and available as open enrollments or in-bank
regulatory issues. training. Visit http://www.rmahq.org/events-
training/rma-university to learn more.

Founded in 1914, RMA was originally called the

Robert Morris Associates, named after American eStatement Studies
patriot Robert Morris, a signer of the Declaration
RMA’s eStatement StudiesSM is the only source of
of Independence. Morris, the principal financier
comparative data that comes directly from the
of the Revolutionary War, helped establish our
financial statements of small and medium-size
country’s banking system.
business customers of RMA’s member
institutions. Round-the-clock online access gives
Today, RMA has approximately 2,500 you the ease and flexibility to use this wealth of
institutional members. These include banks of all information at your convenience. Visit
sizes as well as nonbank financial institutions. http://www.rmahq.org/tools-
RMA is proud of the leadership role its member publications/tools/estatement-studies to learn
institutions take in the financial services industry. more.
Relationship managers, credit officers, risk
managers, and other financial services
professionals in these organizations with Are you an RMA member?
responsibilities related to the risk management An RMA membership provides many benefits.
function represent these institutions within RMA. In addition to a free subscription to The RMA
Known as RMA Associates, these 16,000 Journal® and discounts on RMA events,
individuals are located throughout North America products, services, and training, membership
and financial centers in Europe, Australia, and also provides countless
Asia. networking opportunities and exposure to the
industry's key decision makers and managers.
RMA’s local and national events keep you up to
No part of this publication may be reproduced, date on industry trends and issues while allowing
by any technique or process whatsoever, you to meet new people and swap successes with
without the express written permission of the peers. Visit http://www.rmahq.org/about-
publisher. rma/member-benefits to learn more about
Phone: 800-677-7621 membership.
Fax: 215-446-4101
Website: www.rmahq.org

A Framework for Setting Risk Appetite

Copyright © 2013 by The Risk Management Association
All rights reserved. Printed in the U.S.A.