In the latest edition of the PwC-publication The Journal you can read about bringing it all together. Getting risk appetite right requires banks to successfully tackle a series of imperatives. Missing all or any of them will fatally undermine the framework.

• Risk appetite has to be true to the shareholder promise that drives strategy. The idea is to avoid taking so much risk that the bank’s goals are damaged or so little that it falls short of its targets – so the starting place has to be a detailed appreciation of what the bank wants to do.

• All of the material risks and risk dependencies affecting the bank’s businesses need to be properly accounted for in the overall appetite. As the crisis has shown, if key risks are ignored, organisations can be exposed to life-threatening events.

• Risk appetite has to cascade down through the bank, with the overall tolerance for risk sub-dividing into a series of thresholds – to act as an early-warning system – and limits, to trigger more immediate corrective action. Limits should be set at the business unit level – and lower where appropriate. All limits need to be communicated clearly
to business management and the various control and oversight functions.

• Management information needs to keep the various levels of the organisation (both management and oversight) up to date on how the bank is performing against its appetite and to ensure that action is taken when too much – or too little – risk is being taken.

• Performance measures and rewards must take account of risk.

• Control and oversight functions need to have both bark and bite. They must be listened to and they must be able to force some kind of review or action when they have concerns.

Pulling all of these elements together is easier said than done – but it can be done – and banks will increasingly be expected to place this kind of framework at the heart of their business.

Read more in The Journal.