Charta is on Google Play: practise on the go. Get the app
Charta

Show what good practice and supervisory expectations look like when setting an operational risk appetite and fostering a robust risk culture.

FRM® Part II · Operational Risk and Resilience · Risk Governance · FRM2.ORR.2.d

The idea

The board approves and periodically reviews an operational risk appetite and tolerance statement. Appetite sets the nature, types and levels of operational risk the bank is willing to assume to pursue its strategy. Tolerance sets the acceptable variation or limit around it. Because operational risk earns no direct return, appetite is often expressed by risk type, with very low or zero tolerance for fraud and conduct breaches. It mixes qualitative statements with quantitative metrics such as key risk indicators, loss limits and escalation triggers. Good practice cascades the statement to business lines, monitors it and escalates breaches, and reviews it after major events. A robust risk culture needs tone from the top, accountability, incentives aligned with the statement, training and safe channels to speak up. The common mistake is a statement that behaviour and pay contradict.

A practice question

From the question bank, with the reason each wrong option is wrong.

Which statement best describes an operational risk appetite statement?

  1. It sets the regulatory capital the bank must hold for operational riskWhy not: Capital is a requirement from the capital rules; appetite is the bank's own choice about risk.
  2. It lists the operational loss events the bank suffered in the last yearWhy not: That is loss data, not a statement of what risk the bank will accept.
  3. It sets out the nature, types and levels of operational risk the bank is willing to assume - correct
  4. It is a forecast of next year's expected operational lossesWhy not: A forecast is not an appetite statement; appetite says how much risk is acceptable.

The statement, approved by the board, says what kinds and levels of operational risk the bank will accept to pursue its strategy. It is distinct from capital, loss history and forecasts.

A harder one

A board's operational risk statement says the bank accepts some losses from processing errors but has zero tolerance for deliberate fraud and compliance breaches. Which assessment is most consistent with good practice?

  1. Invalid: appetite must be expressed as one single aggregate loss figure for the bankWhy not: Appetite may differ by risk type and mixes qualitative and quantitative elements.
  2. Invalid: operational risk appetite must be set at zero for every single risk typeWhy not: Some losses from errors are unavoidable; a zero appetite everywhere is unworkable.
  3. Valid as written: qualitative statements need no metrics, limits or escalation rulesWhy not: A statement without metrics, limits or triggers cannot be monitored or enforced.
  4. Acceptable: appetite can differ by risk type if backed by metrics and limits - correct

Operational risk earns no direct return, so appetite varies: low for fraud and conduct, some tolerance for routine errors. To be useful it needs key risk indicators, limits and escalation triggers.

The hardest tier

Which approach to setting the operational risk appetite is most consistent with good practice and supervisory expectations?

  1. Derive the appetite solely from the regulatory capital chargeWhy not: Capital does not reflect all operational risk, and appetite is a management decision.
  2. Set it once at launch and revise it only when the five-year strategic plan is renewedWhy not: Appetite should be reviewed periodically and when the risk profile or environment changes.
  3. Set limits by risk type, link to strategy, cascade to business lines, review after major events - correct
  4. Let each business line set its own, with no board-level viewWhy not: The board approves the statement; business-line limits must cascade from it.

The board-approved statement reflects strategy, uses qualitative and quantitative measures by risk type, is cascaded into business-line limits and is reviewed periodically and after significant changes or events.

In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.

Start free →

More in Risk Governance