Charta is on Google Play: practise on the go. Get the app
Charta

Explain how an ERM (enterprise risk management) framework draws on risk governance, risk appetite and risk culture.

FRM® Part II · Operational Risk and Resilience · Integrated Risk Management · FRM2.ORR.7.a

The idea

An enterprise risk management framework joins three elements that only work together. Risk governance sets who is accountable. The board approves strategy and risk appetite, and senior management implements them. The three lines of defence separate risk-taking in the business units, independent oversight by risk management and compliance, and assurance by internal audit. Risk appetite is the aggregate level and types of risk the firm is willing to accept to pursue its strategy. It sits below risk capacity, the maximum risk the firm could bear before breaching capital or liquidity minimums, and it is turned into limits for business lines. Risk culture is the shared values and behaviour that decide whether the rules are followed. It covers tone from the top, incentives, escalation and challenge. The usual exam point is that a strong appetite statement fails without the right culture and incentives.

Formulas

Risk capacity

risk capacity = total capital − minimum capital

total capital
the capital the firm holds
minimum capital
the required minimum, including buffers

Appetite is set below capacity, often as a fraction of it. Taking that fraction of total capital or of the minimum is the usual mistake.

A practice question

From the question bank, with the reason each wrong option is wrong.

How is risk appetite best defined for the firm as a whole?

  1. The maximum loss the firm could absorb before it breached its minimum regulatory capital requirements.Why not: This is risk capacity, the outer boundary, not the amount the board chooses to accept.
  2. The aggregate level and types of risk the firm will accept to pursue its strategy, as approved by the board. - correct
  3. The numerical exposure ceilings assigned to individual desks and portfolios.Why not: These are risk limits, which implement the appetite rather than define it.
  4. The average loss the firm expects to suffer from its current activities over a year.Why not: This is expected loss, a statistical estimate rather than a board-approved statement of willingness to take risk.

Risk appetite is the amount and type of risk the board is prepared to accept to achieve its strategy. Capacity is the ceiling, limits are the operational translation, and expected loss is a statistical measure.

A harder one

A board is designing its risk appetite framework. Which description of how risk capacity, risk appetite and risk limits relate to one another is most appropriate?

  1. Capacity is the most risk the firm could bear, appetite is set by the board below it, and limits turn appetite into thresholds for business lines. - correct
  2. Appetite is the maximum the firm can bear, capacity is the narrower level the board chooses, and limits sit above both as early warning triggers.Why not: Swaps capacity and appetite and puts limits above the maximum instead of inside the appetite.
  3. Each business line sets its own limits first, appetite is the sum of those limits, and capacity is derived from the result.Why not: Reverses the cascade: appetite is set top-down by the board, not built up from desk limits.
  4. Appetite and capacity are the same quantity, so limits only need to be set when the firm approaches capital minimums.Why not: Collapses two distinct concepts and waits for a capital breach, leaving no buffer between appetite and capacity.

The hierarchy runs from capacity (what the firm can bear) to appetite (what the board chooses to bear, below capacity) to limits (operational thresholds within appetite).

The hardest tier

A bank has total capital of USD 18 billion and a minimum required level, including buffers, of USD 11 billion. Risk capacity is defined as the loss the bank can absorb before capital falls to that minimum. The board sets its stress-loss risk appetite at 50 percent of risk capacity. The maximum stress loss the board is prepared to tolerate is closest to:

  1. USD 5.5 billionWhy not: Takes 50 percent of the minimum required capital of 11 rather than of the capacity.
  2. USD 7.0 billionWhy not: This is the risk capacity itself, not the appetite set below it.
  3. USD 9.0 billionWhy not: Takes 50 percent of total capital of 18 and ignores the required minimum.
  4. USD 3.5 billion - correct

Capacity = 18 - 11 = 7 billion. Appetite = 50% x 7 = 3.5 billion. Appetite must be set below capacity and measured against the distance to the minimum, not against total capital.

In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.

Start free →

More in Integrated Risk Management