Principles for An Effective Risk Appetite Framework 18 November 2013 Table of Contents Page I. Introduction ....................................................................................................................... 1 II. Key definitions .................................................................................................................. 2 III. Principles .......................................................................................................................... 3 1. Risk appetite framework ................................................................................................... 3 1.1 An effective RAF .................................................................................................... 4 2. Risk appetite statement ..................................................................................................... 5 2.1 An effective risk appetite statement ........................................................................ 5 3. Risk limits ......................................................................................................................... 6 3.1 Risk limits ................................................................................................................ 6 4. Roles and responsibilities ................................................................................................. 7 4.1 The board of directors ............................................................................................. 8 4.2 The chief executive officer ...................................................................................... 9 4.3 The chief risk officer ............................................................................................. 10 4.4 The chief financial officer ..................................................................................... 10 4.5 Business line leaders and legal entity-level management ..................................... 11 4.6 Internal audit (or other independent assessor) ....................................................... 12 i I. Introduction Increasing the intensity and effectiveness of supervision is a key component of the Financial Stability Board’s (FSB’s) framework, endorsed by G20 Leaders, to reduce the moral hazard of systemically important financial institutions (SIFIs). As such, supervisory expectations for risk management particularly at SIFIs are increasing. The October 2011 FSB progress report1 on enhanced supervision noted that effective risk appetite frameworks (RAFs) that are actionable and measurable by both financial institutions and supervisors have not yet been widely adopted. It concluded that the development of an effective RAF is important for financial institutions and supervisors, and needs attention by both. The report recommended that supervisors discuss expectations for what a “good” risk appetite framework entails and how to supervise against these expectations. In light of these findings, the FSB launched a peer review on risk governance which was published in February 2013.2 Based on the findings of the review five recommendations were set out, one of which asked the FSB to develop, in collaboration with relevant standard setters, guidance on the key elements contained in an effective RAF. The report also recommended the FSB to establish common definitions for terms used in RAFs to facilitate communication between supervisors and financial institutions, as well as within financial institutions (see Section II). The FSB Principles set out key elements for: (i) an effective risk appetite framework, (ii) an effective risk appetite statement, (iii) risk limits, and (iv) defining the roles and responsibilities of the board of directors and senior management (see Section III). The Principles aim to enhance the supervision of SIFIs but are also relevant for the supervision of financial institutions and groups more generally, including insurers, securities firms and other non-bank financial institutions. For non-SIFIs, supervisors and financial institutions may apply the Principles proportionately so that the RAF is appropriate to the nature, scope and complexity of the activities of the financial institution. An appropriate RAF should enable risk capacity, risk appetite, risk limits, and risk profile to be considered for business lines and legal entities as relevant, and within the group context. Subsidiaries of groups, in particular of SIFIs, should have a risk appetite statement that is consistent with the institution-wide RAF and risk appetite. The elements of the RAF should be applied at the business line and legal entity levels in a manner that is proportionate to the size of the exposures, complexity and materiality of the risks. Materiality should be determined by financial institutions, and discussed with supervisors, in accordance with their internal assessments of risk appetite, risk capacity and risk profile, having regard to capital, liquidity and earnings at the entity level. The FSB Principles are high level to allow financial institutions to develop an effective RAF that is institution-specific and reflects its business model and organisation, as well as to enable financial institutions to adapt to the changing economic and regulatory environment in order to manage new types of risk. Establishing an effective RAF helps to reinforce a strong risk culture at financial institutions, which in turn is critical to sound risk management. A sound risk culture will provide an environment that is conducive to ensuring that emerging risks that will have material impact on an 1 http://www.financialstabilityboard.org/publications/r_111104ee.pdf. 2 http://www.financialstabilityboard.org/publications/r_130212.pdf. 1 institution, and any risk-taking activities beyond the institution’s risk appetite, are recognised, escalated, and addressed in a timely manner. Supervisors should take steps to ensure financial institutions, in particular SIFIs, meet these Principles, and should regularly discuss with financial institutions any changes to its RAF, breaches in risk limits, significant deviations from the approved risk appetite statement, as well as any material risks that the RAF does not adequately address. In the case of international groups, the RAF should be routinely discussed and assessed by supervisors, including at supervisory colleges. II. Key definitions Definitions for key terms used in RAFs often differ across jurisdictions and even within financial institutions. The term ‘risk appetite framework’ and its single elements may have different meanings throughout the industry. For the purposes of these Principles, the following definitions are used which aim to establish a common nomenclature for supervisors and financial institutions to facilitate discussions on risk appetite. Risk appetite The overall approach, including policies, processes, controls, and framework: systems through which risk appetite is established, communicated, and monitored. It includes a risk appetite statement, risk limits, and an outline of the roles and responsibilities of those overseeing the implementation and monitoring of the RAF. The RAF should consider material risks to the financial institution, as well as to the institution’s reputation vis-à-vis policyholders, depositors, investors and customers. The RAF aligns with the institution's strategy. Risk appetite The articulation in written form of the aggregate level and types of risk statement: that a financial institution is willing to accept, or to avoid, in order to achieve its business objectives. It includes qualitative statements as well as quantitative measures expressed relative to earnings, capital, risk measures, liquidity and other relevant measures as appropriate. It should also address more difficult to quantify risks such as reputation and conduct risks as well as money laundering and unethical practices. Risk capacity: The maximum level of risk the financial institution can assume given its current level of resources before breaching constraints determined by regulatory capital and liquidity needs, the operational environment (e.g. technical infrastructure, risk management capabilities, expertise) and obligations, also from a conduct perspective, to depositors, policyholders, shareholders, fixed income investors, as well as other customers and stakeholders. 2 Risk appetite:3 The aggregate level and types of risk a financial institution is willing to assume within its risk capacity to achieve its strategic objectives and business plan. Risk limits: Quantitative measures based on forward looking assumptions that allocate the financial institution’s aggregate risk appetite statement (e.g. measure of loss or negative events) to business lines, legal entities as relevant, specific risk categories, concentrations, and as appropriate, other levels. Risk profile: Point in time assessment of the financial institution’s gross and, as appropriate, net risk exposures (after taking into account mitigants) aggregated within and across each relevant risk category based on forward looking assumptions. III. Principles 1. Risk appetite framework The development and establishment of an effective RAF is an iterative and evolutionary process that requires ongoing dialogue throughout the financial institution to attain buy-in across the organisation. The RAF sets the financial institution’s risk profile and forms part of the process of development and implementation of the institution’s strategy and determination of the risks undertaken in relation to the institution’s risk capacity. For the purpose of these Principles, the RAF does not include the processes to establish the strategy, develop the business plan, and the models and systems to measure and aggregate risks.4 The RAF should be aligned with the business plan, strategy development, capital planning and compensation schemes of the financial institution. An effective RAF should provide a common framework and comparable measures across the financial institution for senior management and the board to communicate, understand, and assess the types and level of risk that they are willing to accept. It explicitly defines the boundaries within which management is expected to operate when pursuing the institution’s business strategy. Financial institutions that implement a RAF most effectively are those that incorporate the framework into the decision-making process and into the institution-wide risk management framework, and communicate and promote the framework throughout the organisation, starting from the top. Financial institutions and supervisors should check that the ‘top down’ risk appetite is consistent 3 The terms “risk appetite”, “risk tolerance”, and “risk limits” can be used by authors with slightly different meanings; however, for clarity and simplicity, the FSB uses only the terms risk appetite and risk limits. 4 Further guidance on these topics is available, for example, in the Basel Committee’s Principles for Sound Liquidity Risk Management and Supervision (2008, available at http://www.bis.org/publ/bcbs144.htm) or Principles for Effective Risk Data Aggregation and Risk Reporting (2013, available at http://www.bis.org/publ/bcbs239.htm). 3 with the ‘bottom up’ perspective through, for example, employee surveys, independent reviews, and internal reporting. The assessment of a financial institution’s consolidated risk profile against its risk appetite should also be an ongoing and iterative process. Implementing an effective RAF requires an appropriate combination of policies, processes, controls, systems and procedures to accomplish a set of objectives. The RAF should enable risk capacity, risk appetite, risk limits, and risk profile to be considered for business lines and legal entities as relevant, and within the group context, taking also into account relationships across legal entities (e.g. in the case of risk pooling or other interconnections).5 As such, an effective and efficient RAF should be closely linked to the development of information technology (IT) and management information systems (MIS) in financial institutions.6 Supervisors should be flexible and apply their skills, experience and knowledge of the financial institution in assessing the adequacy of the RAF. Supervisors can assess the quality of a particular RAF by, for example, discussing with the board and senior management how the financial institution’s business strategy is related to the RAF, as well as how the risk appetite had an impact on the institution’s decisions. This includes reviewing other material, such as strategy and planning documents and board reports, in the context of how the board determines, implements, and monitors its risk appetite so as to ensure that risk-taking is aligned with the board-approved risk appetite statement. 1.1 An effective RAF should: a) establish a process for communicating the RAF across and within the financial institution as well as sharing non-confidential information to external stakeholders (e.g. shareholders, depositors, fixed income investors); b) be driven by both top-down board leadership and bottom-up involvement of management at all levels, and embedded and understood across the financial institution; c) facilitate embedding risk appetite into the financial institution’s risk culture; d) evaluate opportunities for appropriate risk taking and act as a defence against excessive risk-taking; e) allow for the risk appetite statement to be used as a tool to promote robust discussions on risk and as a basis upon which the board, risk management and internal audit functions can effectively and credibly debate and challenge management recommendations and decisions; f) be adaptable to changing business and market conditions so that, subject to approval by senior management and the board as appropriate, opportunities that 5 Materiality should be determined by financial institutions in accordance with their internal assessment of risk appetite, risk capacity and risk profile, having regard to capital, liquidity and earnings at the entity level. 6 Implementation of the BCBS Principles for Effective Risk Data Aggregation and Risk Reporting will facilitate institutions’ ability to identify, measure, aggregate and report on risks at the institution-wide, business line, legal entity and risk category levels. 4 require an increase in the risk limit of a business line or legal entity could be met while remaining within the agreed institution-wide risk appetite;7 g) cover activities, operations and systems of the financial institution that fall within its risk landscape but are outside its direct control, including subsidiaries and third party outsourcing suppliers; and h) be consistent with the principles in this document. 2. Risk appetite statement The risk appetite statement should be easy to communicate and therefore easy for all stakeholders to understand. It should be directly linked to the financial institution’s strategy, address the institution’s material risks under both normal and stressed market and macroeconomic conditions8, and set clear boundaries and expectations by establishing quantitative limits and qualitative statements. It should establish quantitative measures of loss or negative outcomes that can be aggregated and disaggregated. These measures may be expressed in terms of earnings, capital, liquidity-at-risk, or other appropriate metrics (e.g. growth, volatility). Qualitative statements should complement quantitative measures; set the overall tone for the financial institution’s approach to risk taking; articulate clearly the motivations for taking on or avoiding certain types of risks, products, country/regional exposures, or other categories. Setting the institution-wide risk appetite is the first step; the aggregate risk appetite should be allocated to the financial institution’s business lines, legal entities as relevant, and other levels as appropriate, in alignment with the institution’s strategic and business plans. This entails judgement and necessitates input from bottom-up as well as top-down. Some better examples of risk appetite statements include a summary statement that is easy for all stakeholders to understand and addresses the levels and types of risk the financial institution is willing to accept to achieve its business objectives. Risk appetite may not necessarily be expressed in a single document; however, the way it is expressed and the manner in which multiple documents form a “coherent whole” need to be carefully reviewed to ensure that the board obtains a holistic, but compact and easy to absorb, view of the financial institution’s risk appetite. 2.1 An effective risk appetite statement should: a) include key background information and assumptions that informed the financial institution’s strategic and business plans at the time they were approved; b) be linked to the institution’s short- and long-term strategic, capital and financial plans, as well as compensation programs; 7 This could be met, for example, by increasing the institution’s risk capacity, reducing risk within another business line or legal entity, or allocating an excess in risk limit from another business line or legal entity. 8 For example, a stress scenario for liquidity measures could include the ability to meet expected cash outflows due to a financial institution-specific liquidity event that includes loss of access to all unsecured funding markets for up to 12 months (see the BCBS Monitoring Tools for Intraday Liquidity Management, available at: http://www.bis.org/publ/bcbs248.pdf). 5 c) establish the amount of risk the financial institution is prepared to accept in pursuit of its strategic objectives and business plan, taking into account the interests of its customers (e.g. depositors, policyholders) and the fiduciary duty to shareholders, as well as capital and other regulatory requirements; d) determine for each material risk and overall the maximum level of risk that the financial institution is willing to operate within, based on its overall risk appetite, risk capacity, and risk profile; e) include quantitative measures that can be translated into risk limits applicable to business lines and legal entities as relevant, and at group level, which in turn can be aggregated and disaggregated to enable measurement of the risk profile against risk appetite and risk capacity; f) include qualitative statements that articulate clearly the motivations for taking on or avoiding certain types of risk, including for reputational and other conduct risks across retail and wholesale markets, and establish some form of boundaries or indicators (e.g. non-quantitative measures) to enable monitoring of these risks; g) ensure that the strategy and risk limits of each business line and legal entity, as relevant, align with the institution-wide risk appetite statement as appropriate; and h) be forward looking and, where applicable, subject to scenario and stress testing to ensure that the financial institution understands what events might push the financial institution outside its risk appetite and/or risk capacity. 3. Risk limits For the purposes of risk appetite, risk limits are the allocation of the financial institutions’ aggregate risk appetite statement to business line, legal entity levels, specific risk categories, concentrations, and as appropriate, other levels. In order to facilitate effective monitoring and reporting the risk limits should be specific and sensitive to the shape of actual portfolios, measurable9, frequency- based, reportable, and based on forward looking assumptions. Having risk limits that are measurable can prevent a financial institution from unknowingly exceeding its risk capacity as market conditions change and be an effective defence against excessive risk-taking. In setting risk limits, financial institutions need to consider the interaction between risks within and across business lines, and their correlated or compounding impact on exposures and outcomes. As such, stress testing should occur at the institution-wide level as well as for legal entities and specific risks. The number of chosen limits should balance the trade-off between comprehensiveness, and the monitoring costs and effectiveness. 3.1 Risk limits should: a) be set at a level to constrain risk-taking within risk appetite, taking into account the interests of customers (e.g. depositors, policyholders) and shareholders as well 9 For non-quantifiable risks (e.g. reputation risk), risk limits should be measurable even through qualitative assessments. 6 as capital and other regulatory requirements, in the event that a risk limit is breached and the likelihood that each material risk is realised; b) be established for business lines and legal entities as relevant and generally expressed relative to earnings, capital, liquidity or other relevant measures (e.g. growth, volatility); c) include material risk concentrations at the institution or group-wide, business line and legal entity levels as relevant (e.g. counterparty, industry, country/region, collateral type, product); d) although referenced to market best practices and benchmarks, should not be strictly based on comparison to peers or default to regulatory limits; e) not be overly complicated, ambiguous, or subjective; and f) be monitored regularly. 4. Roles and responsibilities The board of directors10 must establish the institution-wide RAF and approve the risk appetite statement, which is developed in collaboration with the chief executive officer (CEO), chief risk officer (CRO) and chief financial officer (CFO). The CEO, CRO and CFO translate those expectations into targets and constraints for business lines and legal entities to follow.11 The independent assessment of the financial institution’s RAF (i.e. by internal audit, an external auditor and/or other independent third party) is critical to the ongoing monitoring and evaluation of the design and overall effectiveness of a financial institution’s internal controls, risk management and risk governance. The strength of the relationships between the board, CEO, CRO, CFO, business lines and internal audit plays an instrumental role in the RAF’s effectiveness. As such, distinct mandates and responsibilities for each of these levels of governance are essential. Financial institutions should allocate the precise roles and responsibilities in accordance with their organisational structure, but the oversight and control functions (usually performed by the CEO, CRO, CFO, business line leaders, and internal audit) should always play a key role. Some financial institutions require senior management to approve the risk appetite statement, with the board formally receiving and noting the risk appetite statement. Boards that approve the risk 10 As noted in the BCBS 2010 Principles for Enhancing Corporate Governance, some countries use a two-tier structure, where the supervisory function of the board is performed by a separate entity known as a supervisory board, which has no executive functions. Other countries use a one-tier structure in which the board has a broader role. Some countries have moved or are moving to an approach that discourages or prohibits executives from serving on the board or limits their number and/or requires the board and its committees to be chaired only by non-executive board members. Owing to these differences, this document does not advocate a specific board structure. The term board refers to the oversight function and the management function in general and should be interpreted throughout the document in accordance with the applicable law within each jurisdiction. The same applies to the committees mentioned in this report which may be under the control of different board functions, accordingly, subject to the board structure and subject to the respective tasks. Recognising that different structural approaches to corporate governance exist across countries, this document encourages practices that can strengthen checks and balances and sound risk governance under diverse structures. 11 The organisational structure of each financial institution is relevant to who will be involved, but these three specific functions (CEO, CRO, CFO) should always play a key role. 7