Boards and senior management of banks must ensure that their risk appetite is held in check and that the quality of risk management practices is not compromised. In this regard, risk management should not be a discussion confined to only senior level management. Risk management should be an enterprise-wide process, involving all levels.
Top management is responsible for putting in place a well-defined risk governance framework and formulating the appropriate risk strategies. At the operational level, the roles of the business units are to ensure that key risks are appropriately identified, assessed and mitigated. Risk management is a dynamic and iterative process, not a one-off exercise.