Over the past few years, banks have made good progress in designing their risk appetite frameworks. Still, there is scope for improvement. Even though risk appetite frameworks now cover many more types of risk, one category is often overlooked: non-financial. Reputational risks, IT risks or legal risks are often either not covered at all or just in part.
I know that it’s difficult to measure these risks, but neglecting them is no solution either. Once the risk appetite has been defined, risk limits play a major role. They ensure that the risks taken are in line with the risks defined; they make the risk appetite operational. It is important that banks break down these limits by business lines, entities or countries.