[author: Kevin Wong]

The European Central Bank (“ECB“) published a speech, “Risk appetite frameworks: good progress but still room for improvement“, given by Daniele Nouy, ECB Supervisory Board Chair, at the International Conference on Banks’ Risk Appetite Frameworks on April 10, 2018.

In her speech, Ms. Nouy explains that a bank’s risk appetite framework includes the policies, processes, limits, controls and systems it puts in place to define, communicate and monitor how much risk it is willing to take on. Supervisors expect risk appetite frameworks to be comprehensive, effectively governed, consistently used and fully integrated into strategic decision-making.

Ms. Nouy acknowledges that banks’ risk appetite frameworks are now better structured and subject to clearer governance. Most banks have clarified the role of the relevant stakeholders involved in the risk appetite framework and many banks’ internal auditors have reviewed the effectiveness of risk appetite frameworks.

However, she highlights four areas in which banks need to improve:

• Banks need to improve how they embed risk appetite frameworks in their strategic processes. They need to take a holistic approach to risk culture and risk management and to align risk modifiers and key performance indicators with their risk appetite frameworks. The board must challenge the senior management and ensure that each strategic decision is based on a sound risk analysis.
• Risk appetite frameworks still do not cover enough risks, particularly non-financial risks (such as compliance and reputational risks, IT risks, legal risks and conduct risks).
• The governance of risk appetite frameworks must be improved. Boards and banks’ risk functions need to play a larger role in defining and reviewing risk appetite frameworks
• Risk appetite limits need to be set and used comprehensively. Banks need to break these limits down to business lines, entities and countries and need to work on how they calculate and apply limits.

Ms. Nouy previously stated that banks’ progress had been too slow in relation to risk management frameworks in a speech in March 2018.

The ECB identified risk management as one its supervisory priorities for the single supervisory mechanism (“SSM“) for 2018.