Risk Appetite & Tolerance Frameworks Flashcards

A manufacturing firm sets its risk appetite for safety incidents at 'zero tolerance.' In practice, what does 'zero tolerance' most accurately mean within a risk framework?

Answer: Any incident, regardless of severity, triggers mandatory investigation and remediation

Zero tolerance in practice means any occurrence triggers mandatory response and remediation; it does not imply incidents are impossible but that none are acceptable without action.

A risk appetite framework uses Key Risk Indicators (KRIs) as 'traffic lights' — green, amber, red. What does an AMBER status typically signal?

Answer: Risk is approaching tolerance limits; heightened monitoring and potential escalation required

Amber status serves as an early warning that risk is trending toward limits, triggering increased monitoring and proactive management before a breach occurs.

Which of the following BEST illustrates the concept of 'risk appetite aggregation' at the enterprise level?

Answer: Adding all individual business unit VaR figures to get total portfolio VaR, adjusted for correlation

Enterprise-level risk appetite aggregation combines individual exposures while accounting for correlations to avoid double-counting or underestimating diversification benefits.

A firm's risk appetite states it seeks 'moderate' growth with 'low' operational risk. A proposed acquisition would accelerate growth but significantly increase operational complexity. This situation is best described as:

Answer: A risk appetite conflict requiring board-level resolution

When strategic pursuits conflict with stated risk appetite dimensions, the conflict must be escalated to the board to either adjust appetite or decline the initiative.

In the Three Lines of Defense model, which line is PRIMARILY responsible for SETTING risk appetite?

Answer: Second line — risk management and compliance

The second line (risk management function) typically designs and proposes the risk appetite framework, which is then approved by the board.

A risk tolerance framework distinguishes between 'inherent risk tolerance' and 'residual risk tolerance.' Which statement is CORRECT?

Answer: Inherent risk tolerance applies before controls; residual risk tolerance applies after controls

Inherent risk tolerance defines acceptable risk before controls are applied; residual risk tolerance defines what is acceptable after controls, which should be lower.

Which regulatory framework explicitly requires financial institutions to document and articulate a risk appetite framework as part of their governance standards?

Answer: Basel III / FSB Risk Appetite Framework principles

The Basel III framework and Financial Stability Board (FSB) principles for sound risk appetite frameworks explicitly require banks to articulate and document risk appetite.