CRA Risk Appetite & Tolerance Frameworks 2 — Questions and Answers
Question 1: A bank's risk appetite statement says it will accept up to $50M in credit losses annually. This year losses reach $48M. What is the most appropriate immediate action?
- Escalate to the board for breach authorization
- Take no action as the limit has not been breached
- Issue a warning and increase monitoring intensity (Correct answer)
- Immediately liquidate credit exposures
Correct answer: Issue a warning and increase monitoring intensity
When approaching but not yet breaching a tolerance limit, the appropriate response is to issue an early warning and heighten monitoring to prevent an actual breach.
Question 2: Which of the following BEST describes the relationship between risk capacity and risk appetite?
- Risk capacity and risk appetite are synonymous terms
- Risk appetite must always equal risk capacity
- Risk appetite should be set at or below the organization's risk capacity (Correct answer)
- Risk capacity is always lower than risk appetite
Correct answer: Risk appetite should be set at or below the organization's risk capacity
Risk appetite is the amount of risk an organization is willing to accept, which should not exceed risk capacity — the maximum risk the entity can absorb before failure.
Question 3: A risk analyst is building a risk appetite framework for a fintech startup. Which element is MOST critical to establish first?
- Quantitative risk limits for each business unit
- Board-approved overarching risk appetite statement (Correct answer)
- Operational risk tolerance thresholds
- Risk reporting templates and dashboards
Correct answer: Board-approved overarching risk appetite statement
The board-approved overarching risk appetite statement provides strategic direction that all subsequent quantitative limits and thresholds must flow from.
Question 4: In a risk tolerance framework, a 'hard limit' differs from a 'soft limit' because:
- Hard limits require board approval while soft limits do not
- Breaching a hard limit triggers immediate mandatory action, whereas soft limits prompt review and escalation (Correct answer)
- Hard limits apply only to financial risks while soft limits cover operational risks
- Soft limits are set by regulators and hard limits by management
Correct answer: Breaching a hard limit triggers immediate mandatory action, whereas soft limits prompt review and escalation
Hard limits are non-negotiable thresholds whose breach demands immediate action, while soft limits serve as early warning triggers that initiate review processes.
Question 5: An organization's stated risk appetite is 'low' for reputational risk. A proposed marketing campaign carries a moderate reputational risk. What should occur?
- Approve the campaign since moderate risk is close to low
- Reject the campaign outright without further analysis
- Conduct additional risk assessment and escalate for senior approval before proceeding (Correct answer)
- Proceed and monitor outcomes post-launch
Correct answer: Conduct additional risk assessment and escalate for senior approval before proceeding
When a proposed activity exceeds stated risk appetite, additional analysis and escalation to appropriate authority is required before a final decision is made.
Question 6: Which scenario represents a 'risk tolerance breach' rather than a 'risk appetite exceedance'?
- A business unit's VaR exceeds its quarterly planning target
- Operational losses exceed the maximum threshold defined in policy (Correct answer)
- A new product's projected risk is above preferred levels
- A risk score increases from 'low' to 'medium'
Correct answer: Operational losses exceed the maximum threshold defined in policy
Tolerance breaches occur when actual risk outcomes exceed defined maximum limits in policy, whereas appetite exceedance reflects going beyond preferred or target levels.
Question 7: Why should a risk appetite framework be reviewed and updated at least annually?
- To comply with SEC quarterly reporting requirements
- Because regulatory bodies require monthly updates
- To reflect changes in strategy, environment, and lessons from risk events (Correct answer)
- To allow management to reset all tolerance limits downward
Correct answer: To reflect changes in strategy, environment, and lessons from risk events
Annual reviews ensure the risk appetite framework remains aligned with the organization's evolving strategy, market conditions, and insights from past risk events.
CRA Risk Appetite & Tolerance Frameworks 2
A bank's risk appetite statement says it will accept up to $50M in credit losses annually.
This year losses reach $48M.
What is the most appropriate immediate action?