Do You Know Your Risk Appetite?

Do you Know Your Risk Appetite?

As part of the development of a comprehensive compliance management program, there are specific roles for senior management and another set of roles for the Board of Directors.  Senior management has a functional role that includes the development of written policies and procedures that are then presented to the Board for approval.   On the other hand, the Board of Director’s role includes setting limits and overall policy guidelines.  Among the most important roles of the Board is to determine the overall risk appetite of the institution.   Traditionally, the way that the Board fulfills this function is by developing a risk appetite statement with metrics for measuring adherence to the risk limits.  For Community Banks and small financial institutions, the idea of a risk appetite statement and metrics may seem like a case of overkill.  However, development of the risk appetite framework can be an invaluable tool for strategic planning and resource allocation.

In one way or another, all financial institutions are making a statement about their risk appetite.  Some choose to consider appropriate risk levels directly and many more do so indirectly.  Each product and service that is offered at an institution, vis-a-vis the resources that are dedicated to compliance create a statement of sorts.   When an institution decides to offer products and services, compliance risks attach regardless of what those products are.  The compliance culture that is developed to support products and services is, a form of a risk statement.  The less emphasis that is placed on compliance the higher the risk that the institution is willing to take.   In many cases, when institutions get into significant regulatory trouble, the root cause is an imbalance between risk appetite and risk management.  Offering a new product without the proper systems in place to monitor compliance and without staff that has the expertise to administer it, is the same as a statement that the risk appetite is high.

Principles Associated with the Risk Appetite Framework

The idea here is that the Board, with the assistance of Senior Management should develop the “rules of the road” for your institution.  If there are certain levels of risk that the institution is/isn’t willing to take, then the Board should clearly state that position.  The same is true for risk that the Board may be willing to take after consideration and approval.   For example, the Board may state that it does not want the financial institution to make auto loans at all.  However, the best customer of the institution tells a loan officer that he wants a car loan for his son.    The loan officer believes that the customer may be lost of he isn’t accommodated.   The auto loan is presented to the Board for approval and an exception may be made.

The basic principles for a risk appetite should include at least four considerations:

  1. The capital level of the institution; Since capital is ultimately what keeps the institution alive a healthy level of capital must be a consideration in the overall willingness to accept risk.
  2. Compensation of staff; The extent to which staff compensation are tied to profits is a risk management consideration. Incentives should be weighted toward the idea that profit should be achieved within the risk framework of the institution
  3. Customer Service; As mentioned above there are times when meeting the needs of the customer base that the institution is trying to maintain may require actions that are out of the ordinary. The ability of your institution to meet those needs should be considered in the risk appetite framework.   If your customer base happens to be high risk, then the products and services that you will offer are also high risk.  [1]
  4. Compliance; For each consideration of risk, there should be a consideration of the resources that will be allocated to mitigate the associated potential for regulatory violations.

The risk appetite framework should be developed to balance the interplay of the four principle areas of consideration.  For example, a higher level of capital should mean that the level of risk appetite is higher than when capital is low.  Considerations of customer service have to be tempered by capital levels; and so it goes.

Compliance as Part of the Risk Appetite    

There are many institutions that consider themselves either low risk or no risk for compliance issues because limited retail products and service are offered.   However, compliance is part of this overall process regardless of whether or not you’re in a retail institution.  There are ALWAYS compliance issues.  Regulations such as the Equal Credit Opportunity Act, Anti-money laundering regulations and Unfair Deceptive Abusive Acts or Practices regulations apply to all financial institutions.

In any financial institution, there are competing interests, and the need to achieve and maintain profitability is often the counterbalance to taking increased risk.   Banking is after all at its essence, the management of risk.   When the competing interests are out of balance, the trouble starts.  Today many financial institutions find themselves searching for sources of income that are different from the traditional positive net interest margins.   The search for nontraditional income has led to consideration of products such as short term loans, MSB’s and mobile banking.   Each of these products have a level of inherent risk as well as substantial potential for profits.  However, the compliance apparatus in place at a financial institution can either significantly raise or reduce the level of inherent risk.   Over the past several years, institutions have found themselves in regulatory trouble by offering products that they either do not fully understand or have the necessary ability to administrate.

There are many examples of institutions that have allowed the push for profits to far outstrip the compliance program.  In fact, on the websites of each of the major regulatory agencies, there are examples of enforcement actions that have been taken as the result of failure to properly maintain a compliance program.

Using the risk framework to help with prioritizing  

When a risk appetite framework is developed and implemented even by a small financial institution, the overall effect on compliance is positive.  The process for developing the framework forces a level of consideration and discipline on the Board and senior management that is useful.  The risk appetite process is conducted by comparing the products and services that that the institutions wishes to offer with its ability to safely offer those products and services.

When a new product is considered, it should receive the same level of thought and consideration.  High risk products are not in of themselves a regulatory “no-no”.   For each additional product or service, the risk appetite of the Board should be considered along with the necessary expenditure on compliance resources.

Remember the overall state of your CMP says a great deal about your risk appetite.


[1] Please note- there are no regulatory bans on high risk customer or clients- just a requirement that the high risks are properly managed.

Your Partner in Balancing Compliance