Skip to content

FRM Exam Part I · The Building Blocks of Risk Management

Risk Appetite and Risk Management Framework Explained

Updated 11 October 2026 · Fact-checked

Risk appetite is the amount and type of risk a firm is willing to take to pursue its strategy. A risk management framework turns that appetite into tolerances, limits, monitoring and escalation. To answer exam questions, identify the level (appetite, tolerance or limit), who owns it and how breaches are handled.

Understand Risk Appetite and Risk Management Framework

Every firm takes risk to earn a return. The question is how much, and of what kind. Risk appetite is the aggregate level and type of risk a firm is willing to accept to achieve its objectives. It is set by the board and linked to strategy, capital and earnings goals.

A risk appetite statement (RAS) writes this down. A good RAS has qualitative parts (the types of risk the firm will and will not take, and its attitude to conduct and reputation) and quantitative parts (capital ratios, earnings volatility, loss budgets, liquidity buffers). It must be understood across the firm, not only at board level.

You must separate four terms. Risk appetite is the broad level of risk the firm wants to take. Risk tolerance is the maximum deviation from the target the firm will accept in a given area. The board approves both appetite and tolerance. Risk limits are the tight, operational controls given to business units, desks or portfolios, such as a VaR limit, a notional limit or a concentration limit. Management and the CRO set and cascade them. Limits are set within tolerance. Risk capacity is a separate concept: the absolute maximum risk the firm could bear before breaching regulatory capital or solvency constraints. Risk appetite and risk tolerance both sit below risk capacity. Treat this as a conceptual ordering, not a strict mathematical inequality to memorise, because tolerance is a deviation and appetite is a level.

The risk management framework is the structure that makes this work. It covers governance (board, risk committee, CRO, three lines of defense), policies, risk identification and assessment, measurement, limits, monitoring, reporting, escalation and review. Appetite is cascaded down into limits, and results are reported back up. Breaches trigger defined escalation: who is told, how fast, and what action follows.

The process is a loop. Strategy shapes appetite, appetite shapes limits, monitoring shows actual risk, and reports go back to the board, which adjusts strategy or appetite. Good frameworks are forward-looking, use stress tests as well as VaR, and are linked to pay and culture, so that taking risk beyond appetite is not rewarded.

Key formulas to remember

Hierarchy of risk terms
Risk appetite and risk tolerance both sit below risk capacity; limits are set within tolerance
Appetite is the chosen target level. Tolerance is the maximum acceptable deviation around it. Capacity is the maximum the firm can bear. Limits are the day-to-day controls, set within tolerance. This is a conceptual ordering, not a strict inequality or a calculation.
Limit utilization
Utilization = Current exposure ÷ Limit
Above 100% means a breach. Many firms also set early-warning triggers below 100%, such as 80%.
Risk-based capital headroom
Headroom = Available capital − Required (risk-based) capital
A simple way to compare appetite and capacity. Negative headroom means capacity is exceeded.

How to solve Risk Appetite and Risk Management Framework questions

Use this method for any conceptual or short-calculation question on appetite and frameworks.

  1. 1Read the question and decide which level it tests: capacity, appetite, tolerance or limit.
  2. 2Identify the owner. The board approves appetite and tolerance. Senior management and the CRO set and cascade limits. Business units operate within limits.
  3. 3Check the direction of flow: strategy to appetite to limits to monitoring to reporting back to the board.
  4. 4If numbers are given, compute utilization (exposure ÷ limit) or headroom and compare with the limit or trigger.
  5. 5Decide what the framework requires: escalation, approval of an exception, reduction of the position or review of the limit.
  6. 6Eliminate options that mix levels, such as treating a desk limit as the firm's appetite, or that let business lines set their own appetite.
  7. 7Choose the option that is forward-looking, quantitative where possible and consistent with strategy and capital.

Quickest way: Level and owner test

When to use it: Use for definition or best-practice multiple-choice questions when time is short.

  1. Ask: is the statement broad and firm-wide (appetite), a maximum deviation (tolerance), or a specific desk control (limit)?
  2. Match the owner: the board approves appetite and tolerance; management and the CRO set and cascade limits.
  3. Reject any option that says appetite is set only by business lines, is purely qualitative, or is fixed forever.
  4. Prefer the option that links appetite to strategy, capital and escalation.

Common mistakes in Risk Appetite and Risk Management Framework

  • Treating risk appetite and risk tolerance as the same thing.

    Everyday language uses them interchangeably.

    Fix: Appetite is the desired overall level of risk. Tolerance is the acceptable deviation or maximum in a specific area. Limits are the operational controls.

  • Confusing risk appetite with risk capacity.

    Both describe 'how much risk'.

    Fix: Capacity is the most the firm can bear. Appetite is what it chooses to take and must be below capacity.

  • Saying business units set the firm's risk appetite.

    Business lines own the risk day to day.

    Fix: The board approves appetite. Business units operate within limits cascaded from it.

  • Thinking a risk appetite statement is only qualitative or only quantitative.

    Students remember one example only.

    Fix: A good RAS combines both: qualitative statements on risk types and culture, and quantitative metrics and limits.

  • Ignoring escalation when a limit is breached.

    Focus is on measuring risk, not on action.

    Fix: A framework must define who is informed, how quickly, and whether the breach is cured or approved as an exception.

  • Assuming the framework is static.

    Policies look like fixed documents.

    Fix: Appetite and limits are reviewed regularly and after changes in strategy, market conditions or stress test results.

Worked examples

Example 1

A bank's board approves a risk appetite that trading VaR must not exceed USD 50 million. The CRO sets a desk limit of USD 12 million for an equity desk within that appetite. The desk's current VaR is USD 10.2 million. An early-warning trigger is set at 80% of the limit. What is the utilization and what action is required?

Show the solution
  1. Utilization = current exposure ÷ limit = 10.2 ÷ 12.
  2. 10.2 ÷ 12 = 0.85, or 85%.
  3. Trigger is 80%, and 85% is above it.
  4. The limit of 100% is not breached, so no formal breach exists.

Answer: Utilization is 85%. There is no breach, but the early-warning trigger is passed. The desk should notify the risk manager or CRO and the position should be monitored as the escalation policy prescribes.

Example 2

Which statement best describes the relationship between risk capacity, appetite and limits? (A) Limits are set above capacity to allow flexibility. (B) Appetite is set by the board below capacity, and limits cascade it to business units. (C) Capacity is chosen by each desk based on its targets. (D) Appetite and capacity are identical.

Show the solution
  1. Capacity is the maximum the firm can bear, so it is a ceiling and not chosen by desks. This removes C.
  2. Appetite is below capacity, so D is wrong.
  3. Limits set above capacity would defeat their purpose, so A is wrong.
  4. B matches the cascade: board sets appetite under capacity, and limits translate it for business units.

Answer: B

Exam tips

  • Remember the conceptual ordering: appetite and tolerance sit below capacity, and limits are set within tolerance. Also know who owns each. Do not treat it as a strict inequality to memorise.
  • Expect questions on what a good risk appetite statement contains: strategy link, qualitative and quantitative parts, and communication.
  • For breach questions, choose answers with defined escalation and documented exceptions.
  • Watch for options saying appetite should never change. Good frameworks review it regularly.
  • If a calculation appears, it is usually simple utilization or headroom. Do it first, then apply the concept.

Practice questions from The Building Blocks of Risk Management

Risk Appetite and Risk Management Framework in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Risk Appetite and Risk Management Framework: frequently asked questions

What is a risk appetite statement in FRM Part I?

It is a board-approved document that states the amount and types of risk the firm will take to meet its strategy. It includes qualitative statements and quantitative metrics, and it guides limits and monitoring.

What is the difference between risk appetite and risk tolerance?

Appetite is the overall level of risk a firm wants to take. Tolerance is the maximum acceptable deviation in a specific area. Tolerance is narrower and more measurable.

How do risk limits relate to risk appetite?

Limits translate appetite into controls for desks, portfolios or risk types. In aggregate they should keep the firm within its appetite and tolerance.

What are the main parts of a risk management framework?

Governance, policies, risk identification, measurement, limits, monitoring, reporting, escalation and regular review. Appetite links them together.