Skip to content

FRM Exam Part I · The Governance of Risk Management

Risk Appetite Statement and Risk Culture Explained

Updated 11 October 2026 · Fact-checked

A risk appetite statement (RAS) is a board-approved document that sets the amount and types of risk a firm is willing to take to pursue its strategy, backed by limits and metrics. Risk culture is the shared norms and incentives that drive how staff actually treat risk. Exam questions test the link between them.

Understand Risk Appetite Statement and Risk Culture

Start with a simple idea. Every firm takes risk to earn a return. The board must decide how much risk is acceptable. That decision is the risk appetite. It is the aggregate level and types of risk the firm is willing to assume to achieve its business objectives.

A risk appetite statement writes this down. It is approved by the board, usually proposed by the CEO, CRO and CFO. A good RAS has both qualitative and quantitative parts. Qualitative parts describe the types of risk the firm will or will not take, and its stance on reputation and conduct. Quantitative parts are metrics such as capital ratios, earnings volatility, loss limits, VaR, liquidity ratios and concentration limits.

Risk appetite is then cascaded down. The board sets the overall appetite. Management turns it into risk limits for business lines, desks and risk types. Frameworks often distinguish a few terms. Risk capacity is the maximum risk the firm can bear before it breaches constraints such as capital, liquidity or regulatory requirements. Risk appetite is below capacity. Risk tolerance (or limits) is the allowed deviation around appetite for a specific risk, and risk profile is the risk actually held at a point in time. Usage of these terms varies between sources. Read the definitions given in the question.

Monitoring closes the loop. Risk reports compare the risk profile with appetite and limits. Breaches are escalated, and the RAS is reviewed regularly and when strategy or conditions change. The RAS should be linked to strategy, capital planning, budgeting and compensation.

Risk culture is the set of norms, attitudes and behaviors on risk and control across the firm. Culture decides whether the RAS is followed or just filed. Strong cultures show tone from the top, accountability, open communication and challenge, and incentives that reward risk-adjusted results rather than raw revenue. Pay tied only to short-term profit encourages excess risk. Weak cultures show silos, ignored limit breaches and fear of speaking up.

Key formulas to remember

Ordering of risk concepts
Risk profile ≤ Risk tolerance (limits) ≤ Risk capacity, with risk appetite set below capacity
A common framework ordering. Check the definitions in the question, since terms are used differently across sources.
Limit utilization
Utilization = Current exposure ÷ Limit
Above 100% is a breach and must be escalated.
Risk-adjusted incentive idea
Risk-adjusted performance = Return ÷ Risk (or Return − Capital charge)
Used to link pay to risk taken, for example RAROC-style measures.

How to solve Risk Appetite Statement and Risk Culture questions

Use this method for any conceptual or scenario question on risk appetite and culture.

  1. 1Identify what is being asked: definition, process step, responsibility, or a culture/incentive problem.
  2. 2Separate the terms: capacity (maximum), appetite (desired level), tolerance/limits (allowed deviation), profile (actual).
  3. 3Decide who owns the item: the board approves the RAS; management implements it; the CRO monitors and reports.
  4. 4Check for a link to strategy, capital and limits. A good RAS has both qualitative and quantitative elements.
  5. 5For culture questions, look at tone from the top, accountability, communication and incentives.
  6. 6If numbers are given, compare exposure with limit and decide on escalation.
  7. 7Eliminate options that put the profit motive above risk limits or that leave the board out of approval.

Quickest way: Owner and link check

When to use it: Use for multiple-choice questions with four plausible statements when time is short.

  1. Ask who approves: board for appetite, management for limits.
  2. Ask if the option links appetite to strategy, limits and pay.
  3. Reject absolutes such as 'zero risk' or 'revenue only' incentives.
  4. Pick the option that closes the loop through monitoring and escalation.

Common mistakes in Risk Appetite Statement and Risk Culture

  • Treating risk appetite and risk tolerance as identical.

    Everyday language blurs them and sources differ.

    Fix: Appetite is the desired level of risk. Tolerance is the acceptable deviation or limit. Follow the definitions given.

  • Thinking the RAS is only quantitative.

    Candidates focus on VaR and capital metrics.

    Fix: Remember qualitative statements on risk types, conduct and reputation also belong in a RAS.

  • Assigning approval of the RAS to the CRO or business heads.

    The CRO does most of the work.

    Fix: The board approves. The CRO helps develop, monitor and report.

  • Believing a RAS alone ensures good behavior.

    Documents feel like control.

    Fix: Culture and incentives decide actual behavior. A RAS without them fails.

  • Confusing risk capacity with risk appetite.

    Both relate to how much risk can be taken.

    Fix: Capacity is the hard maximum. Appetite is chosen below it with a buffer.

Worked examples

Example 1

A bank's board sets a maximum of ₹500 crore for trading VaR. The desk reports a current VaR of ₹560 crore. What is the limit utilization and what should happen?

Show the solution
  1. Utilization = Current exposure ÷ Limit.
  2. = 560 ÷ 500 = 1.12, or 112%.
  3. This is above 100%, so the limit is breached by 12%.
  4. The breach must be escalated to senior risk management and, per policy, the board, with a plan to cut risk or a documented approval.

Answer: Utilization is 112%. It is a limit breach that must be escalated and resolved.

Example 2

A firm pays traders a bonus based only on annual revenue, and breaches of limits are often waived for top earners. Which risk culture problem does this show, and what is the best fix?

Show the solution
  1. Pay on revenue alone rewards risk taking with no cost for the risk.
  2. Routine waivers show that limits are not enforced and that accountability is weak.
  3. Together they signal a poor tone from the top and misaligned incentives.
  4. The fix is to tie pay to risk-adjusted performance, include compliance with limits and conduct in assessments, and enforce consequences for breaches.

Answer: Misaligned incentives and weak accountability. Link pay to risk-adjusted results and enforce limits consistently.

Exam tips

  • Know who does what: board approves, management implements, CRO monitors and reports independently.
  • Expect scenario questions where incentives cause excess risk taking. The answer usually involves risk-adjusted pay.
  • Watch for definition traps among capacity, appetite, tolerance and profile.
  • A good RAS is linked to strategy, capital and limits. Eliminate options that treat it as standalone.

Practice questions from The Governance of Risk Management

Risk Appetite Statement and Risk Culture in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Risk Appetite Statement and Risk Culture: frequently asked questions

What is the difference between risk appetite and risk tolerance?

Risk appetite is the level and type of risk a firm wants to take to meet its objectives. Risk tolerance is the acceptable variation around that level, often expressed as limits. Some sources use the terms differently, so use the definitions in the question.

What should a risk appetite statement contain?

It should state the types and levels of risk the firm will accept, with quantitative metrics such as capital, liquidity, loss and concentration limits. It should also include qualitative statements on conduct and reputation, and be linked to strategy.

What is risk culture in banks?

Risk culture is the shared norms, attitudes and behaviors that shape how staff identify, discuss and manage risk. It is shaped by tone from the top, accountability, open challenge and incentives.

Who is responsible for the risk appetite statement?

The board approves it, usually on the proposal of senior management. The CRO helps design it, monitors the risk profile against it and reports breaches.