FRM Exam Part II · The Investment Function in Financial Services Management

Investment Policy and Risk Appetite Framework Explained

Updated 11 October 2026 · Fact-checked

An investment policy sets what a bank may buy, in what size, and who approves it. A risk appetite framework sets how much risk the institution is willing to take overall. To solve questions, start from liabilities and risk appetite, then check that limits, permitted securities and governance match.

Understand Investment Policy and Risk Appetite Framework

Start with the institution's job. A bank takes deposits and other funding, then invests surplus funds. Those funds can be withdrawn or repaid at set times. So the portfolio must be built around the liabilities, not around the highest yield.

Risk appetite is the amount and type of risk the board is willing to accept to meet its strategy. It is set at the top and covers the whole institution. It is usually expressed as a statement plus measures such as capital ratios, liquidity ratios, earnings volatility and loss tolerance.

Investment policy is the lower-level document that turns that appetite into rules for the investment function. It states objectives, permitted securities, credit quality minimums, concentration limits, maturity and duration limits, liquidity requirements, and who may approve exceptions. So risk appetite says how much risk; investment policy says how it may be taken in the portfolio.

Governance connects the two. The board approves the risk appetite and the policy. Senior management and the treasury or investment desk run the portfolio. An independent risk function monitors limits and reports breaches. Breaches need a defined escalation path and a record of who approved any exception.

Risk limits come in layers. Typical ones are: exposure limits by issuer, rating, sector and country; market risk limits such as VaR, DV01 or duration; liquidity limits such as the share of assets that are high-quality liquid; and stop-loss or loss-trigger limits. Limits should sit inside appetite, with early-warning triggers set below the hard limit so management can act before a breach.

Key formulas to remember

Hierarchy of the framework: Risk capacity ≥ Risk appetite ≥ Risk limits; Capacity is the maximum risk the institution could bear. Appetite is what the board chooses to take. Limits are the day-to-day controls set within appetite.
Limit utilisation: Utilisation = Current exposure ÷ Limit × 100%; Used to monitor limits. A trigger is often set below 100%, for example at 80%, to give early warning.
Concentration limit check: Exposure to one issuer ÷ Reference base ≤ Limit %; The reference base is whatever the policy names, such as the portfolio, Tier 1 capital or total capital. Always use the base the policy states.
Portfolio duration: D(portfolio) = Σ wi × Di; Weights are market-value shares. Compare with the policy duration range and with the duration of liabilities.
Duration gap (simple form): Duration gap = D(assets) − (Liabilities ÷ Assets) × D(liabilities); A positive gap means asset value falls more than liability value when rates rise, so equity falls.

How to solve Investment Policy and Risk Appetite Framework questions

Use this order for any question on investment policy, limits or risk appetite.

1Identify the level: is the question about risk appetite (board, whole institution), investment policy (rules for the portfolio) or a limit (a number)?
2Identify the liabilities and constraints: funding stability, maturity, currency, liquidity needs and regulatory ratios.
3Check each proposed investment against permitted securities, minimum credit quality and maturity rules in the policy.
4Calculate any limit test: exposure divided by the stated base, or weighted-average duration, and compare with the limit.
5Check liquidity and interest rate fit between assets and liabilities, including stress conditions.
6Check governance: who approves, who monitors, how breaches are escalated and whether exceptions are documented.
7Pick the answer that keeps the portfolio inside appetite and aligned with liabilities, not the one with the highest return.

Quickest way: Three-check shortcut

When to use it: Use it for scenario MCQs where options mix return, limits and governance.

Remove any option that breaches a stated limit or permitted list.
Remove any option that ignores liabilities or liquidity needs.
Between the rest, choose the one with proper board approval and independent monitoring. If a number is needed, do one division or one weighted average only.

Common mistakes in Investment Policy and Risk Appetite Framework

Treating risk appetite and investment policy as the same thing.
Both mention limits and risk tolerance.
Fix: Appetite is the board's statement of how much risk overall. Policy is the set of portfolio rules that carry it out.
Choosing the highest-yielding option.
Return looks like the objective of an investment function.
Fix: For an institution, the first test is fit with liabilities, liquidity and appetite. Return comes after that.
Using the wrong base for a concentration limit.
Students divide by total assets when the policy says capital.
Fix: Read the base in the question and use exactly that.
Letting the investment desk monitor its own limits.
Desk staff know the positions best.
Fix: Monitoring and breach reporting should be independent of those taking the risk, with escalation to senior management or the board.
Treating a limit breach as acceptable if the portfolio is profitable.
Profit seems to justify the position.
Fix: A breach is a control failure. It needs escalation, approval or reduction, and documentation, whatever the profit.
Setting the hard limit equal to risk capacity.
Students want to use all the room available.
Fix: Limits sit inside appetite, and appetite sits inside capacity. Add early-warning triggers below the limits.

Worked examples

Example 1

A bank's investment policy limits exposure to any single corporate issuer to 10% of Tier 1 capital. Tier 1 capital is USD 800 million. The bank holds USD 70 million of bonds of Issuer X and plans to buy USD 15 million more. Can it proceed, and what is the limit utilisation after the purchase?

Show the solution

Limit = 10% × USD 800 million = USD 80 million.
Exposure after purchase = 70 + 15 = USD 85 million.
USD 85 million is above USD 80 million, so the purchase breaches the limit.
Utilisation after purchase = 85 ÷ 80 = 106.25%.
Room available now = 80 − 70 = USD 10 million.

Answer: No. The purchase would take exposure to USD 85 million, 106.25% of the USD 80 million limit. The bank can buy at most USD 10 million more without an approved exception.

Example 2

A bank's investment policy requires portfolio duration between 3.0 and 4.0 years. The portfolio is USD 600 million in 2-year bonds (duration 1.9), USD 300 million in 7-year bonds (duration 6.0) and USD 100 million in 10-year bonds (duration 8.0). Is it within policy?

Show the solution

Total = 600 + 300 + 100 = USD 1,000 million.
Weights are 0.60, 0.30 and 0.10.
Duration = 0.60 × 1.9 + 0.30 × 6.0 + 0.10 × 8.0.
= 1.14 + 1.80 + 0.80 = 3.74 years.
3.74 lies between 3.0 and 4.0.

Answer: Portfolio duration is 3.74 years, so it is within the policy range. Management should still compare it with the duration of liabilities and watch how close it is to the 4.0 limit.

Exam tips

Read what each limit is measured against. Capital, total assets and portfolio value give different answers.
When asked who is responsible, the board approves appetite and policy, management implements, and an independent risk function monitors.
Expect options that offer higher yield by breaking a limit or a liquidity need. Reject them.
Questions often test the order: capacity, then appetite, then policy, then limits.
Show a breach as a number first, then state the escalation action.

Practice questions from The Investment Function in Financial Services Management

Investment Policy and Risk Appetite Framework in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Investment Policy and Risk Appetite Framework: frequently asked questions

What is the difference between investment policy and risk appetite?

Risk appetite is the board's statement of how much and what kind of risk the whole institution will accept. Investment policy is the set of rules for the investment portfolio, such as permitted securities and limits, that keeps the portfolio within that appetite.

What should a bank investment policy contain?

It should state objectives, permitted securities, minimum credit quality, issuer and sector concentration limits, maturity or duration limits, liquidity requirements, and roles and approvals. It should also set breach escalation and review frequency.

Who approves and monitors investment limits?

The board approves the risk appetite and the policy, and senior management sets detailed limits within them. An independent risk function monitors and reports breaches, separate from the desk that takes the positions.

How are portfolio limits set for a bank?

Start from risk appetite, capital, liquidity needs and the profile of liabilities. Then set limits by issuer, rating, sector, duration and liquidity, with early-warning triggers below each hard limit, and review them regularly.