Risk appetite frameworks boards can use

The Risk Control Part puts the duty on the management body: approve and periodically review the strategies and policies for taking up, managing, monitoring and mitigating the risks, with risk management policies that set the level of risk tolerated by the firm. A significant firm must have a risk committee of non-executive members of the management body to advise it on the firm’s overall current and future risk appetite.

SS5/16, the PRA’s supervisory statement on board responsibilities (published 4 July 2018, in effect since 10 December 2018), sets the standard: a well-articulated and measurable statement of risk appetite, clearly owned by the board, integral to the strategy and actively used by them to monitor and control actual and prospective risks, in terms employees throughout the business can readily understand. The risk control framework should flow from it.

The evidence that a statement is actively used is the board pack, so that is where we look first: are the metrics in the statement the metrics in the risk report, and do the minutes show the board challenging a breach rather than noting it?

Sources: PRA Rulebook, Risk Control Part, rules 2.2C, 2.3 and 3.1; PRA SS5/16, July 2018, paras 4.1 and 4.2.

As a ladder, one for each capital and liquidity metric. The regulatory minimum and the buffers sit at the bottom, where capacity runs out. The recovery plan’s triggers sit above them, calibrated in relation to the buffers as SS9/17 expects, with early warning indicators above those and each trigger a prompt to consider the situation rather than an automatic action. The board’s appetite limit sits above the recovery trigger, and the operating range the business plans within sits above that.

A limit set below the recovery trigger means the recovery plan fires before the board’s own appetite is breached. That is the gap we find most often, usually because two teams wrote the two documents from different balance sheets, and the first thing we reconcile with the recovery planning work.

Two dated changes move the rungs. Basel 3.1 applies from 1 January 2027 and re-measures risk-weighted assets, the denominator of the risk-based capital ratios, so a CET1 limit set on today’s rules describes a different balance sheet after that date. For a small domestic deposit taker the SDDT capital regime, in force the same day, replaces the capital conservation buffer, the countercyclical buffer and the PRA buffer with a Single Capital Buffer the PRA has said will be set no lower than 3.5% of RWAs. The capital rungs in the statements we see need rebuilding before the first board pack of 2027.

Sources: PRA SS9/17 Recovery planning, March 2026, paras 2.45, 2.47 and 2.51; PRA PS1/26, 20 January 2026, para 1.23; PRA PS9/24, 12 September 2024, para 1.7; PRA PS20/25, 28 October 2025, paras 1.14 and 4.43; PRA PS4/26, 20 January 2026, para 1.15.

The work is led by Mark Dougherty, CPA (CAN), our technical lead, and done by senior practitioners who have held the roles: former CROs and heads of risk, former regulators and interim executives, with model and quant specialists. If you want risk framework consultants who have sat in the CRO’s chair, that is the bench.

Work our senior people have led includes the enterprise risk management framework for a start-up bank that won its UK banking licence after two failed applications.

Every engagement starts with a 30-minute scoping call and a written proposal setting out scope, timetable and fee, and runs inside Risk Advisory alongside the ICAAP, ILAAP and recovery planning work.