Key facts
- A majority of banks formally embed risk appetite into business planning and investment decisions.
- Reliance on risk appetite metrics appears to lag in key areas.
- Four in five banks reported breaching risk appetite in the past year.
- Banks that reported no breaches often have skinnier appetite frameworks.
- 71% of banks automate the escalation of appetite breaches.
- North American banks have more developed enterprise risk management functions than European banks.
A majority of banks now formally embed risk appetite and mitigation activities into business planning and investment decisions, according to Risk.net’s latest Enterprise Risk Benchmarking research. However, reliance on these metrics appears to lag in key areas.
Four in five banks reported breaching risk appetite in the past year, with those reporting no breaches often having skinnier appetite frameworks, despite similar governance mechanisms. Approximately 71% of banks automate the escalation of appetite breaches, though automated processes are less common at banks where enterprise risk management (ERM) sets the overall risk appetite.
North American banks are outpacing their European counterparts in ERM, with US and Canadian banks demonstrating more developed functions. Despite this, more than 80% of banks treat ERM as compulsory, even when not explicitly required, often following supervisory guidance or expectations.
The research also indicated that while more banks are adding ERM heads, chief risk officers (CROs) maintain control. Hiring trends show an increase in AI, cyber, and model risk roles, suggesting ERM's remit is growing faster than its reach. Furthermore, fewer than half of banks rate their Governance, Risk, and Compliance (GRC) vendor as ‘good’, with many juggling multiple systems that add costs and complexity.