Risk Appetite & Tolerance Frameworks Flashcards
7 cards from real CRA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Risk Appetite & Tolerance Frameworks flashcards as text
A bank's risk appetite statement says it will accept up to $50M in credit losses annually. This year losses reach $48M. What is the most appropriate immediate action?
Answer: Issue a warning and increase monitoring intensity
When approaching but not yet breaching a tolerance limit, the appropriate response is to issue an early warning and heighten monitoring to prevent an actual breach.
Which of the following BEST describes the relationship between risk capacity and risk appetite?
Answer: Risk appetite should be set at or below the organization's risk capacity
Risk appetite is the amount of risk an organization is willing to accept, which should not exceed risk capacity — the maximum risk the entity can absorb before failure.
A risk analyst is building a risk appetite framework for a fintech startup. Which element is MOST critical to establish first?
Answer: Board-approved overarching risk appetite statement
The board-approved overarching risk appetite statement provides strategic direction that all subsequent quantitative limits and thresholds must flow from.
In a risk tolerance framework, a 'hard limit' differs from a 'soft limit' because:
Answer: Breaching a hard limit triggers immediate mandatory action, whereas soft limits prompt review and escalation
Hard limits are non-negotiable thresholds whose breach demands immediate action, while soft limits serve as early warning triggers that initiate review processes.
An organization's stated risk appetite is 'low' for reputational risk. A proposed marketing campaign carries a moderate reputational risk. What should occur?
Answer: Conduct additional risk assessment and escalate for senior approval before proceeding
When a proposed activity exceeds stated risk appetite, additional analysis and escalation to appropriate authority is required before a final decision is made.
Which scenario represents a 'risk tolerance breach' rather than a 'risk appetite exceedance'?
Answer: Operational losses exceed the maximum threshold defined in policy
Tolerance breaches occur when actual risk outcomes exceed defined maximum limits in policy, whereas appetite exceedance reflects going beyond preferred or target levels.
Why should a risk appetite framework be reviewed and updated at least annually?
Answer: To reflect changes in strategy, environment, and lessons from risk events
Annual reviews ensure the risk appetite framework remains aligned with the organization's evolving strategy, market conditions, and insights from past risk events.