This lesson ties together the strategic perspective with the operational reality of managing risk, a core function of bank management.

8.1 The Strategic Importance of Risk Management
Risk management is not simply a compliance function; it is a strategic one. A bank’s risk appetite—the amount and type of risk it is willing to take—is a direct reflection of its strategy. The risk management framework must be aligned with the business strategy and cascaded down to operational limits.

8.2 Mandated Risk Management Tools
Post-2008 regulation has mandated the use of sophisticated risk management tools. These are key components of the Pillar 2 Supervisory Review Process.

• Risk Management Framework (RMF): The overall system for managing risk.

• Risk Appetite Statement (RAS): A formal articulation of the bank’s risk appetite.

• Internal Capital Adequacy Assessment Process (ICAAP): The bank’s own assessment of its capital needs, considering all material risks.

• Internal Liquidity Adequacy Assessment Process (ILAAP): The bank’s assessment of its liquidity needs.

• Stress Testing (ST): Modeling the bank’s financial resilience under severe but plausible adverse scenarios.

• Recovery and Resolution Plans (RRP): Plans for how the bank would recover from severe stress or be wound down in an orderly manner.

8.3 The System of Internal Controls
A robust system of internal controls is essential for executing strategy safely. This is a major challenge and opportunity for management. The controls are designed to provide reasonable assurance regarding the achievement of objectives in operations, reporting, and compliance. Key principles include segregation of duties, clear lines of authority, and independent oversight. The system is often organized around the “three lines of defense” model:

1. Operational Management: Owns and manages risk.

2. Risk and Compliance Functions: Oversee and support risk management.

3. Internal Audit: Provides independent assurance.