Board Risk Committee

A board risk committee is a committee of the board of directors that oversees an organisation's risk profile and its framework for managing risk. It advises the board on how much risk the organisation should be willing to take and checks that management operates within those limits. Risk committees are found mainly in banks, insurers and other large financial firms, where regulation often requires them.

The committee is separate from the board audit committee. The audit committee looks mainly backward, at the reliability of reported figures and controls; the risk committee looks forward, at exposures that could threaten the firm's capital, liquidity or reputation. In smaller companies and most non-financial groups, the two roles are combined in a single audit and risk committee.

Dedicated risk committees became standard after the financial crisis of 2007 to 2009. Reviews of bank failures found that boards had not understood the risks their firms were running and that risk oversight had been treated as a minor part of the audit committee's agenda. In the United Kingdom, the Walker Review of 2009 recommended that banks and other large financial firms establish a board risk committee separate from the audit committee.

Requirements followed in law. In the United States, the Dodd-Frank Act requires large publicly traded bank holding companies to have a risk committee that includes at least one member with experience of managing risk at large, complex firms. The European Union's Capital Requirements Directive requires significant institutions to establish a risk committee composed of non-executive members of the management body. The corporate governance principles of the Basel Committee on Banking Supervision set the same expectation for systemically important banks internationally.

Members are non-executive directors, and regulators generally expect the chair and a majority to be independent. The chair should not also chair the board or another committee. Members need knowledge of risk management and of the firm's main businesses, since the material is technical. The chief risk officer attends meetings and has direct access to the committee chair; other executives attend by invitation. Some overlap of membership with the audit committee is common, to make sure that issues do not fall between the two.

The committee's work centres on the firm's risk appetite. It reviews the risk appetite statement proposed by management and recommends it to the board, then monitors actual exposures against it. Its other typical duties are:

• Risk profile. It reviews regular reports on credit risk, market risk, liquidity risk, operational risk and conduct, including concentrations and emerging risks.
• Stress testing. It challenges the scenarios, assumptions and results of stress tests and their implications for capital and liquidity planning.
• Framework and policies. It approves or recommends key risk policies and limits and reviews the effectiveness of the risk management framework.
• Major decisions. It advises the board on the risk aspects of acquisitions, new products and strategic changes.
• The risk function. It safeguards the independence and resources of the risk function and is consulted on the appointment or removal of the chief risk officer.
• Remuneration. It advises the remuneration committee on whether incentive schemes reflect the risks taken.

In banks the committee also reviews the internal assessments of capital and liquidity adequacy and the recovery planning documents submitted to supervisors. Insurers have an equivalent in the own risk and solvency assessment (ORSA).

Under the three lines model, business units own and manage risk, the risk and compliance functions provide oversight and challenge, and internal audit gives independent assurance. The risk committee is the board-level body to which the second line reports. It depends on clear information: a concise set of indicators against limits, with breaches and exceptions escalated promptly.

In the United Kingdom, the chair of the risk committee holds a designated role under the Senior Managers Regime, making the individual personally accountable to regulators for the committee's effectiveness. Supervisors meet committee chairs regularly and review committee papers and minutes as evidence of the quality of board oversight.

The committee's remit usually extends to behaviour as well as numbers. It considers whether the firm's compliance culture supports sound risk taking and receives reports under the conduct risk framework.

A risk committee does not manage risk; it oversees those who do. Its effectiveness depends on the quality of management information and the readiness of members to challenge executives who know the business far better. Papers running to hundreds of pages can obscure the main issues, and committees may spend their time on regulatory process at the expense of discussion.

Failures since the crisis show the limits of structure alone. At Silicon Valley Bank, which failed in 2023, the post-mortem by the Federal Reserve noted weaknesses in board oversight of risk, and the bank had been without a chief risk officer for part of the preceding year. The division of work with the audit committee can also leave gaps, particularly for operational resilience, technology and financial crime, unless the two committees coordinate their agendas.

• Basel Committee on Banking Supervision