See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/303864622

A quantitative model to articulate the banking risk appetite framework

Article · February 2016

CITATIONS READS

3 4,482

3 authors:

Cinzia Baldan Geretto Enrico

University of Padova University of Udine
9 PUBLICATIONS 31 CITATIONS 33 PUBLICATIONS 42 CITATIONS

SEE PROFILE SEE PROFILE

Francesco Zen
University of Padova
7 PUBLICATIONS 25 CITATIONS

SEE PROFILE

Some of the authors of this publication are also working on these related projects:

Bad banks analysis View project

Banking Foundations: financial and efficiency analysis View project

All content following this page was uploaded by Cinzia Baldan on 12 July 2016.

The user has requested enhancement of the downloaded file.

 A quantitative model to articulate the
banking risk appetite framework
Received (in revised form): 12th February, 2016

Cinzia Baldan
is associate professor in financial intermediaries at the Department of Economic and Managerial Sciences ‘M. Fanno’ at
the University of Padova (Italy). She is also a member of CEFIN, a research centre on banking and finance at the University
of Modena and Reggio Emilia (Italy). Cinzia has been a visiting scholar at CASS Business School, and a visiting lecturer at
the same institution for the investment banking course. Her main research areas include banks, capital markets and risk
management.

Cinzia Baldan, Department of Economic and Managerial Sciences, ‘Marco Fanno’, University of Padova,
Via del Santo, 33-35123 Padova, Italy
E-mail: cinzia.baldan@unipd.it

Enrico Geretto
is associate professor in banking at the Department of Economic and Statistical Sciences at the University of Udine. He is also
a consultant for banks (especially small ones) and other financial institutions. Enrico’s main research areas include banks and
corporate finance.

E-mail: enrico.geretto@uniud.it

Francesco Zen
is associate professor in financial intermediaries at the Department of Economic Managerial Sciences ‘M. Fanno’ at the University of
Padova. He is also a chartered accountant and a consultant for banks and other financial institutions. Francesco’s main research areas
include banks, corporate finance and risk management.

E-mail: francesco.zen@unipd.it

Abstract The present work aims at implementing a quantitative model to articulate the banking
risk appetite framework (RAF). The research hopes to achieve two main objectives: (1) to build up
the risk appetite statement (RAS) as a static ‘picture’ of the banks’ risk profile; and (2) to develop
a quantitative approach with which to implement the RAF. First, the authors calculated eight
indicators describing the consumption of the banks’ capital by the three risks stated in Pillar I of
the Basel II accord. They then assumed that the variables would follow a standardised Student’s
t-distribution; they found the 99th and the 95th percentile of the distribution as the risk tolerance
(RT) and risk limit (RL) levels, respectively. The authors attained the second objective by analysing
the variables defined in the first step with a multiple linear regression (OLS). The main outcomes
confirm that the model allows for the generalising of the relation among risks, in terms of capital
consumption. The work contributes by enlarging the academic literature about banking risk
management; it also contributes by tackling the shortage of regulatory rules. Moreover it offers
external analysts and regulators a standardised technical instrument with which to analyse the
banks’ risk appetite profiles.

Keywords: banks, credit risk, market risk, operational risk, risk appetite framework, risk management

© Henry Stewart Publications 1752-8887 (2016) Vol. 9, 2 000–000 Journal of Risk Management in Financial Institutions 1

RMFI0035_BALDAN_9_2.indd 1 05/03/16 11:34 am

 Baldan, Geretto and Zen
1. INTRODUCTION
In 2013 the Financial Stability Board (FSB)
published three reports on the topic of risk
governance, the first of a general nature,1 the other
two on the founding principles of the so-called risk
appetite framework (RAF).2,3 The last of the three
documents should serve on the one hand as a tool
for an exchange of ideas and debate among financial
institutions (and particularly systemically important
financial institutions (SIFIs) and supervisors; on
the other hand, it should provide the former with
an easy-to-use tool to support their activities for
monitoring and controlling the various classes of
risk to which they are exposed. In this setting, the
FSB developed a type of guideline — in cooperation
with other standard setters — concerning the key
elements that a RAF should contain in order to be
effective.
Given the novel content of the above-mentioned
requirements and the considerable impact they
should have on how banks are managed, this paper
further develops a quantitative approach to structure
the RAF, suggesting a possible practical application
in the light of the detailed recommendations of the
supervisors. After some introductory comments
to examine the dictates of the currently applicable
regulations and identify some of the associated
problems (section 2), the authors propose an
approach that could be used to adapt to the
requirements of these regulations, which could be
valuable for management purposes, too (section 3).
This approach is then empirically applied to the
balance sheets of a number of Italian banking groups
(section 4). The last part of the paper (section 5)
adds a few considerations prompted by the results
obtained.
2. THE FINANCIAL STABILITY
BOARD’S RULES
The outbreak of the financial crisis has obliged
operators, researchers and regulators to see the
need for banks to formalise an organic reference
framework for their global risk management and
its timely monitoring and control, in order to avoid
their taking risks incompatible with their capacity to
absorb and manage them.4–9 The FSB has responded
to this need by drawing up a set of principles that
2 Journal of Risk Management in Financial Institutions Vol. 9, 2 000–000 © Henry Stewart Publications 1752-8887 (2016)
RMFI0035_BALDAN_9_2.indd 2
banks should follow in developing their RAF,
and national supervisors have been asked to urge
financial intermediaries to adopt the proposed
guidelines according to criteria of proportionality.
The FSB’s document was published in November
2013 and is basically organised in two parts, the first
containing key definitions and the second describing
the roles and responsibilities of businesses’ various
management functions. The first section thus defines
the following expressions3:
•• Risk appetite framework. The overall approach,
including policies, processes, controls and systems
through which risk appetite is established,
communicated and monitored. It includes a risk
appetite statement, risk limits and an outline of
the roles and responsibilities of those overseeing
the implementation and monitoring of the RAF.
The RAF should consider material risks to the
financial institution, as well as to the institution’s
reputation vis-à-vis policyholders, depositors,
investors and customers. The RAF aligns with
the institution’s strategy.
•• Risk appetite statement (from now on RAS). The
articulation in written form of the aggregate level
and types of risk that a financial institution is
willing to accept, or to avoid, in order to achieve
its business objectives. It includes a qualitative
statement as well as quantitative measures expressed
relative to earnings, capital, risk measures, liquidity
and other relevant measures, as appropriate. It
should also address more difficult to quantify risks
such as reputation and conduct risk, as well as
money laundering and unethical practices.
•• Risk capacity. The maximum level of risk the
financial institution can assume given its current
level of resources before breaching constraints
determined by regulatory capital and liquidity
needs, the operational environment (eg technical
infrastructure, risk management capabilities,
expertise) and obligations, also from a conduct
perspective, to depositors, policy holders,
shareholders and fixed income investors, as well as
other customers and stakeholders.
•• Risk appetite. The aggregate level and types of risk
a financial institution is willing to assume within
its risk capacity to achieve its strategic objectives
and business plan.
05/03/16 11:34 am
 A quantitative model to articulate the banking risk appetite framework
•• Risk limits. Quantitative measures based on
forward-looking assumptions that allocate the
financial institution’s aggregate risk appetite
statement (eg measure of loss or negative events)
to business lines, legal entities as relevant, specific
risk categories, concentrations and, as appropriate,
other levels.
•• Risk profile. Point in time assessment of the
financial institution’s gross and, as appropriate, net
risk exposures (after taking into account mitigants)
aggregated within and across each relevant risk
category based on forward-looking assumptions.
Although these definitions are in line with
the sector’s standards10,11 they prompt a few
considerations concerning their content. Generally
speaking, there is no clearly stated relationship
between the parameters that the RAF should
consider, as listed below, in the sense of a hierarchy
or their dependence on one another. The document
only mentions the comparison that should be
drawn on a continuous and iterative basis between
risk profile and risk appetite.3 The most important
issue, however, concerns the document’s failure to
explicitly define the concept of risk tolerance, a term
used in the footnotes as if it were synonymous with
risk appetite and risk limits. It is worth emphasising
that this notion has not been used systematically
(and therefore properly defined) by authorities or
researchers. The concept of risk tolerance has been
defined explicitly, however, in a lot of works.12–15
It is worth adding that risk tolerance was included
among the principles of risk management by the
Committee of European Banking Supervisors
(CEBS).16 Risk tolerance is nonetheless a necessary
and useful parameter in defining risk monitoring and
control methods and should therefore be included
in the RAF. Risk tolerance can be identified as the
difference existing between maximum assumable
risk and risk appetite (analytically: RT = RC − RA,
where RT identifies the risk tolerance; RC identifies
the risk capacity, and RA identifies the risk appetite),
so it could be expressed in terms of the maximum
allowable deviation from an organisation’s risk
appetite, according to the supervisory rules
established by the Bank of Italy.17
It has already been underscored that the RAS
represents a way of making known in written
© Henry Stewart Publications 1752-8887 (2016) Vol. 9, 2 000–000 Journal of Risk Management in Financial Institutions 3
RMFI0035_BALDAN_9_2.indd 3
form, to the whole business organisation and to all
stakeholders in general, what risks the intermediary
intends to assume or avoid under normal or
stressful market conditions, the corresponding
limits it has adopted and some quantitative and
qualitative measures of said risks.18,19 The content
of the RAS should be adapted appropriately as a
function of the class of operators to which it refers.
Separate documents need to be drafted, depending on
whether the RAS is intended for the business
organisation process, called ‘cascading down’,14,18,20
or for its various categories of stakeholders (clients,
depositors, etc), because they need different types
and amounts of information and they have different
levels of technical expertise.
The proposed definition of ‘risk capacity’ does
contain a sort of hierarchy, requiring compliance
first with regulatory constraints, then with limits
relating to the operational environment, and
finally with obligations to depositors, regulators,
shareholders, bondholders and so on.21
While the first condition is an easily identifiable
‘area’ and various statistical measures can be used
to quantify it in relation to subsequent ‘boundaries’
within which to contain an organisation’s risk
capacity, there are some doubts as to their
measurability and suitability for representing a
consistent parameter to take into account when
establishing the maximum level of risk assumable.
As for the most appropriate risk appetite, this must
be stated for single types of risk as well as in overall
terms. There are no specifications regarding how
to measure the correlations between the risks, ie
methods for their calibration or recomposition in
relation to the continuous variations that might
occur in their volume, which could temporarily
implicate violations of certain limits; this aspect
was emphasised by the Institute of International
Finance22 in their comments on the FSB’s document.
Partly in light of these considerations, the authors
feel that this parameter should be expressed in terms
of a range of values rather than a single figure.
The guidelines establish that risk appetite be
articulated by adopting operational limits (risk limits)
for each type of risk and business unit and for different
legal entities, counterparty client categories, product
lines, or other types of cluster of relevance for a given
intermediary. There is no mention of the adoption
05/03/16 11:34 am
 Baldan, Geretto and Zen
of any so-called ‘early warning system’, ie indicators
to use when nearing any risk limits to enable the
timely planning and proper implementation of the
most suitable management initiatives to return to the
desired risk-taking levels.23,24
Finally, there is the concept of risk profile, or the
intermediary’s exposure to risk, which is measured
in instantaneous terms, using gross and net figures
as appropriate. When it comes to recording this
parameter, it is emphasised that currently used
information technology (IT) systems are sometimes
still partially inadequate for the purpose of promptly
and accurately quantifying an organisation’s risk
profile, especially at banking group level, for different
business lines and for different legal entities.25
The second part of the principles developed by
the FSB concerns the roles and responsibilities for
ensuring the adoption of the RAF, not only by top
management, but also by managers of the various
business lines and different legal entities. It also
establishes what the internal audit function has to
do. Generally speaking, the board of directors is
responsible for approving the RAF — developed in
cooperation with the chief executive officer (CEO),
chief risk officer (CRO) and chief financial officer
(CFO). Consistency must be assured between its
content and the predictions of the short-term and
medium- to long-term business strategy, the business
and capital plans, the organisation’s risk capacity
and the compensation programmes. The chief
officers are primarily responsible for transposing the
content of the RAF to the company structures; for
instance, they jointly approve the risk limits for the
business lines, they ensure that the business lines
have appropriate processes in place for continually
monitoring the corresponding risk profile, they
establish processes for facilitating the metabolisation
of the concepts of risk appetite and risk profile
in the organisation’s risk culture, and so on. It is
essential for the managers of the business lines and
legal entities to incorporate the content of the RAS
and the risk limits in their daily risk management
activities. To do so, they need to cooperate with
the CRO and with the risk management function.
Finally, the main duties of the internal audit function
are established, which include a number of controls
of various kinds, eg identifying whether violations
of the risk limits have been effectively identified,
4 Journal of Risk Management in Financial Institutions Vol. 9, 2 000–000 © Henry Stewart Publications 1752-8887 (2016)
RMFI0035_BALDAN_9_2.indd 4
authorised and reported to the specified levels of
competence, and reporting to the top management
on any weaknesses in the RAF, and so on.
3. IMPLEMENTATION OF THE RAF
The effects of introducing a quantitative
methodology for defining and articulating an RAF
that complies with the regulations depend largely
on whether a given financial institution has some
requirements, ie a reference infrastructure, that
can favour the onset and positive deployment of
the effects deriving from the adoption of this new
regulatory approach. The framework should be
founded on the following elements:
•• the presence of an adequate risk culture;
•• the existence of a significant interdependence
between a business’s risk management and
other processes (strategic planning, internal
capital adequacy assessment process (ICAAP),
organisation, control systems, etc);
•• the use of effective methods for internal
communication and cooperation;
•• the use of sufficiently advanced IT systems.
Concerning the first element, it seems important to
underline that the term risk culture generally refers to the
behaviour of people operating within the organisation
in light of how they identify, understand and manage
current and prospective risks.26 A consolidated risk-
oriented culture should facilitate a rapid and effective
implementation of the RAF, as the RAF is mostly
about harmonising risk-related terminology and key
figures, within and across intermediaries. This is shared
among the most relevant intermediaries, but is probably
less acknowledged when they are not very large. As a
consequence, numerous researchers and institutional
bodies have been emphasising the importance of
promoting, developing and circulating a risk culture to
all levels for some time now.16,27
In particular, the FSB document assigns the task
of integrating the new parameters in the business’s
risk culture to the CEO and the CRO.
From the practical standpoint, the successful
integration of the content of the RAF in the bank’s
day-to-day management mainly depends on whether
there are already well-established interrelations
05/03/16 11:34 am
 A quantitative model to articulate the banking risk appetite framework

between governance and risk management activities,
ie between the risk management function and other
company processes such as strategic operational
planning, ICAAP implementation, the organisation
of single business lines, and so on. What the authors
wish to emphasise here is that any barriers (be
they functions, divisions or of any other nature) to
an enterprise’s risk management activities, or the
latter’s limited inf luence on its overall governance,
may represent significant obstacles to the practical
usage of the output deriving from the adoption of
the RAF; in this sense, the term enterprise-wide risk
management was coined specifically to emphasise the
importance of integrating risk management with the
other business activities.28,29
After outlining the framework of an organisation’s
risk objectives, it is important for the frameworks
to be reviewed periodically to adapt them to any
changes to organisations’ strategy and/or market
variations. This activity must presumably be
conducted with a shared effort of collaboration
and communication involving the board of
directors, the general management or so-called
C-Suite (the CEO, the CFO and the CRO) and
their respective functions, the managers of the
different business lines, and the whole operational
structure. These parties need to develop an iterative
process of communication, feedback collection and
reporting, and a shared commitment to preventing
any excessive risk taking, and to rapidly and
effectively managing contingencies, improving their
ability to identify, analyse and solve operational
problems relating to risk monitoring and control.
A consolidated aptitude for developing synergies
between the various company organs and functions
would contribute to the proper definition and
gradual fine-tuning of the content of the RAF.30–32
The feasibility of precisely identifying the risks
assumed by an organisation, with a level of detail
sufficient to ensure their effective monitoring,
demands an IT infrastructure — or management
information system (MIS) — adequately focused in
order to capture these profiles (intrinsic in the
various activities undertaken), not only to satisfy the
regulators, but also for the management’s purposes.
The major international banks’ experiences in this
area still seem to be partial and rather limited.11 The
choices that management must make in this setting
are likely to represent a far from negligible challenge,
in terms of both economic outlay and regulatory
commitment,25 the outcome of which will be
fundamentally important to their effective use of the
principles of risk appetite schematics and frameworks.
The different constructs for which the authors
were able to schematically illustrate the more
specifically quantitative section of the RAF — ie the
RAS — with reference to a particular type of risk,
are shown in Figure 1.

Figure 1: RAS implementation scheme

Source: Authors’ adaptation from ECRS-EMEA (2013) ‘Risk appetite framework. How to spot the genuine article’, July, Deloitte, New
York, available at: https://www2.deloitte.com/content/dam/Deloitte/au/Documents/risk/deloitte-au-risk-appetite-frameworks-financial-
services-0614.pdf, p. 8.

© Henry Stewart Publications 1752-8887 (2016) Vol. 9, 2 000–000 Journal of Risk Management in Financial Institutions 5

RMFI0035_BALDAN_9_2.indd 5 05/03/16 11:34 am

 Baldan, Geretto and Zen
Figure 1 contains the definitions proposed by
the FSB, integrated with appropriate additional
parameters. Both tolerance thresholds and the early
warning values are used and paired upper and lower
values are provided in both cases, in the same way
as for the risk limits. This is necessary because the
intermediary must monitor instances not only of
excessive risk taking (upper level), but also — given
its established risk-return objectives — of violations
of the opposite thresholds (lower limits) which
could prevent it from achieving its expected income
results. The ideal position of the risk profile would
come in between the two early warning thresholds;
for these thresholds to be useful, the range of the risk
appetite (defined by upper and lower limits) must be
sufficiently broad. It is advisable to distinguish here
between the actual risk profile and the target risk
profile. In particular, the concept of risk profile in
this second sense can be made to coincide with the
desired level of risk appetite, while the actual risk
profile may not necessarily coincide with the bank’s
real propensity to take risks. The former may come
anywhere within the band defining the risk capacity
(or even outside it in extreme cases); the latter, to
be consistent with strategic needs, should come
somewhere within the established risk appetite band.
Whenever the actual risk profile nears or exceeds the
limits or tolerance thresholds, various kinds of action
must be taken to adjust it.
The layout shown in the diagram in Figure 1
relies on quantities that should be processed
consistently with the metrics used in the ICAAP.
This means that, in defining risk capacity in
relation to a given type of risk, one can use the
concept of ‘capital’, a portion of which (ie its
intermediate levels) can be used to express the
RT and RL. To measure risk appetite, one should
consider the objective ‘internal capital’ (in absolute
terms or as a percentage of the capital available),
while the risk profile could be expressed by the
internal capital actually allocated. The meanings
of the definitions between inverted commas are
drawn from the provisions of the regulations for
preparing the ICAAP. With a few adjustments,
the proposed reconciliation can be found in ABI–
Bain & Company.23 In some risk categories (eg
liquidity), reference to capital or ‘overall capital’
becomes insignificant in the definition of the
6 Journal of Risk Management in Financial Institutions Vol. 9, 2 000–000 © Henry Stewart Publications 1752-8887 (2016)
RMFI0035_BALDAN_9_2.indd 6
related risk capacity, and consequently of the
tolerance threshold and risk limits; this is confirmed
by further problems subsequently encountered
when aggregating between risks expressed using
different methods. This leaves us with the problem
of which mechanism to use in deciding reference
values for the measurements indicated in the figure
and especially for the tolerance threshold and risk
limit (and for both aggregates the authors need to
set upper and lower levels). For the first indicator,
assuming that it can be reconstructed in terms of
a maximum allowable ‘deviation’ from the risk
objectives, in its definition one can consider the
said statistical measure in combination with a
dispersion index such as the coefficient of variation,
the variance and the standard deviation. Given their
relative characteristics, the authors opted for the last
of these; an alternative solution might be subjectively
to define a maximum percentage deviation from
the risk appetite limit established in the light of the
board’s expectations. Choosing a dual tolerance
threshold entails using measures of variability
capable of providing indications of the downside
risk, and upside potential type.
Based on the mean value of the risk in question
and its volatility, the authors identified upper and
lower tolerance levels by adding/subtracting the
desired multiple of the latter to/from the former. In
order to set out the range of variation for the risk
appetite, ie to establish its operational limits (for the
two early warning levels, one might hypothetically
consider an arbitrary definition, related to subjective
assessments), the two previously defined tolerance
thresholds were correlated with the aggregate figure
expressing the given actual risk profile in question
(which was also distributed between an upper and a
lower value).
The RAF subsequently developed from the RAS
(prepared using the proposed parameters) would not
only be an effective tool for risk control purposes,
but with a few simple manipulations it could also
become a useful working reference for the company’s
global risk governance. This is confirmed by the fact
that one interesting approach involves assessing the
positioning of certain key performance indicators
(KPIs) aligned with the objectives expressed by
the stakeholders in relation to the risk appetite and
tolerance thresholds.33,34
05/03/16 11:34 am
 A quantitative model to articulate the banking risk appetite framework
It is also worth noting that there are no prior
researches using regression models on risk appetite, so
the present work could represent a novel approach.
4. IMPLEMENTATION OF A
QUANTITATIVE MODEL FOR THE RAF
4.1. Methodology
The regulations establish that the RAF should
indicate all the types of risk the bank intends to
assume, identified from among those of Pillar I and
Pillar II and use them for the purposes of preparing
the ICAAP.35 The RAF also demands the drafting
of an RAS3: among other things, this document
provides a summary of the quantitative measures
of the risk that a financial institution is willing to
accept, or that it intends to limit, for the purposes of
achieving its business objectives.
In this setting, the present work proposes a two-
step analysis:
(1) First, the authors developed a quantitative model
for drafting an RAS (see also Figure 1) that was
applied to the financial statements of 29 Italian
banking groups for the period 2008–2014 (n = 7).
(2) In the second stage, the resulting RAS outcomes
are used to obtain a rough outline of a RAF
suitable for use by an internal analyst, but also
(and more importantly), by an external analyst
interested in knowing the position of financial
institutions in terms of their propensity to accept
or avoid the main types of risk to which they are
exposed.
The research thus proposes to overcome some
already identified shortcomings, which are:
normative (failure to provide instructions in Pillar III
of Basel II for the information deriving from
the ICAAP to be communicated to the market);
methodological (the lack of a quantitative model
for reference in constructing an RAF); and
academic (researchers’ lack of attention to the
topic of banks’ RAF).
The approach used to draft the RAS considers
three risks regulated as part of Pillar I of Basel II:
the counterparty and credit risk, the operational
risk and the market risk. For these three types of
risk, the authors considered the specific minimum
© Henry Stewart Publications 1752-8887 (2016) Vol. 9, 2 000–000 Journal of Risk Management in Financial Institutions 7
RMFI0035_BALDAN_9_2.indd 7
capital requirements (MCR) that each bank must
meet according to the dictates of Pillar I and they
examined how they correlate with their Tier 1 and
regulatory capital (RC). For each bank, they also
considered the minimum total capital requirements
(TCR), calculated as the sum of the capital
requirements for each type of risk considered. The
TCR were likewise placed in relation to Tier 1 and
regulatory capital, identifying the overall ‘weight’
of the risks vis-à-vis the bank’s capital. The authors
thus aimed to underscore the inf luence of the MCR
on the regulatory capital by specifying tolerance
thresholds within which the credit institutions
examined should keep these weights. Risk appetite
statements drafted in this way would serve the
purpose of identifying the banks’ current situation in
relation to the ‘consumption’ of their capital by the
three types of risk considered.
For each bank (i) and for each year, the authors
calculated eight indicators as ratios describing
the consumption of the banks’ capital by the
three risks stated in Pillar I of the Basel II accord
(credit and counterparty, operational, market),
with respect to Tier1 (‘core capital’) and the total
regulatory capital (RC):
•• total capital requirements/core capital
(TCR i/Tier1i );
•• total capital requirements/regulatory capital
(TCRi/RCi );
•• minimum capital requirements for counterparty
and credit risk/core capital (CCi,/Tier1i );
•• minimum capital requirements for counterparty
and credit risk/regulatory capital (CCi,/RCi );
•• minimum capital requirements for operational
risk/core capital (Opi/Tier1i );
•• minimum capital requirements for operational
risk/regulatory capital (Opi,/RCi );
•• minimum capital requirements for market risk/
core capital (Mkti/Tier1i );
•• minimum capital requirements for market risk/
regulatory capital (Mkti/RCi ).
The authors assumed the indicators previously
calculated as variables to analyse. They then
standardised the variables in order to eliminate
the outliers (eg in case of consolidation processes
among banks they observed exceptional levels of
05/03/16 11:34 am
 Baldan, Geretto and Zen
capital requirements with respect to the year of
consolidation); in particular, they identified the 2008
values for one of the elements of the dataset (‘IBL
bank’) as not comparable with the remainder; hence,
they excluded them from the analysis.
The authors then assumed that the variables
followed a standardised Student’s t-distribution.
In fact, even if neither credit nor operational
risk loss distributions were symmetric, they
considered variables made of ratios between the
amount of capital required to buffer potential
losses and the regulatory capital available (‘core’
and total). It seemed reasonable to retain that
from an ‘ongoing concern’ perspective such ratios
are distributed, across many years, following a
‘pseudo-normal’ distribution. In this sense, the
Student’s t-distribution seemed to be useful to take
into account the different volatility of each banks’
ratio; moreover there was no current evidence
of a different distribution of that specific kind of
variable, developed ad hoc for the analysis. In detail,
they used a standardised Student’s t-distribution, by
imposing the same degrees of freedom (n − 1), while
the mean and standard deviation were the specific
values calculated for each banking group, and so
the distribution captured the fat tails (eg in the case
of extreme events the authors would expect the
percentage of capital consumption to increase as the
bank approaches to default). They then determined
the lower bound and the upper bound of the
confidence interval for mean, fixed at 99 per cent
for the risk tolerance (RT), and at 95 per cent for the
risk limit (RL). The upper bounds correspond to the
upper ‘risk levels’; the lower bounds correspond to
the lower risk levels.
The early warning levels (EW) are calculated in
equations (1–2):
EWui, j = RLui,j − 0.2(RLui,j − RLli,j)
EWli, j = RLli,j + 0.2(RLui,j − RLli,j)
where
EWu i, j; (EWli, j ) = Early Warning upper level (lower
level) of the i-th bank with respect to the j-th risk,
with i = 1 − 29 and j = 1 – 3;
RLui,j; (RLli,j) = Risk Limit upper level (lower level)
of the i-th bank with respect to the j-th risk, with
i = 1 – 29 and j = 1 – 3.
8 Journal of Risk Management in Financial Institutions Vol. 9, 2 000–000 © Henry Stewart Publications 1752-8887 (2016)
RMFI0035_BALDAN_9_2.indd 8
The objective of the second step of the analysis
was to identify a relation between the different
types of risk of Pillar I (credit, operational, market),
in order to obtain an ‘aggregate’ analysis of the
risk appetite of each bank. The RAS represents
a temporal analysis with which the authors
considered the changes of capital consumption
across time; these changes are summarised with a
sort of risk ‘picture’ with which to compare the
annual or periodical results, for each risk and each
bank, separately.
From the RAF the authors changed the
perspective, by investigating the existence of a
relation among the upper levels of risk tolerance,
and among the upper levels of risk limits, with
respect both to total regulatory capital, and to
Tier1. The relation, if verified, could be usefully
implemented to verify, for example, what happens
to a certain type of risk when the bank modifies
another one; it would also reveal how to change a
certain risk exposure without changing the total
risk consumption. Since different types of risk
are calculated by using different approaches, the
authors used the previously determined capital
consumption ratios as homogeneous variables not
affected by the different quantitative approaches
used to estimate the risk exposures. They then
developed four equations by using a cross-
sectional multiple linear regression (OLS), where
the variables (dependent and independent) are the
results of the distribution across seven years of
observations, as determined above.36 The regression
is made ‘on levels’, rather than on changes, because
the variables taken into account are expected to
be stationary; a larger time period of observations
could be useful to verify the assumption, or to
‘stationarise’ the variables through the use of
mathematical transformations.
(1)
(2) Equation (3)
Y ToleranceRCi = β0 + βRTCC X RTiCC + βRTOp X RTiOp
+ βRTMkt X RTiMkt + εi
i = 1, ..., 29
where
TCRi
Y ToleranceRCi = Risk Tolerance upper level of
RCi
05/03/16 11:34 am
 A quantitative model to articulate the banking risk appetite framework

MCRCCi where
X RTiCC = Risk Tolerance upper level of TCRi
RCi YLimitTier1i = Risk Limit upper level of
Tier1i
MCROpi
X RTiOp = Risk Tolerance upper level of MCRCCi
RCi X ′RLiCC = Risk Limit upper level of
Tier1i
MCR Mkti
X RTiMkt = Risk Tolerance upper level of MCROpi
RCi X ′RLiOp = Risk Limit upper level of
Tier1i
Equation (4) MCR Mkti
Y ToleranceTier 1i = β ′0 + β ′RTCC X′RTiCC + β ′RTOp X ′RTiOp X ′RLiMkt = Risk Limit upper level of
Tier1i
+ β ′RTMkt X′RTiMkt + εi
i = 1, ..., 29
4.2. Dataset
where The model for drafting an ICAAP-compliant
TCRi RAS was applied to 29 Italian commercial
Y ToleranceTier 1i = Risk Tolerance upper level of
Tier1i banking groups, comprising the first five groups
MCRCCi and all the so-called large institutions, according
X ′RTiCC = Risk Tolerance upper level of to the Bank of Italy’s classification. 37 This sample
Tier1i has a market share of 68.95 per cent (calculated
MCROpi on the basis of loans to customers). The authors
X ′RTiOp = Risk Tolerance upper level of disregarded credit institutions involved in
Tier1i
activities other than those of the commercial
MCR Mkti banks (eg corporate banking, investment banking,
X ′RTiMkt = Risk Tolerance upper level of
Tier1i etc) and groups that were in receivership at the
time of our analysis.
Equation (5) They considered the consolidated financial
statements as at 31st December for the years 2008–
YLimitRCi = β0 + βRLCC X RLiCC + βRLOp X RLiOp
2014 (n = 7). They developed 29 RAS prospects
+ βRLMkt X RLiMkt + εi with which to compare the year-end results of
i = 1, ..., 29 each bank and the related risk appetite levels;
the research then presents the outcomes of the
where regression analysis.
TCRi
YLimitRCi = Risk Limit upper level of
RCi
4.3. Main findings
MCRCCi
X RLiCC = Risk Limit upper level of The work now discusses the main evidences
RCi emerging from the analysis of the most significant
MCROpi groups. The RAS for each group are attached in
X RLiOp = Risk Limit upper level of Appendix 1 (Table A.1).
RCi
MCR Mkti
X RLiMkt = Risk Limit upper level of First step: RAS development
RCi Table 1 shows the RAS for the ‘Monte dei Paschi
Equation (6) di Siena’ Group (MPS) drafted from an ICAAP-
compliant standpoint on the basis of the previously
YLimitTier1i = β ′0 + β ′RLCC X′RLiCC + β ′RLOp X ′RLiOp listed indicators.
+ β ′RLMkt X′RLiMkt + εi The MPS is distinctive in that, as at
i = 1, ..., 29 31 December 2014, it exceeded the upper

© Henry Stewart Publications 1752-8887 (2016) Vol. 9, 2 000–000 Journal of Risk Management in Financial Institutions 9

RMFI0035_BALDAN_9_2.indd 9 05/03/16 11:34 am

 Baldan, Geretto and Zen

Table 1: RAS for the ‘Monte dei Paschi di Siena’ (MPS) Group (% values)
TCR/Tier1 TCR/RC CC/Tier1 CC/RC Op/Tier1 Op/RC Mkt/Tier1 Mkt/RC
RiskTolerance Up 133.97 77.61 129.96 75.47 10.70 6.61 6.81 4.20
RiskLimit Up 121.79 72.65 115.56 68.81 9.90 6.21 6.42 4.02
EW Up 112.33 68.80 104.38 63.63 9.28 5.89 6.12 3.88
EW Low 83.96 57.23 70.84 48.12 7.42 4.94 5.22 3.48
RiskLimit Low 74.51 53.38 59.65 42.95 6.80 4.62 4.91 3.34
RiskTolerance Low 62.33 48.42 45.26 36.29 6.00 4.21 4.52 3.16
Values as at 31.12.14 92.28 61.59 77.19 51.52 10.72 7.15 4.38 2.92
Notes: RiskTolerance Up = upper bound of 99% confidence interval for mean = mean + (t critical value*std error of the mean). RiskLimit
Up = upper bound of 95% confidence interval for mean = mean + (t critical value*std error of the mean). EW Up = RiskLimit Up −
0.2(RiskLimit Up − RiskLimit Low). EW Low = RiskLimit Low + 0.2(RiskLimit Up − RiskLimit Low). RiskLimit Low = lower bound of 95%
confidence interval for mean = mean − (t critical value*std error of the mean). RiskTolerance Low = lower bound of 99% confidence
interval for mean = mean − (t critical value*std error of the mean).
Source: authors’ elaboration.

Table 2: RAS for the ‘Intesa SanPaolo’ (ISP) Group (% values)

TCR/Tier1 TCR/RC CC/Tier1 CC/RC Op/Tier1 Op/RC Mkt/Tier1 Mkt/RC
RiskTolerance Up 83.17 62.91 72.81 54.88 6.65 5.12 4.22 3.54
RiskLimit Up 78.98 60.52 68.90 52.65 6.32 4.91 4.09 3.37
EW Up 75.73 58.67 65.86 50.92 6.07 4.74 3.99 3.24
EW Low 65.97 53.11 56.74 45.73 5.31 4.25 3.68 2.85
RiskLimit Low 62.72 51.26 53.70 44.00 5.06 4.08 3.58 2.72
RiskTolerance Low 58.53 48.87 49.79 41.78 4.74 3.87 3.45 2.55
Values as at 31.12.14 59.06 46.63 50.65 39.99 4.63 3.66 3.61 2.85
Notes: RiskTolerance Up = upper bound of 99% confidence interval for mean = mean + (t critical value*std error of the mean). RiskLimit
Up = upper bound of 95% confidence interval for mean = mean + (t critical value*std error of the mean). EW Up = RiskLimit Up −
0.2(RiskLimit Up − RiskLimit Low). EW Low = RiskLimit Low + 0.2(RiskLimit Up − RiskLimit Low). RiskLimit Low = lower bound of 95%
confidence interval for mean = mean − (t critical value*std error of the mean). RiskTolerance Low = lower bound of 99% confidence
interval for mean = mean − (t critical value*std error of the mean).
Source: authors’ elaboration.

tolerance threshold for two of the eight indicators
concerning operational risk. In fact, the Op/Tier1
and Op/RC ratios show levels of 10.72 per cent
and 7.15 per cent, respectively, while the upper
tolerance levels are at 10.70 per cent and 6.61 per
cent, respectively.
Table 2 shows the results obtained in the RAS
developed for the ‘Intesa SanPaolo’ Group (ISP).
Here one can see a situation that is, in a sense, the
exact opposite of the previous case of the MPS
Group. The ISP has values for its indicators as at
31st December 2014 falling below its established
lower risk tolerance threshold. In particular, the
TCR/Tier1 ratio stands at 59.06 per cent, while
the lower tolerance threshold is 58.53 per cent;
the TCR/RC ratio stands at 46.63 per cent, while
the lower tolerance threshold is 48.87 per cent.
For operational risk the group’s position is also
under the lower threshold, both with respect to
Tier1 and to RC. For credit risk, in particular, the
institution should consider undertaking schemes in
the medium to long term to raise this specific risk
profile. The risk containment measures that MPS
Group should take are needed to restore its capital
solidity; in the case of ISP Group, while it is not
urgent to take action in the short term, it would
nonetheless be advisable to review their policy
for distributing loans, given that an excessive risk
containment could negatively affect the institution’s
global profitability, gradually eroding its ability to
remain competitive, and even the margins needed
to operate in situations of stress.

10 Journal of Risk Management in Financial Institutions Vol. 9, 2 000–000 © Henry Stewart Publications 1752-8887 (2016)

RMFI0035_BALDAN_9_2.indd 10 05/03/16 11:34 am

 A quantitative model to articulate the banking risk appetite framework

Second step: RAF development Dependent 0.711082 Dependent 0.117291

Equation (7) var. mean var. SQM
SSR 0.011430 SER 0.021382
Dependent Variable:
TCRi R2 0.970327 Adjusted R2 0.966766
Y ToleranceRCi = Risk Tolerance upper level of
RCi
Variables Coeff. Std. error t-ratio p-value Equation (10)
Const 0.0486365 0.0206635 2.3537 0.0268** Dependent Variable:
CC 0.937785 0.0462536 20.2748 <0.0001*** TCRi
YLimitTier1i = Risk Limit upper level of
Op 0.717661 0.367931 1.9505 0.0624* Tier1i
Mkt 0.737784 0.210727 3.5011 0.0018***
Variables Coeff. Std. error t-ratio p-value
Note: Significance levels (bilateral test): ***0.01; **0.05; *0.10.
Const 0.0269389 0.0185567 1.4517 0.1590
Dependent 0.740932 Dependent 0.126306 CC 0.946736 0.0459066 20.6231 <0.0001***
var. mean var. SQM Op 1.09649 0.385046 2.8477 0.0087***
SSR 0.019311 SER 0.027793 Mkt 0.799265 0.255335 3.1303 0.0044***
R2 0.956768 Adjusted R2 0.951580 Significance levels (bilateral test): ***0.01; **0.05; *0.10.

Dependent 0.944527 Dependent 0.246314

Equation (8) var. mean var. SQM
SSR 0.018680 SER 0.027335
Dependent Variable:
TCRi R2 0.989004 Adjusted R 2 0.987684

Y ToleranceTier 1i = Risk Tolerance upper level of

Tier1i
The results of the four equations are robust and
Variables Coeff. Std. error t-ratio p-value significant (also tested for heteroscedasticity and
Const 0.0353168 0.0238458 1.4810 0.1511 collinearity). In particular, they reveal that the
CC 0.939042 0.0549317 17.0947 <0.0001*** total capital consumption is mainly explained by
Op 1.03004 0.450483 2.2865 0.0310** the consumption due to ‘credit and counterparty
Mkt 0.810565 0.247749 3.2717 0.0031*** risk’ (according to expectations); noticeable is
Significance levels (bilateral test): ***0.01; **0.05; *0.10. the relevance of operational risk as the ‘capital-
consuming’ variable. This last result could be
Dependent 0.996552 Dependent 0.271552 partially due to the way the capital charges for
var. mean var. SQM operational risk are computed. In particular, most
SSR 0.030067 SER 0.034680 of the banks of the sample apply the basic indicator
R2 0.985438 Adjusted R2 0.983690 approach (BIA), or the standardised approach,
where the ‘gross income’ is the proxy for the scale
of business operations and thus the likely scale of
Equation (9) operational risk exposure within each of the business
Dependent Variable: lines.5,7 This could affect the banks’ efforts to reduce
TCRi risk by managing the business lines, and expose them
YLimitRCi = Risk Limit upper level of
RCi to a considerable capital consumption attributable to
operational risk.
Variables Coeff. Std. error t-ratio p-value The model allows for the generalising of
Const 0.0374536 0.0162524 2.3045 0.0298** the relation among risks (in terms of capital
CC 0.945583 0.0381385 24.7934 <0.0001*** consumption), so that it could be possible, among
Op 0.845367 0.332394 2.5433 0.0175** others aspects, to infer how to change a specific
Mkt 0.746204 0.208597 3.5773 0.0015*** capital-consuming variable without changing
Significance levels (bilateral test): ***0.01; **0.05; *0.10. the total consumption. The inferences should be

© Henry Stewart Publications 1752-8887 (2016) Vol. 9, 2 000–000 Journal of Risk Management in Financial Institutions 11

RMFI0035_BALDAN_9_2.indd 11 05/03/16 11:34 am

 Baldan, Geretto and Zen
calibrated with the feasibility of the model with the
banks’ strategic decisions (eg could the operational
risk consumption of capital be realistically and
rapidly changed? Since the results come from an
analysis across banks, is it worth taking into account
competitors’ risk appetite attitudes or are the RAS
prospects adequate for determining the overall risk
appetite profile?). Nonetheless, the comparative
analysis provided indications about the relation among
risks and the corresponding capital consumption for
a homogeneous category of banks, which could be of
particular use for external analysts.
5. CONCLUDING REMARKS
The present work discusses the RAF in terms of a
possible practical application of the framework in
light of the national and international regulatory
recommendations. For this purpose, the work
proposed a quantitative model for drafting an
RAS using the financial statements of 29 Italian
commercial banking groups for the years 2008–
2014. The resulting RAS were then analysed with a
view to developing a RAF that could be especially
useful for regulatory and banking supervisors, and
for external analysts interested in knowing a credit
institution’s position in terms of its propensity/
aversion to the main types of risk to which such
organisations are exposed.
Our analysis of the single RASs revealed very
different pictures and some extreme situations. For
instance, one group was found to be exposed to an
excessively high total risk for its overall risk profile,
which even exceeded its upper tolerance threshold
(the maximum allowable deviation from its risk
appetite), and consequently pointed to the urgent
need for measures designed to reduce the weight
of the risks vis-à-vis its capital, coherently with the
results and comments of the European Banking
Authority (EBA) about the last stress test results.38
On the other hand, one of the reports identified
a group with indicators coming well below the
lower tolerance threshold established for the risks it
could assume, making it advisable to adopt schemes
designed to raise this banking group’s risk profile.
The results of the second step of the analysis
highlighted that the total capital consumption is
mainly explained by the consumption due to ‘credit
12 Journal of Risk Management in Financial Institutions Vol. 9, 2 000–000 © Henry Stewart Publications 1752-8887 (2016)
RMFI0035_BALDAN_9_2.indd 12
and counterparty risk’ (according to expectations);
the relevance of operational risk as capital-
consuming variable was also notable.
The proposed quantitative model for first drafting
an RAS and then obtaining a global RAF could
be applied effectively to different types of risk,
making the necessary adjustments according to the
particular features of the profile being examined.39
This particular aspect is worth bearing in mind for
the purpose of expressing a business’s risk appetite
in aggregate and unequivocal terms: having no
common parameter with which to compare all
the categories of risk typically encountered in
banking activities makes it impossible to have a
single indicator that can globally represent the risk
propensity of a given intermediary. The authors
surmised that the RAF needs to be separated into
various (quantitative and/or qualitative) sections that
identify, for each of the different classes of risk, the
corresponding total absorption capacity, tolerance
thresholds and operational limits, and the measures
and procedures for restoring the risk levels to within
the established ranges. The framework’s setup
and activation relies on certain premises that are
not always readily identifiable in the Italian credit
industry.
The present contribution could consequently
serve as a useful methodological reference for
quantifying and solving the numerous problems that
will occur in the course of action to comply with
the recently introduced requirements, as well as
an attempt to overcome normative and theoretical
shortcomings identified on the particularly urgent
and topical issue of risk management in banks.
Acknowledgments
The authors would like to thank Massimiliano Caporin
for helpful discussions and an anonymous referee for
precious comments. The usual disclaimer applies.
References and notes
1 FSB (2013) ‘Thematic review on risk governance’,
Peer Review report, 12th February, Financial
Stability Board, Basel, available at: http://
www.fsb.org/wp-content/uploads/r_130212.pdf
(accessed 5th February, 2016).
05/03/16 11:34 am
 A quantitative model to articulate the banking risk appetite framework
2 FSB (2011) ‘Intensity and effectiveness of SIFI
supervision. Progress report on implementing
the recommendations on enhanced supervision’,
27th October, Financial Stability Board, Basel,
available at: http://www.fsb.org/wp-content/
uploads/r_101101.pdf?page_moved=1 (accessed
5th February, 2016).
3 FSB (2013) ‘Principles for an effective risk
appetite framework’, 18th November, Financial
Stability Board, Basel, available at: http://
www.fsb.org/wp-content/uploads/r_131118.pdf
(accessed 5th February, 2016).
4 Counterparty Risk Management Policy
Group (2008) ‘Containing systemic risk: the
road to reform’, The Report of the CRMPG III,
6th August, available at: http://www.
crmpolicygroup.org/docs/CRMPG-III.pdf
(accessed 5th February, 2016).
5 BCBS (2009) ‘Proposed enhancements to
the Basel II framework’, January, Bank for
International Settlements, Basel Committee on
Banking Supervision, Basel, available at:
http://www.bis.org/publ/bcbs157.pdf
(accessed 5th February, 2016).
6 Senior Supervisors Group (2010) ‘Observations
on developments in Risk Appetite Framework
and IT infrastructure’, 23rd December,
available at: https://www.newyorkfed.org/
medialibrary/media/newsevents/news/
banking/2010/an101223.pdf (accessed
5th February, 2016).
7 BCBS (2011) ‘Principles for the sound
management of operational risk’, June, Bank for
International Settlements, Basel Committee on
Banking Supervision, Basel, available at:
http://www.bis.org/publ/bcbs195.pdf
(accessed 5th February, 2016).
8 FSB (2014) ‘Supervisory intensity and
effectiveness’, 7th April, Financial Stability
Board, Basel, available at: http://www.
fsb.org/wp-content/uploads/r_140407.pdf
(accessed 5th February, 2016).
9 EBA (2014) ‘Results of 2014 EU-Wide Stress
Test. Aggregate results’, Report, 26th October,
European Banking Authority, London, available at:
http://www.eba.europa.eu/documents/10180/
669262/2014+EU-wide+ST-aggregate+results.pdf
(accessed 5th February, 2016).
© Henry Stewart Publications 1752-8887 (2016) Vol. 9, 2 000–000 Journal of Risk Management in Financial Institutions 13
RMFI0035_BALDAN_9_2.indd 13
10 ECRS–EMEA Centre for Regulatory Strategy
(2013) ‘Risk appetite framework. How to
spot the genuine article’, July, Deloitte, New
York, available at: https://www2.deloitte.com/
content/dam/Deloitte/au/Documents/risk/
deloitte-au-risk-appetite-frameworks-financial-
services-0614.pdf (accessed 9th February, 2016).
11 Bank Governance Leadership Network
(2013) ‘Enabling more effective risk appetite
framework’, 30th September, ViewPoints, Tapestry
Networks, available at: http://www.ey.com/
Publication/vwLUAssets/EY_Building_more_
effective_risk_appetite_frameworks/$FILE/
EY-BGLN-ViewPoints-Enabling-more-
effective-RAFs-30-September2013.pdf
(accessed 9th February, 2016).
12 KPMG (2008) ‘Understanding and articulating
risk appetite’, June, available at: https://
www.kpmg.com/CN/en/IssuesAndInsights/
ArticlesPublications/Documents/Risk-appetite-
O-200806.pdf (accessed 9th February, 2016).
13 Institute of Risk Management (2011) ‘Risk
appetite & tolerance. Guidance paper’,
September, available at: https://www.theirm.
org/knowledge-and-resources/thought-
leadership/risk-appetite-and-tolerance/
(accessed 9th February, 2016).
14 COSO (2012) ‘Enterprise risk management.
Understanding and communicating risk
appetite’, January, Committee of Sponsoring
Organizations of the Treadway Commission,
available at: http://www.coso.org/
documents/ERM-Understanding%20%20
Communicating%20Risk%20Appetite-WEB_
FINAL_r9.pdf (accessed 9th February, 2016).
15 Protiviti (2012) ‘Defining risk appetite’,
Early Mover Series, June, available at: http://
www.protiviti.com/en-US/Documents/White-
Papers/Risk-Solutions/Defining-Risk-
Appetite-Early-Mover-Protiviti.pdf (accessed
9th February, 2016).
16 CEBS (2010) ‘High level principles for risk
management’, 16th February, Committee
of European Banking Supervisors,
London, available at: http://www.eba.
europa.eu/documents/10180/16094/
HighLevelprinciplesonriskmanagement.pdf
(accessed 5th February, 2016).
05/03/16 11:34 am
 Baldan, Geretto and Zen
17 Bank of Italy (2006) ‘New regulations for the
prudential supervision of banks’, Circular No. 263
of 27th December and subsequent updates, Bank
of Italy, Rome.
18 Institute of International Finance (2011)
‘Implementing robust risk appetite frameworks
to strengthen financial institutions’, available at:
http://www.garp.org/media/1488538/
risk_appetite_report_final.single.pdf (accessed
5th February, 2016).
19 GARP (2013) ‘Risk appetite framework
challenges’, December, Global Association of
Risk Professionals, Jersey City, NJ, available
at: http://www.garp.org/media/1233873/
riskappetiteframeworkchallenges_
tsuyoshioyama_120313.pdf (accessed
9th February, 2016).
20 Price Waterhouse Coopers (2009) ‘Risk: getting
appetite right’, The Journal, Banking and Capital
Markets, May, available at: https://www.rims.
org/resources/ERM/Documents/Getting%20
Risk%20Appetite%20Right.pdf (accessed
9th February, 2016).
21 Cremonino, A. (2011) ‘Risk appetite as a core
element of ERM: definition and process’,
Enterprise Risk Management Symposium,
Society of Actuaries, 14th–16th March,
available at: http://www.ermsymposium.
org/2011/pdf/Cremonino.pdf (accessed
5th February, 2016).
22 IIF (2013) ‘I.I.F. response to FSB’s principles
for an effective risk appetite framework’,
30th September, Institute of International
Finance, Washington, DC.
23 ABI–Bain & Company (2011) ‘Il processo
di definizione e gestione del Risk Appetite
nelle banche Italiane’, Gruppo di Lavoro Risk
Appetite, March, available at: http://www.
compliance-community.it/public/files/group_
files/11/162 (accessed 9th February, 2016).
24 Mc Nish, R., Schlosser, A., Selandari, F.,
Stegemann, U. and Vorholt, J. (2013) ‘Getting to
ERM. A road map for banks and other financial
institutions’, McKinsey Working Paper Series on
Risk, No. 43, March, available at: http://www.
mckinsey.com/~/media/mckinsey/dotcom/client_
service/Risk/Working%20papers/43_Getting_
to_ERM.ashx (accessed 9th February, 2016).
14 Journal of Risk Management in Financial Institutions Vol. 9, 2 000–000 © Henry Stewart Publications 1752-8887 (2016)
RMFI0035_BALDAN_9_2.indd 14
25 BCBS (2013) ‘Principles for effective risk
data aggregation and risk reporting’, Bank
for International Settlements, January, Basel
Commission on Banking Supervision, Basel,
available at: http://www.bis.org/publ/bcbs239.
pdf (accessed 5th February, 2016).
26 Ashby, S., Palermo, T. and Power, M. (2012)
‘Risk culture in financial organizations: an
interim report’, November, Centre for Analysis
of Risk and Regulation, London School of
Economics and Political Science, available at:
http://www.lse.ac.uk/accounting/CARR/
pdf/risk-culture-interim-report.pdf (accessed
9th February, 2016).
27 Cortez, A. (2011) ‘Winning at risk’, Wiley
Finance, Hoboken, NJ.
28 Deloach, J. W. (2000) ‘Enterprise-wide risk
management’, Prentice Hall, London.
29 COSO (2004) ‘Enterprise risk management
— integrated framework’, September,
Committee of Sponsoring Organizations
of the Treadway Commission, available
at: http://www.coso.org/documents/
coso_erm_executivesummary.pdf (accessed
9th February, 2016).
30 Protiviti (2012) ‘Risk appetite framework: uno
strumento chiave di sostenibilità per il mondo
finanziario’, Insight 36, February, available
at: http://www.protiviti.it/it-IT/Documents/
Newsletters/Newsletter%20n.36%20_Feb_2012.
pdf (accessed 9th February, 2016).
31 KPMG (2011) ‘Using risk appetite to drive
value’, Risk Consulting, September.
32 Guorguiev, M. and Gualerzi, C. (2013)
‘Introduzione al risk appetite framework’, in
G. Giudici and F. Marchetto (eds) La gestione
dei rischi durante la crisi: lesson learnt,
McGraw-Hill, Milan, chapter 3.
33 Hyde, P., Liebert, T. and Wackerbeck, P. (2009)
‘A comprehensive risk appetite framework for
banks’, Leading Research, Booz & Company,
New York.
34 Corbellini, M. (2013) ‘Risk appetite e
pianificazione strategica in chiave ICAAP: una
metodologia per le piccole banche’, Bancaria,
No. 3, pp. 70–76.
35 For some risk categories (eg reputation), but
also for all the so-called pure risks in general,
05/03/16 11:34 am
 A quantitative model to articulate the banking risk appetite framework
it is hard to imagine a bank having a particular
‘appetite’, since no economic returns can be
derived from accepting such risks. In such cases,
unless the risks are ‘quantifiable’, it would be
better to define a generic tolerance, expressed in
mainly qualitative terms. One should also note
that the operational risk numbers from banks
(eg OpVaR) do often include some ‘soft
elements’; nonetheless, since the authors are
taking the capital requirements, as is, from the
financial statements for modelling purpose, they
implicitly leave it to individual banks to decide
what goes into the VaR.
36 In this research, the regression equations are
developed for upper levels of risk tolerance
and risk limits because the authors expect
banks could be more concerned about high
levels of risk than lower ones, following the
prudential approach recommended by regulatory
authorities. Nonetheless, the model could also
be applied to the lower levels of risk tolerance
and risk limits: this should especially be done
in the case of banks with current levels of risk
consumption below the lower limits identified
with RAS, in order to avoid reducing their
profitability (see, for example, Table 2).
37 Bank of Italy (2014) ‘Annual Report for 2013
— statistical appendix’, 30th May, Bank of Italy,
© Henry Stewart Publications 1752-8887 (2016) Vol. 9, 2 000–000 Journal of Risk Management in Financial Institutions 15
RMFI0035_BALDAN_9_2.indd 15
Rome, available at: https://www.bancaditalia.
it/pubblicazioni/relazione-annuale/2013/en_
stat_app_13.pdf?language_id=1 (accessed
9th February, 2016).
38 EBA (2014) ‘Draft guidelines for common
procedures and methodologies for the
supervisory review and evaluation process
under Article 107 (3) of Directive 2013/36/EU’,
Consultation Paper, 7th July, European Banking
Authority, London, available at: http://www.eba.
europa.eu/documents/10180/748829/EBA-CP-
2014-14+%28CP+on+draft+SREP+Guidelin
es%29.pdf (accessed 5th February, 2016).
39 Concerning the liquidity risk, for instance,
one could start by considering the ‘Liquidity
Coverage Ratio’ (LCR) and the ‘Net Stable
Funding Ratio’ (NSFR), but to apply the
method described here it would be advisable to
consider their respective reciprocals, ie the ratio
between the volume of net outf lows at 30 days
and the high-quality (first and/or second tier)
cash reserves available over the same period (the
LCR), and the ratio between stable loans and
stable funding, both measured for periods longer
than one year (the NSFR). This approach would
enable the risk capacity with which to correlate
the other risk parameters to be taken into due
consideration.
05/03/16 11:34 am
 Baldan, Geretto and Zen

APPENDIX 1. RAS FOR SEPARATE BANKING GROUPS (% VALUES)

Credem TCR/Tier1 TCR/RC CC/Tier1 CC/RC Op/Tier1 Op/RC Mkt/Tier1 Mkt/RC
RiskTolerance Up 105.95 78.87 87.56 65.36 9.01 6.66 10.29 7.66
RiskLimit Up 100.43 75.30 84.12 63.22 8.60 6.42 8.31 6.19
EW Up 96.15 72.53 81.45 61.56 8.29 6.24 6.77 5.05
EW Low 83.30 64.22 73.44 56.58 7.35 5.68 2.14 1.64
RiskLimit Low 79.01 61.45 70.77 54.92 7.04 5.50 0.60 0.50
RiskTolerance Low 73.50 57.89 67.33 52.78 6.64 5.26 0.00 0.00
Values as at 31.12.14 71.94 67.98 64.32 60.78 6.29 5.95 1.33 1.25
Carige TCR/Tier1 TCR/RC CC/Tier1 CC/RC Op/Tier1 Op/RC Mkt/Tier1 Mkt/RC
RiskTolerance Up 128.84 87.38 117.25 79.11 10.54 7.53 2.61 1.96
RiskLimit Up 122.32 84.71 111.11 76.66 10.01 7.19 2.23 1.67
EW Up 117.26 82.64 106.34 74.76 9.60 6.93 1.94 1.44
EW Low 102.06 76.43 92.03 69.05 8.36 6.14 1.06 0.76
RiskLimit Low 97.00 74.37 87.26 67.15 7.95 5.87 0.76 0.53
RiskTolerance Low 90.48 71.70 81.12 64.70 7.42 5.53 0.38 0.24
Values as at 31.12.14 91.84 71.17 84.87 65.77 6.76 5.24 0.20 0.16
BPer TCR/Tier1 TCR/RC CC/Tier1 CC/RC Op/Tier1 Op/RC Mkt/Tier1 Mkt/RC
RiskTolerance Up 120.59 75.43 113.90 72.06 10.05 6.39 1.87 1.29
RiskLimit Up 113.69 73.61 106.62 69.51 9.54 6.25 1.68 1.17
EW Up 108.32 72.20 100.98 67.52 9.14 6.15 1.54 1.08
EW Low 92.23 67.96 84.03 61.57 7.95 5.83 1.12 0.80
RiskLimit Low 86.87 66.54 78.38 59.58 7.56 5.73 0.98 0.70
RiskTolerance Low 79.96 64.73 71.11 57.03 7.05 5.59 0.80 0.58
Values as at 31.12.14 70.89 65.34 63.21 58.26 6.28 5.79 1.25 1.15
BPM TCR/Tier1 TCR/RC CC/Tier1 CC/RC Op/Tier1 Op/RC Mkt/Tier1 Mkt/RC
RiskTolerance Up 110.31 76.25 100.67 70.11 8.56 5.78 2.17 1.44
RiskLimit Up 104.37 72.91 95.24 66.89 7.92 5.43 1.93 1.30
EW Up 99.76 70.32 91.02 64.39 7.43 5.17 1.74 1.19
EW Low 85.93 62.55 78.38 56.89 5.95 4.37 1.18 0.87
RiskLimit Low 81.32 59.96 74.16 54.39 5.46 4.10 0.99 0.76
RiskTolerance Low 75.38 56.62 68.73 51.17 4.82 3.76 0.75 0.61
Values as at 31.12.14 65.50 52.12 59.36 47.23 5.19 4.13 0.94 0.75
PopVi TCR/Tier1 TCR/RC CC/Tier1 CC/RC Op/Tier1 Op/RC Mkt/Tier1 Mkt/RC
RiskTolerance Up 111.31 70.86 112.77 71.55 8.52 5.47 1.65 1.39
RiskLimit Up 106.25 70.38 106.22 70.02 7.89 5.23 1.42 1.17
EW Up 102.33 70.00 101.14 68.83 7.41 5.05 1.25 1.00
EW Low 90.56 68.87 85.87 65.26 5.95 4.50 0.71 0.49
RiskLimit Low 86.64 68.49 80.79 64.07 5.47 4.31 0.53 0.32
RiskTolerance Low 81.59 68.00 74.24 62.54 4.84 4.08 0.30 0.10
Values as at 31.12.14 76.65 69.24 69.91 63.15 4.83 4.37 1.91 1.72

16 Journal of Risk Management in Financial Institutions Vol. 9, 2 000–000 © Henry Stewart Publications 1752-8887 (2016)

RMFI0035_BALDAN_9_2.indd 16 05/03/16 11:34 am

 A quantitative model to articulate the banking risk appetite framework

PopSondrio TCR/Tier1 TCR/RC CC/Tier1 CC/RC Op/Tier1 Op/RC Mkt/Tier1 Mkt/RC

RiskTolerance Up 107.35 90.70 100.17 85.56 7.04 5.99 3.29 2.96
RiskLimit Up 103.08 87.30 95.78 81.74 6.75 5.75 2.91 2.59
EW Up 99.77 84.66 92.37 78.78 6.53 5.56 2.61 2.31
EW Low 89.83 76.74 82.14 69.87 5.86 4.99 1.72 1.45
RiskLimit Low 86.52 74.10 78.73 66.91 5.64 4.80 1.42 1.17
RiskTolerance Low 82.25 70.70 74.34 63.09 5.35 4.56 1.03 0.80
Values as at 31.12.14 81.99 70.94 71.45 61.82 6.48 5.61 4.06 3.51
Desio TCR/Tier1 TCR/RC CC/Tier1 CC/RC Op/Tier1 Op/RC Mkt/Tier1 Mkt/RC
RiskTolerance Up 80.74 73.14 72.14 65.37 7.98 7.15 0.90 0.81
RiskLimit Up 78.36 70.78 70.03 63.27 7.74 6.94 0.77 0.70
EW Up 76.51 68.94 68.40 61.64 7.55 6.77 0.68 0.61
EW Low 70.96 63.44 63.48 56.75 6.99 6.28 0.40 0.36
RiskLimit Low 69.11 61.60 61.84 55.12 6.81 6.11 0.31 0.27
RiskTolerance Low 66.72 59.24 59.73 53.02 6.57 5.90 0.18 0.16
Values as at 31.12.14 76.49 65.24 67.95 57.95 8.13 6.93 0.41 0.35
BPop TCR/Tier1 TCR/RC CC/Tier1 CC/RC Op/Tier1 Op/RC Mkt/Tier1 Mkt/RC
RiskTolerance Up 122.00 78.13 107.89 69.31 8.66 6.52 6.41 4.11
RiskLimit Up 112.05 74.16 98.80 65.50 8.29 6.19 5.58 3.66
EW Up 104.33 71.07 91.75 62.54 8.01 5.93 4.94 3.31
EW Low 81.15 61.82 70.58 53.66 7.17 5.17 3.01 2.27
RiskLimit Low 73.42 58.74 63.53 50.70 6.89 4.91 2.37 1.92
RiskTolerance Low 63.47 54.77 54.44 46.89 6.53 4.58 1.54 1.48
Values as at 31.12.14 65.26 54.71 55.77 46.75 6.77 5.68 2.72 2.28
CreVal TCR/Tier1 TCR/RC CC/Tier1 CC/RC Op/Tier1 Op/RC Mkt/Tier1 Mkt/RC
RiskTolerance Up 131.79 87.67 121.05 80.50 9.68 6.49 1.32 0.89
RiskLimit Up 123.16 83.04 113.11 76.24 9.14 6.20 1.09 0.74
EW Up 116.46 79.45 106.94 72.94 8.71 5.97 0.91 0.62
EW Low 96.36 68.67 88.45 63.04 7.44 5.29 0.37 0.26
RiskLimit Low 89.66 65.07 82.29 59.74 7.01 5.07 0.19 0.13
RiskTolerance Low 81.03 60.45 74.35 55.48 6.46 4.77 0.00 0.00
Values as at 31.12.14 72.93 57.23 66.48 52.18 6.37 5.00 0.08 0.06
UBI TCR/Tier1 TCR/RC CC/Tier1 CC/RC Op/Tier1 Op/RC Mkt/Tier1 Mkt/RC
RiskTolerance Up 110.40 74.30 100.47 67.63 7.87 5.28 2.51 1.72
RiskLimit Up 101.94 69.19 92.88 63.05 7.21 4.88 2.16 1.48
EW Up 95.38 65.23 86.99 59.50 6.69 4.56 1.88 1.29
EW Low 75.68 53.32 69.31 48.84 5.14 3.62 1.05 0.73
RiskLimit Low 69.11 49.35 63.42 45.29 4.62 3.30 0.77 0.54
RiskTolerance Low 60.65 44.24 55.83 40.71 3.96 2.90 0.42 0.30
Values as at 31.12.14 64.88 52.33 60.24 48.59 3.90 3.15 0.74 0.60
(Continued)

© Henry Stewart Publications 1752-8887 (2016) Vol. 9, 2 000–000 Journal of Risk Management in Financial Institutions 17

RMFI0035_BALDAN_9_2.indd 17 05/03/16 11:34 am

 Baldan, Geretto and Zen

APPENDIX 1. (CONTINUED)
Unicredit TCR/Tier1 TCR/RC CC/Tier1 CC/RC Op/Tier1 Op/RC Mkt/Tier1 Mkt/RC
RiskTolerance Up 106.85 71.74 93.57 63.30 9.99 7.30 5.24 3.81
RiskLimit Up 99.76 68.87 86.47 59.94 9.65 7.08 4.57 3.34
EW Up 94.26 66.64 80.95 57.34 9.38 6.92 4.05 2.97
EW Low 77.73 59.95 64.41 49.52 8.58 6.42 2.49 1.86
RiskLimit Low 72.23 57.72 58.90 46.92 8.31 6.25 1.97 1.49
RiskTolerance Low 65.13 54.85 51.80 43.56 7.97 6.04 1.30 1.02
Values as at 31.12.14 71.95 59.68 61.49 51.00 7.78 6.45 2.69 2.23
VenetoBanca TCR/Tier1 TCR/RC CC/Tier1 CC/RC Op/Tier1 Op/RC Mkt/Tier1 Mkt/RC
RiskTolerance Up 107.69 85.00 98.14 77.44 7.91 6.63 1.84 1.36
RiskLimit Up 104.20 81.62 94.88 74.30 7.64 6.25 1.72 1.28
EW Up 101.49 78.99 92.35 71.87 7.43 5.96 1.63 1.23
EW Low 93.36 71.11 84.76 64.56 6.82 5.08 1.35 1.06
RiskLimit Low 90.66 68.48 82.23 62.13 6.61 4.79 1.26 1.00
RiskTolerance Low 87.17 65.09 78.98 58.99 6.35 4.41 1.14 0.93
Values as at 31.12.14 83.72 77.46 75.56 69.91 6.68 6.18 1.48 1.37
Sella TCR/Tier1 TCR/RC CC/Tier1 CC/RC Op/Tier1 Op/RC Mkt/Tier1 Mkt/RC
RiskTolerance Up 119.68 72.07 102.59 61.48 14.52 9.10 3.29 2.08
RiskLimit Up 114.90 70.37 98.33 60.01 14.04 8.85 3.00 1.90
EW Up 111.19 69.06 95.02 58.88 13.68 8.65 2.77 1.76
EW Low 100.08 65.11 85.10 55.46 12.58 8.06 2.10 1.35
RiskLimit Low 96.37 63.79 81.80 54.32 12.22 7.87 1.88 1.21
RiskTolerance Low 91.60 62.10 77.54 52.85 11.75 7.62 1.59 1.03
Values as at 31.12.14 89.29 68.24 74.78 57.15 11.91 9.11 2.58 1.97
Ravenna TCR/Tier1 TCR/RC CC/Tier1 CC/RC Op/Tier1 Op/RC Mkt/Tier1 Mkt/RC
RiskTolerance Up 89.01 63.67 79.90 57.38 7.04 5.04 2.43 1.68
RiskLimit Up 85.83 61.07 77.05 54.98 6.89 4.90 1.98 1.37
EW Up 83.37 59.05 74.84 53.11 6.77 4.79 1.63 1.13
EW Low 75.97 52.99 68.21 47.51 6.42 4.47 0.59 0.40
RiskLimit Low 73.50 50.97 66.00 45.64 6.30 4.37 0.24 0.16
RiskTolerance Low 70.33 48.37 63.15 43.24 6.15 4.23 0.00 0.00
Values as at 31.12.14 71.93 61.23 65.21 55.51 6.20 5.27 0.17 0.14
Marostica TCR/Tier1 TCR/RC CC/Tier1 CC/RC Op/Tier1 Op/RC Mkt/Tier1 Mkt/RC
RiskTolerance Up 77.81 75.19 67.78 65.29 7.89 7.69 6.97 6.92
RiskLimit Up 74.09 71.82 64.10 61.99 7.23 7.05 5.94 5.88
EW Up 71.19 69.21 61.24 59.43 6.72 6.56 5.14 5.08
EW Low 62.52 61.35 52.68 51.74 5.20 5.08 2.73 2.67
RiskLimit Low 59.62 58.74 49.82 49.18 4.69 4.59 1.93 1.86
RiskTolerance Low 55.90 55.36 46.14 45.88 4.04 3.96 0.90 0.83
Values as at 31.12.14 75.54 74.28 64.10 63.04 8.45 8.31 2.98 2.93

18 Journal of Risk Management in Financial Institutions Vol. 9, 2 000–000 © Henry Stewart Publications 1752-8887 (2016)

RMFI0035_BALDAN_9_2.indd 18 05/03/16 11:34 am

 A quantitative model to articulate the banking risk appetite framework

PopBari TCR/Tier1 TCR/RC CC/Tier1 CC/RC Op/Tier1 Op/RC Mkt/Tier1 Mkt/RC

RiskTolerance Up 143.68 86.00 123.43 70.94 15.45 8.61 1.55 0.85
RiskLimit Up 133.63 81.24 114.85 67.82 14.15 8.15 1.24 0.69
EW Up 125.82 77.54 108.19 65.40 13.14 7.79 0.99 0.56
EW Low 102.40 66.46 88.21 58.14 10.12 6.73 0.26 0.17
RiskLimit Low 94.60 62.76 81.55 55.71 9.11 6.38 0.02 0.04
RiskTolerance Low 84.55 58.00 72.98 52.60 7.81 5.92 0.00 0.00
Values as at 31.12.14 72.56 55.00 65.39 49.56 6.98 5.29 0.20 0.15
CariAsti TCR/Tier1 TCR/RC CC/Tier1 CC/RC Op/Tier1 Op/RC Mkt/Tier1 Mkt/RC
RiskTolerance Up 105.35 91.56 96.26 82.83 10.52 9.43 0.99 0.78
RiskLimit Up 99.64 85.32 90.91 77.29 9.57 8.42 0.75 0.59
EW Up 95.20 80.48 86.76 72.99 8.84 7.64 0.60 0.47
EW Low 81.89 65.96 74.30 60.08 6.63 5.29 0.15 0.12
RiskLimit Low 77.46 61.12 70.15 55.77 5.90 4.51 0.00 0.00
RiskTolerance Low 71.74 54.88 64.80 50.23 4.95 3.50 0.00 0.00
Values as at 31.12.14 74.77 59.21 65.01 51.48 9.58 7.59 0.18 0.14
PopCividale TCR/Tier1 TCR/RC CC/Tier1 CC/RC Op/Tier1 Op/RC Mkt/Tier1 Mkt/RC
RiskTolerance Up 89.30 76.40 80.95 69.36 7.94 6.84 3.04 2.51
RiskLimit Up 84.80 72.35 76.98 65.75 7.11 6.10 2.45 2.03
EW Up 81.31 69.21 73.90 62.95 6.46 5.53 2.00 1.65
EW Low 70.84 59.80 64.65 54.54 4.52 3.82 0.63 0.53
RiskLimit Low 67.35 56.66 61.57 51.74 3.88 3.24 0.17 0.15
RiskTolerance Low 62.86 52.62 57.60 48.13 3.04 2.51 0.00 0.00
Values as at 31.12.14 79.69 75.08 72.33 68.14 7.31 6.89 0.05 0.05
BCCAltaBrianza TCR/Tier1 TCR/RC CC/Tier1 CC/RC Op/Tier1 Op/RC Mkt/Tier1 Mkt/RC
RiskTolerance Up 59.61 55.49 51.90 48.32 4.49 4.22 0.00 0.00
RiskLimit Up 57.50 53.67 50.39 47.04 4.43 4.16 0.00 0.00
EW Up 55.87 52.26 49.22 46.05 4.39 4.12 0.00 0.00
EW Low 50.95 48.02 45.70 43.07 4.25 3.99 0.00 0.00
RiskLimit Low 49.31 46.60 44.53 42.08 4.20 3.95 0.00 0.00
RiskTolerance Low 47.20 44.78 43.02 40.80 4.15 3.89 0.00 0.00
Values as at 31.12.14 46.80 45.41 42.53 41.26 4.28 4.15 0.00 0.00
Bologna TCR/Tier1 TCR/RC CC/Tier1 CC/RC Op/Tier1 Op/RC Mkt/Tier1 Mkt/RC
RiskTolerance Up 77.56 74.59 72.51 69.68 6.49 6.40 0.26 0.25
RiskLimit Up 76.02 73.32 70.71 68.16 6.22 6.11 0.20 0.20
EW Up 74.82 72.33 69.31 66.98 6.02 5.89 0.16 0.16
EW Low 71.23 69.37 65.12 63.44 5.40 5.21 0.04 0.04
RiskLimit Low 70.03 68.39 63.72 62.26 5.20 4.99 0.00 0.00
RiskTolerance Low 68.49 67.12 61.92 60.74 4.93 4.70 0.00 0.00
Values as at 31.12.14 66.50 66.50 59.48 59.48 6.82 6.82 0.20 0.20
(Continued)

© Henry Stewart Publications 1752-8887 (2016) Vol. 9, 2 000–000 Journal of Risk Management in Financial Institutions 19

RMFI0035_BALDAN_9_2.indd 19 05/03/16 11:34 am

 Baldan, Geretto and Zen

APPENDIX 1. (CONTINUED)
BCCCesena TCR/Tier1 TCR/RC CC/Tier1 CC/RC Op/Tier1 Op/RC Mkt/Tier1 Mkt/RC
RiskTolerance Up 63.58 61.39 59.37 57.34 5.29 5.16 0.37 0.36
RiskLimit Up 62.01 59.98 57.63 55.76 5.05 4.91 0.29 0.28
EW Up 60.79 58.90 56.28 54.54 4.85 4.72 0.23 0.22
EW Low 57.13 55.63 52.24 50.86 4.28 4.15 0.06 0.06
RiskLimit Low 55.91 54.54 50.90 49.63 4.08 3.96 0.00 0.00
RiskTolerance Low 54.34 53.14 49.16 48.05 3.84 3.71 0.00 0.00
Values as at 31.12.14 51.91 51.38 46.47 45.99 5.29 5.23 0.15 0.15
CreditoPopolare TCR/Tier1 TCR/RC CC/Tier1 CC/RC Op/Tier1 Op/RC Mkt/Tier1 Mkt/RC
RiskTolerance Up 79.48 68.35 66.16 56.02 8.05 7.12 7.93 6.89
RiskLimit Up 76.82 66.70 64.59 55.52 7.92 7.01 6.07 5.28
EW Up 74.76 65.41 63.37 55.12 7.82 6.93 4.85 4.22
EW Low 68.56 61.56 59.70 53.94 7.52 6.69 1.21 1.06
RiskLimit Low 66.49 60.27 58.48 53.55 7.42 6.60 0.00 0.00
RiskTolerance Low 63.83 58.62 56.91 53.04 7.29 6.50 0.00 0.00
Values as at 31.12.14 62.01 61.96 53.92 53.88 7.18 7.17 0.92 0.92
Carismi TCR/Tier1 TCR/RC CC/Tier1 CC/RC Op/Tier1 Op/RC Mkt/Tier1 Mkt/RC
RiskTolerance Up 135.07 92.73 120.07 82.38 12.65 8.69 6.22 4.27
RiskLimit Up 128.89 88.43 114.51 78.53 11.95 8.20 4.98 3.42
EW Up 124.09 85.09 110.20 75.54 11.40 7.82 4.02 2.76
EW Low 109.69 75.08 97.25 66.58 9.76 6.68 1.15 0.79
RiskLimit Low 104.89 71.74 92.94 63.59 9.22 6.30 0.19 0.13
RiskTolerance Low 98.71 67.44 87.38 59.74 8.51 5.81 0.00 0.00
Values as at 31.12.14 89.68 60.94 82.14 55.81 7.08 4.81 0.46 0.32
IBL TCR/Tier1 TCR/RC CC/Tier1 CC/RC Op/Tier1 Op/RC Mkt/Tier1 Mkt/RC
RiskTolerance Up 127.40 89.35 116.79 81.68 19.25 16.43 0.00 0.00
RiskLimit Up 117.89 85.42 106.29 76.66 17.46 14.66 0.00 0.00
EW Up 111.19 82.65 98.91 73.13 16.07 13.29 0.00 0.00
EW Low 91.12 74.35 76.75 62.55 11.90 9.16 0.00 0.00
RiskLimit Low 84.42 71.58 69.36 59.02 10.51 7.79 0.00 0.00
RiskTolerance Low 74.91 67.65 58.87 54.00 8.72 6.02 0.00 0.00
Values as at 31.12.14 94.70 91.07 85.24 81.98 9.46 9.09 0.00 0.00
CassaPadana TCR/Tier1 TCR/RC CC/Tier1 CC/RC Op/Tier1 Op/RC Mkt/Tier1 Mkt/RC
RiskTolerance Up 58.64 52.60 54.05 48.49 5.08 4.66 0.01 0.01
RiskLimit Up 56.36 51.00 51.85 46.91 4.84 4.45 0.01 0.01
EW Up 54.59 49.75 50.13 45.68 4.65 4.29 0.01 0.01
EW Low 49.29 46.02 44.99 42.00 4.10 3.80 0.00 0.00
RiskLimit Low 47.52 44.78 43.28 40.77 3.92 3.64 0.00 0.00
RiskTolerance Low 45.25 43.18 41.07 39.19 3.68 3.43 0.00 0.00
Values as at 31.12.14 41.75 41.42 37.73 37.43 4.02 3.99 0.00 0.00

20 Journal of Risk Management in Financial Institutions Vol. 9, 2 000–000 © Henry Stewart Publications 1752-8887 (2016)

RMFI0035_BALDAN_9_2.indd 20 05/03/16 11:34 am

 A quantitative model to articulate the banking risk appetite framework

SanFelice TCR/Tier1 TCR/RC CC/Tier1 CC/RC Op/Tier1 Op/RC Mkt/Tier1 Mkt/RC

RiskTolerance Up 41.17 40.47 38.31 37.69 2.99 2.82 0.07 0.07
RiskLimit Up 40.27 38.91 37.43 36.19 2.92 2.74 0.05 0.05
EW Up 39.57 37.70 36.75 35.02 2.87 2.68 0.04 0.04
EW Low 37.48 34.06 34.70 31.53 2.70 2.49 0.01 0.01
RiskLimit Low 36.78 32.84 34.02 30.36 2.64 2.43 0.00 0.00
RiskTolerance Low 35.88 31.28 33.14 28.86 2.57 2.34 0.00 0.00
Values as at 31.12.14 42.93 42.82 39.97 39.87 2.96 2.95 0.00 0.00
BCCBedizzole TCR/Tier1 TCR/RC CC/Tier1 CC/RC Op/Tier1 Op/RC Mkt/Tier1 Mkt/RC
RiskTolerance Up 61.68 58.86 56.88 54.17 4.96 4.81 0.00 0.00
RiskLimit Up 60.07 57.49 55.41 52.96 4.76 4.61 0.00 0.00
EW Up 58.82 56.43 54.26 52.01 4.62 4.46 0.00 0.00
EW Low 55.06 53.24 50.83 49.19 4.17 4.00 0.00 0.00
RiskLimit Low 53.81 52.18 49.68 48.24 4.02 3.85 0.00 0.00
RiskTolerance Low 52.20 50.81 48.21 47.03 3.83 3.66 0.00 0.00
Values as at 31.12.14 59.11 59.11 54.37 54.37 4.74 4.74 0.00 0.00
Notes: RiskTolerance Up = upper bound of 99% confidence interval for mean = mean + (t critical value*std error of the mean). RiskLimit
Up = upper bound of 95% confidence interval for mean = mean + (t critical value*std error of the mean). EW Up = RiskLimit Up −
0.2(RiskLimit Up − RiskLimit Low). EW Low = RiskLimit Low + 0.2(RiskLimit Up − RiskLimit Low). RiskLimit Low = lower bound of 95%
confidence interval for mean = mean − (t critical value*std error of the mean). RiskTolerance Low = lower bound of 99% confidence
interval for mean = mean − (t critical value*std error of the mean).
Source: authors’ elaboration.

APPENDIX 2. GLOSSARY DESIO = Gruppo Banco Desio (http://www.

CREDEM = Gruppo Bancario Credito
Emiliano — Credem (http://www.credem.
it/EN_International/Pages/Home_
International.aspx)
INTESA SANPAOLO = Gruppo Bancario Intesa
SanPaolo (http://www.group.intesasanpaolo.
com/scriptIsir0/si09/eng_index.jsp)
CARIGE = Gruppo Banca Carige — Banca CARIGE
S.p.A. — Cassa di Risparmio di Genova e Imperia
(http://www.gruppocarige.it/grp/)
MPS = Gruppo Banca Monte dei Paschi di Siena
(http://english.mps.it/)
BPER = Gruppo Banca Popolare dell’Emilia
Romagna — Bper (http://www.gruppobper.it/
wps/gruppo/banca/bper_istzgruppo_content/
sitoen/homepage/ilgruppo/)
BPM = Gruppo Banca Popolare di Milano (http://
www.gruppobpm.it/en-ist.html)
POPSONDRIO = Gruppo Banca Popolare di
Sondrio (http://www.popso.it/cm/pages/
ServeBLOB.php/L/EN/IDPagina/1)
bancodesio.it/index.php/home)
BPOP = Gruppo Banco Popolare (http://www.
bancopopolare.it/en/)
CREVAL = Gruppo Bancario Credito Valtellinese
(https://www.creval.it/index.asp)
UBI = Gruppo UBI Banca (http://www.ubibanca.
it/pagine/Home-EN.aspx)
UNICREDIT = Unicredit S.p.A. (https://www.
unicreditgroup.eu/en.html)
VENETOBANCA = Gruppo Veneto Banca
(http://www.gruppovenetobanca.it/en/)
POPVI = Gruppo Banca Popolare di Vicenza
(http://www.popolarevicenza.it/bpvi-web/
home/englishVersion.html)
SELLA = Gruppo Banca Sella (https://www.
gruppobancasella.it/bsh_eng/index.jsp)
RAVENNA = Gruppo Cassa di Risparmio di
Ravenna (http://www.lacassa.com/ita/
Banca/Gruppo-Bancario)
MAROSTICA = Gruppo Banca Popolare di
Marostica (from 16th January, 2015 merged

© Henry Stewart Publications 1752-8887 (2016) Vol. 9, 2 000–000 Journal of Risk Management in Financial Institutions 21

RMFI0035_BALDAN_9_2.indd 21 05/03/16 11:34 am

 Baldan, Geretto and Zen
into Banca Popolare dell’Alto Adige: https://
www.bancapopolare.it/smartedit/documents/
download/comunicato_stampa_press_release_
cda_fusione_en.pdf )
POPBARI = Gruppo Creditizio Banca Popolare di
Bari (http://www.popolarebari.it/content/bpb/
it/il-gruppo.html)
CARIASTI = Gruppo Cassa di Risparmio di Asti
(http://www.bancacrasti.it/index.php)
POPCIVIDALE = Gruppo Banca Popolare di
Cividale (http://www.civibank.it/)
BCCALTABRIANZA = Gruppo Banca di Credito
Cooperativo dell’Alta Brianza (http://www.
bccaltabrianza.it/home/home.asp)
BOLOGNA = Gruppo Bancario Banca di Bologna
(http://www.bancadibologna.it/ecm/home/privati)
22 Journal of Risk Management in Financial Institutions Vol. 9, 2 000–000 © Henry Stewart Publications 1752-8887 (2016)
RMFI0035_BALDAN_9_2.indd
View publication stats 22
BCCCESENA = Gruppo Banca di Credito
Cooperativo di Cesena e Ronta (http://www.
bancadicesena.it/)
CREDITOPOPOLARE = Gruppo Bancario Banca
di Credito Popolare (https://www.bcp.it/wps/
portal/BCP/header/la-banca)
CARISMI = Gruppo Carismi (http://www.carismi.
it/opencms/homepage/index.jsp)
IBL = Gruppo IBL Banca (https://www.iblbanca.it/)
CASSAPADANA = Gruppo Cassa Padana (http://
www.cassapadana.it/)
SANFELICE = Gruppo SanFelice 1893 Banca
Popolare (http://sanfelice1893.it/Default.aspx)
BCCBEDIZZOLE = Gruppo Banca di Credito
Cooperativo di Bedizzole Turano Valvestino
(http://www.bedizzole.bcc.it/index.php)
05/03/16 11:34 am