Risk Committees & Governance

Why this chapter matters

A risk committee should turn reliable information into decisions, direction, and accountable follow-through. It is easy for a bank to hold many meetings while material issues remain unowned or unresolved. The value lies in the authority exercised, the quality of challenge, and the consequences for the bank's actual risk profile. Attendance and completed agendas are outputs, not proof of effective governance.

This lesson follows a fictional funding decision at Malla Bank. Malla sponsors a growth proposal, Ramesh prepares the cash and exposure information, Gunaditya challenges the stress assumptions, and Sravanthi relies on the bank delivering her payments. The example connects committee mandates, information, decision rights, minutes, and operational execution. Its amounts, quorum arrangements, and decision thresholds are internal classroom assumptions.

The governing body and management have different roles, while committees support their work. A board committee can examine material risk and advise or act within its remit; a management committee can coordinate and decide matters within delegated authority. A name such as enterprise risk committee does not establish which decisions the forum can make. The authority must be clear before a consequential proposal reaches it.

The plain meaning

Governance establishes direction, oversight, decision rights, and accountability. A committee is a forum with a defined purpose, membership, information needs, authority, and reporting route. Its charter records those arrangements. Management information supports the forum's judgement, and minutes preserve the consequential decisions, reasoning, and actions.

The decision chain should connect authority to execution. A committee may approve a proposal with conditions, but the operating owner must ensure the conditions are met before proceeding. A discussion that identifies a concern is incomplete if nobody owns the response. A recommendation is different from an approval, and noting a report does not imply acceptance of every exposure it describes.

The bank should be able to reconstruct who decided what, on which evidence, within which authority, and with which unresolved assumptions. Those questions apply during normal meetings, urgent decisions, and disagreements. A governance process that works only when every usual participant is present is vulnerable when it is most needed.

Current standards context

The Basel corporate-governance principles of July 2015 are the international reference for board oversight, management, risk governance, and control functions. The April 2024 Core Principles address governance and comprehensive risk management in supervisory assessment. They do not prescribe the fictional committee names, meeting calendar, quorum, or cash threshold used here. Basel governance principles; Basel Core Principles, Principles 14 and 15.

Applicable legal and supervisory arrangements determine institution-specific duties, including any required committees, independence, reporting, and individual responsibilities. BCBS decisions have no supranational legal force. Sources were reviewed on 2 October 2026. BCBS Charter.

The governance artifacts below are original teaching designs. A bank should adapt them to its legal entities, business, risk profile, authority structure, and requirements. An internal approval cannot waive a binding obligation, and group approval cannot automatically replace a local entity's required decision.

What governance means

Direction establishes the objectives and boundaries of risk-taking. Oversight examines whether management is pursuing them appropriately. Decision rights determine who can choose among alternatives, and accountability makes someone responsible for delivery and explanation. These elements should reinforce each other. A committee without authority can identify a problem repeatedly without changing it; authority without reliable information can approve an unsafe proposal.

Governance should also recognise uncertainty. A decision can be reasonable on the available evidence and still need review if assumptions change. The record should identify those assumptions and the triggers for reconsideration. Describing a conditional decision as permanently approved removes an important control over changing circumstances.

A useful governance design follows the decisions the bank actually needs to make. A service outage, a funding change, a product launch, and a significant control weakness can require different expertise and urgency. The design should connect the relevant forums and escalation routes without sending every issue through every committee.

Board and executive responsibilities

The governing body oversees the bank's direction, risk appetite, and management arrangements under applicable requirements. It needs enough information and expertise to challenge material matters. It should not become the operator of every process. Management implements strategy, manages exposure, provides information, and arranges effective controls and resources.

Board oversight can examine whether management's proposal fits appetite and capacity, whether specialist challenge was addressed, and whether execution conditions are credible. Management should identify the decision needed rather than provide a large pack without a clear request. A governing body cannot assess a proposal well if important limitations are hidden in an appendix.

Delegation should preserve escalation for matters beyond management's remit. The authority schedule can identify decision types, materiality criteria, conditions, and emergency arrangements. The exact design is bank-specific. A management forum should not infer authority from the fact that a senior person attends it; authority follows the approved arrangement and applicable law.

Committee mandates and charters

A charter should state purpose, scope, authority, membership, chair, required expertise, quorum, information standards, conflict handling, escalation, and recordkeeping. It should distinguish advisory recommendations from decisions. It should also identify the relationship with other committees and the governing body so that matters do not disappear between forums.

In the fictional bank, a management funding forum can adjust short-term funding within approved bounds, while a material strategic funding change needs a different authority. Its charter names the owners who provide liquidity, collateral, capital, and operational views. It also defines how an urgent decision is handled when a scheduled meeting is too late.

Quorum is meaningful only if the bank follows its own rules. If required decision participants are absent, the forum can discuss the matter but should not misrepresent the outcome as a valid approval. An authorised alternate or urgent route may be available. The minutes should state which route was used and why, rather than conceal the departure behind a normal meeting template.

Specialist risk committees

Specialist forums can examine credit, asset-liability management, operational resilience, conduct, models, or other areas where focused expertise helps. Their existence should reflect actual decisions and exposures. A specialist forum can provide a detailed view to an enterprise committee, which considers interactions and aggregate consequences.

An asset-liability committee may assess funding and interest-rate exposures together, while a product forum examines customer and operating outcomes. A supplier forum can expose common dependencies affecting several services. These are examples of possible designs, not a universal list of required bank committees.

The interface should specify what is escalated, by whom, and with which evidence. A specialist recommendation that depends on enterprise capacity should reach the forum controlling that capacity. Conversely, an enterprise decision should not assume specialist implementation details that were never examined. Clear boundaries reduce both blind spots and repeated review of the same question.

Management information quality

A decision pack should state the proposal, alternatives, exposure, assumptions, risk effects, applicable constraints, specialist concerns, and decision requested. It should distinguish current observations from forecasts and conditional management actions. The first page should make material uncertainty visible, rather than bury it in technical detail.

Ramesh's funding report identifies usable cash by time and location, projected net outflows, collateral already encumbered, and access dependencies. A total labelled liquidity without those details can overstate available resources. The pack should reconcile important totals to sources and show the data date. A late report based on stale assumptions may be worse than a concise current report with explicit limitations.

Information should include adverse evidence and unresolved disagreement. Gunaditya's challenge to the stress scenario belongs in the decision record even if management prefers the base forecast. The forum can then judge alternatives knowingly. Removing the dissent because the pack should be concise compromises the substance of oversight.

Decision rights and escalation

The agenda should identify whether the forum is being asked to note, recommend, approve, reject, or request further work. These outcomes have different consequences. A minute that says discussed does not establish authority to execute. A minute that says approved should identify the version, scope, conditions, and owner of the decision.

Escalation needs an appropriate recipient and time sensitivity. A projected limit breach may require action before the next scheduled meeting. An incident can need containment through an authorised response process, followed by formal reporting. Waiting for a committee calendar should not prolong known harm or postpone a binding reporting obligation.

Decision-makers should consider conflicts of interest. A sponsor can explain benefits while the forum obtains challenge from people able to question the proposal. Where a conflict affects participation or voting under the bank's arrangements, the record should show how it was handled. A signature is weak evidence if the decision process was materially conflicted.

Minutes evidence and action tracking

Minutes should capture the material decision, rationale, conditions, significant challenge, unresolved issues, authority, and assigned actions. They need not reproduce every spoken sentence. Their purpose is to preserve the consequential governance record so that another person can understand what management was authorised to do.

An action log should distinguish the decision from the work required to implement it. Each action needs an owner, intended outcome, milestone or due date, dependencies, and closure evidence. If the funding decision depends on confirming collateral access, that condition should be verified before the dependent action proceeds. Recording it as an ordinary later action can weaken the approval.

Closure reporting should show ageing and materiality as well as counts. A fictional log begins with 24 actions, closes six, and adds nine, ending with 27. The stock increased by three despite successful closures. If the oldest material action remains unresolved, the governance position may be worse than the closure count suggests. Dates should not be reset casually to make overdue work disappear.

Legal entity and group governance

A group view and a legal-entity view can both matter. Resources available elsewhere in the group may be restricted or unavailable when a local entity needs them. A group policy can define expectations, while local obligations and decision rights still need analysis. The bank should not assume that consolidation removes entity-specific constraints.

For the funding case, treasury should identify which entity owns the asset, which entity has the obligation, and whether transfer is feasible in the relevant period. A group total can hide a local shortfall. The committee's authority should cover the decision actually proposed, not merely the group narrative on the first slide.

The interface between group and local forums should specify reporting, escalation, approvals, and conflicts. A local concern should not be removed because the consolidated position looks comfortable. A group decision should be communicated with enough context for local management to identify implementation barriers and applicable requirements.

Committee overload and duplication

Several committees can review one proposal while each assumes another assessed the difficult issue. The bank should map decision objectives and evidence needs. Duplicate work can be reduced where it answers the same question without adding value, while independent challenge should be preserved where it provides a different perspective.

A practical map can show that the specialist forum assesses collateral feasibility, the enterprise forum judges aggregate capacity, and the authorised management body makes the execution decision. Each outcome should flow into the next without repeating a generic pack. A matter should not circulate indefinitely because no charter identifies who can decide.

Meeting effectiveness also depends on manageable information. Excessive agenda items can crowd out material decisions. The chair should arrange prioritisation, adequate preparation, and a route for urgent matters. Removing difficult items to keep the meeting short would solve the calendar problem while weakening governance.

Regulatory supervision and challenge

Supervisors can examine governance evidence, including whether the bank understands its material risks and addresses weaknesses. The bank should distinguish an internal action from a formal supervisory commitment and preserve the applicable authority, wording, date, and evidence requirements for the latter. An internal committee cannot silently redefine a commitment.

Responses should be supported by implementation and effectiveness evidence, not just revised documents. If the bank states that governance improved, it should explain the decision process changed, how material information now reaches the forum, and how execution is followed through. The scope of the claim should match the evidence available.

A request from a supervisor should reach the relevant accountable owners through controlled channels. Interpretation may require legal or compliance expertise. Committee visibility helps oversight, but reporting a request is not the same as completing the work or obtaining acceptance from the authority where that is required.

How governance connects to operations

An approved decision must become executable instructions, controlled changes, resources, and monitoring. The process owner should understand the conditions and the evidence needed to demonstrate them. A committee minute hidden from the delivery team cannot operate as an effective control over implementation.

Feedback should also travel upward. If operations discovers that the approved funding route depends on unavailable access or incomplete collateral records, management needs to reconsider the decision. Staff should have a route to report that condition without being pressured to deliver the original plan at any cost.

The governance record should connect the proposal, approved version, implementation, and subsequent outcomes. That trace makes it possible to determine whether an incident arose from an unsound decision, failed execution, or a later change in assumptions. Without it, lessons tend to become generic requests for better communication.

How to tell whether a committee is effective

Look at consequential decisions and their results. Did the forum receive reliable information? Did challenge expose a material assumption? Was authority clear? Were conditions implemented before dependent actions? Did monitoring identify changes requiring reconsideration? These questions provide stronger evidence than meeting frequency alone.

Effectiveness can also be assessed through sampled records, participant feedback, action ageing, recurring unresolved matters, and the quality of escalation. Measures should be interpreted carefully. A low escalation count may indicate well-controlled operations or reluctance to raise concerns. A high count may indicate deterioration or better detection.

Independent assurance can examine whether the committee system works as intended, including the quality of information and specialist challenge. It should state its scope and limitations. Reviewing charters alone cannot establish operating effectiveness; reviewing a few convenient meetings cannot establish every decision was sound.

Worked teaching story

Malla proposes committing 40 million training units to a lending initiative. The bank has 100 million of usable resources over the example horizon. Ramesh's base forecast shows 30 million of other net outflows, leaving 30 million after the proposed commitment. These are simplified cash positions, not regulatory liquidity calculations.

Gunaditya identifies a plausible stress condition increasing other net outflows to 50 million. Under that condition, 100 minus 40 minus 50 leaves 10 million. The fictional internal planning buffer is 20 million. The proposed commitment therefore fails that internal stress condition even though the base forecast is comfortable.

The funding forum examines alternatives: reduce the commitment, arrange a credible resource increase, change timing, or decline. If resources and stressed outflows remain as stated, a commitment no greater than 30 million preserves the 20 million buffer because 100 minus 30 minus 50 equals 20. This calculation establishes a scenario condition, not loan acceptability or compliance with every applicable constraint.

The charter gives the forum authority to recommend the strategic change, while a different authorised body approves it. The recommendation records the stressed calculation and a condition that collateral access be confirmed before any resource-dependent execution. The final decision names the implementation owner and monitoring triggers. A recommendation is not misreported as an immediate execution approval.

Operations later discovers that one assumed access route cannot be used in the relevant window. Ramesh reports the limitation, and the decision is reconsidered before commitment. Sravanthi's existing payment service is included in the consequence analysis because the bank must consider ongoing obligations alongside new growth. The exercise shows how operational information can change governance judgement.

Learners should write the decision request, significant challenge, conditional approval, and action evidence. They should explain why the base result alone is insufficient, why the forum's authority matters, and which information should trigger reconsideration. The goal is a traceable decision chain, not a collection of meeting signatures.

Common failure scenarios

A committee notes a report, and the sponsor treats noting as approval. The bank needs clear decision terminology and a record of the actual authority exercised. The response should correct the interpretation before execution proceeds on an unsupported assumption.

An action is repeatedly extended while the exposure continues. The forum should examine the remaining risk, causes of delay, interim controls, and escalation. Updating a due date does not reduce the exposure or provide evidence of remediation.

A group pack omits a local entity constraint. The decision should be reassessed with entity-specific information and the appropriate local authority. A favourable consolidated total cannot establish that resources are available where and when needed.

Practical closing view

A committee is effective when it obtains dependable information, exercises clear authority, preserves material challenge, and ensures decisions reach accountable execution. Its record should make conditions and uncertainty visible. Follow-through then tests whether the outcome supports the original decision.

Use the funding case to trace a proposal from cash assumptions through stress, authority, conditions, implementation, and review. Governance becomes useful when those links influence what the bank actually does.

Official reference sources

The Basel corporate-governance principles, 2024 Core Principles, and BCBS Charter support the international context. Committee structures, internal buffers, calculations, and record designs in this chapter are original teaching examples. Applicable committee and supervisory obligations must be identified for the relevant bank and legal entity.