Risk Appetite, Tolerance, Capacity and Limits

Capacity is arithmetic: the most an institution could lose before it reaches its own capital floor. Appetite is a choice made inside capacity. Tolerance is a band around that choice. A limit is the cap given to the business, set below appetite on purpose. Profile is what actually happened. Here they run Rs 2,400 crore, Rs 900 crore, Rs 1,080 crore, Rs 810 crore and Rs 648 crore.

Four of these words get used as though they meant the same thing, and one of them, the profile, gets used as though it were a plan rather than a measurement. The confusion between the five words is not a vocabulary problem. Loose vocabulary is what lets an institution say it is comfortable when all it means is that it has not yet hit anything. The five words have to be settled before any exposure can be examined.

The five separate cleanly only when all five are stated on one number. The number is annual credit loss at Vindhya Commercial Bank Limited, an invented bank, chosen because five words need one scale to be held apart on. Credit risk and the other risk types are covered separately, and every figure below is one invented bank's own setting rather than a requirement of anybody.

Why are four words that sound like synonyms not synonyms?

Start with the everyday version. The bank version is the same shape at a larger scale. A household earns Rs 90,000 a month and, after everything that has to be paid, could survive a fall of Rs 24,000 a month before it starts missing an instalment. Nobody chose that Rs 24,000. The figure fell out of the income and the commitments. Because it wants room, the household then decides, sitting at the kitchen table, that it will not let its spending on anything uncertain go past Rs 9,000 a month. The household also agrees that Rs 10,800 in a bad month is survivable without a fresh conversation. The household tells the person who does the shopping that the cap is Rs 8,100. And at the end of the month, the figure actually spent was Rs 6,480.

Five numbers, five different kinds of thing. The first was computed, the second and third were decided, the fourth was granted to somebody, and the fifth was measured after the fact. The single most useful habit is asking of any risk number presented which of those four kinds it is. A computed number does not care whether anybody likes it. A decided number can be argued with. A granted number can be exceeded by somebody doing exactly the job they were told to do. A measured number can only be wrong if the measurement is wrong.

Four words, four claims, four different people

Now the same five at Vindhya Commercial Bank Limited, on one metric, with the mistake each pair invites. Confusing capacity with appetite makes a board think its own choice was forced on it. Confusing appetite with a limit makes a business think its cap is the whole of what the board will live with. Confusing tolerance with appetite removes the institution's ability to say whether a small overshoot needs anybody to do anything. And confusing the profile with any of the other four is how an institution ends up describing what it did as what it intended.

What is risk capacity, and why is it arithmetic rather than a choice?

Risk capacityThe most an institution could absorb before it reaches its own floor, computed from capital rather than chosen. is the one figure in the set that nobody votes on. Capacity is the most an institution could lose in a year before its capital reaches a level it has decided it will not go below. Three inputs produce it, and once those three are fixed the answer is fixed with them. Capacity is therefore the right place to start: everything after it is a decision made inside a boundary that was already there.

Risk Capacity: worked from capital, risk weighted assets and the institution's own floor

At Vindhya Commercial Bank Limited the three inputs are total capital of Rs 9,000 crore, risk weighted assets of Rs 60,000 crore, and an internal capital floorThe lowest capital ratio an institution will allow itself to reach. Here it is set by the bank itself and is not a stated requirement of anybody. of 11.0 per cent that the bank set for itself. Eleven per cent of Rs 60,000 crore is Rs 6,600 crore, and that much capital is reserved before any loss is contemplated at all. The capital left over is Rs 9,000 crore less Rs 6,600 crore, or Rs 2,400 crore. The remaining Rs 2,400 crore is the bank's risk capacity on this metric, and no meeting produced it.

Little discretion sits inside it. The bank cannot argue with its own capital. The balance sheet states it. The same holds for its risk weighted assets. The only element it chose is the floor, and the floor is a policy about how close to the edge it is prepared to run rather than a view about lending. So the honest description is that capacity is arithmetic with one policy variable in it, and the simulation below moves exactly that variable and shows what happens.

What the capacity figure ignores, and by how much

Here is the part most treatments leave out, and leaving it out is worse than not giving the figure at all. The computation above holds risk weighted assets at Rs 60,000 crore while the loss is being taken. In life they would not stay there. When an exposure goes bad and is written off, it stops being an asset that carries a risk weight, so the denominator falls at the same time the capital does. A computation that moves only the numerator has understated how much loss the institution could actually take.

How much does it understate it by? Answering it needs an assumption the bank has not made, and an assumption that changes the answer has to be visible: suppose the exposure written off carried a risk weight of 100 per cent, so risk weighted assets fall rupee for rupee with the loss. Then the question becomes: what loss takes the ratio exactly to 11.0 per cent when both sides move? Solve 9,000 less the loss, over 60,000 less the loss, equal to 11.0 per cent. The solution gives 2,400 equal to 0.89 times the loss, so the loss is Rs 2,696.6 crore. Check it: Rs 6,303.4 crore of capital over Rs 57,303.4 crore of risk weighted assets is 11.00 per cent exactly.

So the locked Rs 2,400 crore is the conservative reading, and it is too low by about 12.4 per cent under that one stated assumption. The 12.4 per cent matters less as a number than as a habit. Knowing which direction a simplification errs in is most of what makes the simplification usable. A figure that ignores something and says so can be relied on in one direction. A figure that ignores something silently cannot be relied on in either. Rs 2,400 crore stays the bank's capacity throughout this guide; the Rs 2,696.6 crore is an illustration of what the simplification costs and is not a figure of the bank.

What is risk appetite, and who decides it?

Now the choice. Risk appetiteThe amount and type of risk an institution says it is willing to take in pursuit of its objectives, decided rather than computed. is what a board says it is willing to lose, and at this bank it is Rs 900 crore a year on this metric. Every part of that sentence matters. A board says it, not a risk function and not a business. The figure is stated as an amount, so it can be tested. And it is a willingness rather than a forecast: nobody is predicting a Rs 900 crore loss, they are saying that if one arrived they would not consider the institution to have gone outside what it signed up for.

Risk Appetite: a choice made inside capacity, and the refusal is the statement

Rs 900 crore against capacity of Rs 2,400 crore is 37.5 per cent. Read that the other way round and the meaning turns over. The board has declined to use Rs 1,500 crore of its own capacity, being 62.5 per cent of it, and that refusal is the entire content of an appetite statement. A board that set appetite equal to capacity would have declined nothing, and would have written a document that says nothing at all. The interesting number was never the Rs 900 crore on its own. The fraction was the number all along.

And it genuinely was a choice. Rs 600 crore would have been inside capacity. So would Rs 1,200 crore. So would Rs 2,399 crore, uncomfortably. The board picked one point on a line where every point was available, and a reader who cannot see that line will read Rs 900 crore as though it had been handed down. It was not. Somebody sat in a room and argued for it, and somebody else argued for a different figure, and the minute of that meeting is where the reasoning lives.

Two warnings attach before the fraction is carried anywhere. First, 37.5 per cent of capacity is this invented bank's setting on one metric in one year and is not a normal, a benchmark or a target for anybody. Second, capacity itself moves, so the same appetite figure is a different fraction next year if capital or risk weighted assets change. The statement is a claim about a moment, and it is re-approved for that reason.

What is risk tolerance, and why is it a band when appetite is a point?

Appetite gave one number. One number cannot answer what comes next: the loss for the year comes in at Rs 950 crore, Rs 50 crore past the stated appetite. Has anything happened? With only a point, the answer is either yes, in which case a fifty crore overshoot on a nine hundred crore statement triggers a board conversation, or no, in which case nobody knows how much past the point is allowed and the point means nothing. An institution that states only a point cannot tell a rounding error from a problem.

Risk Tolerance: a band around the appetite point

Risk toleranceThe range around the appetite point an institution will live with before it is obliged to act. is the answer to that. At this bank the tolerance runs from Rs 900 crore to Rs 1,080 crore, appetite plus 20.0 per cent, so the band is Rs 180 crore wide. Inside the band, the institution is somewhere it did not aim for and is willing to be, a different state from either being on target or being outside its statement. The Rs 950 crore year sits there: above the point, inside the band, and therefore a note in a paper rather than a decision by the board.

The household had this too, and it is worth naming because most people already run a band without calling it one. The kitchen table figure was Rs 9,000 a month, and Rs 10,800 in a bad month was survivable without a fresh conversation. Nobody wrote that down. The bank writes it down, and writing it down is the whole difference: an unwritten band is renegotiated every time it is tested, always downward in the moment and always upward in hindsight.

Two things this band is not. The band is not a second appetite. The institution is not indifferent between Rs 900 crore and Rs 1,080 crore, and the point remains where it wants to be. The band is not permission to run at the ceiling either. A position that lives at Rs 1,080 crore all year has quietly turned the band into the target, and turning the band into the target is the most common way a tolerance band stops doing its job.

What is a risk limit, and why does it sit below appetite on purpose?

Everything so far has happened in a board room. A risk limitAn operational cap given to a business, expressed as a number somebody can measure against a position every day. is the first object in the set that a person at a desk can actually use. A limit is a cap, expressed in the same units as the thing being capped, granted to somebody named, and measured against a live position at a stated frequency. If any of those four is missing, what remains is a sentence rather than a limit.

Risk Limit: the operational cap the business is actually given

The limit on the metric at this bank is Rs 810 crore, or 90.0 per cent of appetite. Ask why it is not Rs 900 crore. The answer is what separates a limit from an appetite statement. A limit sits below appetite so that a business filling its cap is not, by that single act, a board breaching its own statement. A business at its cap and a board past its statement are two different failures, and an institution needs them to stay different sizes. One is an operational matter settled between a business and the body that granted the cap. The other is a board matter that reaches the appetite statement itself.

With the limit at Rs 810 crore, a business that runs all the way to its cap has consumed 90.0 per cent of appetite. There is still Rs 90 crore of the board's own statement intact, and beyond that a band running to Rs 1,080 crore. The institution has room to notice, ask, and decide, and none of that room exists if the two figures are the same number.

The word that appears next to every limit is utilisationWhat is actually running against a cap, stated as a percentage of the cap.. Utilisation is simply the position divided by the cap. At Rs 648 crore against Rs 810 crore this bank is at 80.0 per cent utilisation on the metric. Utilisation above 100 per cent is a breach. How a cap like this is derived from an appetite clause, who grants it, what happens the day it is crossed and how the excess is escalated are all a separate subject, covered by the material on risk governance and the limit framework.

What is a risk profile, and how is it different from the other four?

The last of the five is the only one that is neither computed from the balance sheet nor decided by anybody. A risk profileThe risk actually being carried at a point in time, measured rather than decided. is the risk an institution is actually carrying, measured at a reporting date. At this bank the profile on the metric is Rs 648 crore.

Risk Profile: the only one of the five that is an observation

Say the four kinds out loud one more time. The profile is where they get mixed up most often. Capacity was computed. Appetite and tolerance were chosen. The limit was granted. The profile was measured, and a measurement can only be argued with by arguing about the measurement. Nobody can say the profile should have been lower; they can only say it was mismeasured, or that something should have been done earlier to make it lower.

Which is why the most useful thing to do with a profile is to state it against each of the other four rather than on its own. Rs 648 crore is 80.0 per cent of the limit, 72.0 per cent of appetite and 27.0 per cent of capacity. Three sentences, three different audiences. The business hears the first, the board hears the second, and anybody asking whether this institution is close to trouble hears the third. The same rupee figure answers all three because it is the only one of the five that is an observation about the world.

The trap is the sentence "our risk profile is Rs 900 crore" said by somebody who means the appetite. The substitution happens constantly, it sounds harmless, and it converts an intention into a fact. An institution that describes what it did as what it intended has lost the only figure in the set that could have told it it was wrong.

How do the four words differ when they are put side by side?

Risk Appetite vs Tolerance vs Capacity vs Limit: the question each answers and the person who answers it

Definitions read one at a time always sound compatible. Put them in one table and the differences stop being shades of meaning. Read the table by column rather than by row: the column that separates these four fastest is not the figure and not the definition, it is who is entitled to change it.

Three pairings are worth saying out loud because each is a real confusion with a real cost. Capacity against appetite is arithmetic against a decision, and running them together makes a board believe its own choice was imposed, removing the reason to revisit it. Appetite against a limit is a statement against an authorisation, and running them together makes a business believe its cap is the whole of what the institution will bear. Tolerance against appetite is a band against a point, and running them together leaves the institution unable to say whether a small overshoot needs anybody to do anything at all.

How do the five figures nest inside each other?

With all five set on one scale, the nesting is the object worth carrying away. Rs 648 crore of profile sits inside a Rs 810 crore limit, the limit inside a Rs 900 crore appetite, appetite inside a tolerance ceiling of Rs 1,080 crore, and the ceiling inside Rs 2,400 crore of capacity. Every gap on that ladder is a real distance and each one was put there by a different person for a different reason.

Read it downward and it is a series of deliberate narrowings. Read it upward and the ladder becomes a set of multiples, the form a board can actually use: the limit is 1.25 times the profile, appetite is 1.111 times the limit, the tolerance ceiling is 1.20 times appetite, and capacity is 3.70 times the profile. The last multiple is the single most useful sentence the ladder produces: this year would have to be 3.70 times worse before capital reached the floor the bank set for itself. A gap of Rs 1,752 crore says the same thing and travels badly. The gap stops being comparable the moment the balance sheet grows. The multiple keeps working.

One caution about the picture below, and it is the reason the note is drawn on it. The five figures are five stated points. Nothing in between them is a graded zone: this bank has not published a scale of comfort running from Rs 648 crore to Rs 2,400 crore, and a ladder like this invites the reader to imagine one. The white space between two rungs is a distance, not a rating.

There is one loose thread left in the ladder, and it is the floor. Capacity looked like a fact about the institution, but the only element of it anybody chose was the 11.0 per cent the bank set for itself. So what does the ladder look like if that one number moves? Predicting the answer before the control is touched is where the learning is.

Five crossings are worth writing down, and every one of them is exact rather than rounded. Capacity equals the tolerance ceiling of Rs 1,080 crore at a floor of 13.20 per cent, appetite of Rs 900 crore at 13.50 per cent, the limit of Rs 810 crore at 13.65 per cent, the profile of Rs 648 crore at 13.92 per cent, and reaches zero at 15.00 per cent. The last crossing deserves a second look. The bank's actual total capital ratio is 15.0 per cent. So a bank that set its internal floor at the ratio it happens to be running today would have written itself a capacity of nothing at all, and every figure in the chain below it would be outside what the balance sheet could absorb. A floor is a decision about how much room an institution wants, and setting it flush against where it is standing leaves none.

What does an appetite statement look like when it is written down?

An appetite statementThe written document in which a board records what it is willing to be exposed to, clause by clause. is not a paragraph of intent. A statement is a numbered list of testable sentences. The statement at this bank runs to eight clauses, A1 to A8, and the useful thing about seeing them laid out is how ordinary they look: each names a subject, states a threshold in a unit somebody can measure, and sits beside the position the bank is actually at.

The test of a clause is whether anybody could tell, today, whether it is being met. Every one of these eight passes that test, and passing is the minimum rather than the achievement. Notice that they are not all in rupees: one is in days, one is in percentage points of advances, one is a survival period, and one is about a reporting obligation. An appetite statement is not a single number and never was. The clauses are one document because each says the same kind of thing: how much of one exposure the institution is willing to carry, in whatever unit that exposure is naturally measured in.

What can an appetite statement not do?

Three things, and the first one is arithmetic that can be checked on the artefact above. Of the eight clauses, four carry a limit beneath them and four do not. A2 sits above limit L8, A3 above L2, A4 above L3 and A7 above L11. A1 on capital, A5 on asset quality, A6 on liquidity and A8 on conduct have nothing beneath them at all. So on half its own clauses, this board's statement is measured when the board next meets and at no other time. The gap is not the same as nobody looking at capital or liquidity; it means no cap, granted to anybody, is being read against those four clauses between meetings.

The second thing it cannot do is cover what cannot be measured. A clause has to be testable to be a clause, so anything that resists measurement never enters the document. Frank Knight drew the line this depends on in Risk, Uncertainty and Profit in 1921, separating the risk that can be given a number from the uncertainty that cannot, and an appetite statement lives entirely on the first side of it. Clause A8 shows the craft involved: an institution cannot measure whether it has a tolerance for a conduct failure, so it writes down something it can measure instead: any such breach reaches the board's risk committee within 5 working days. The substitute clause is honest work, and it carries a warning inside it. The proxy is what gets managed, so the choice of proxy is a decision about behaviour and not a formatting detail.

The third thing is the simplest. A statement cannot stop anything. The statement is one sentence in a document approved once a year. A position stops growing only against a cap that somebody measures against a live number and has to explain when it is crossed. Frequency rather than size is where the difference shows: the five objects are not read at the same rate, and the gaps in the reading are where an institution loses sight of itself.

Who actually reads these five figures, and what do they do with them?

Different people read different rungs, and most of them never see the whole ladder. Knowing which rung somebody is standing on is what tells the reader what their sentence means.

A board member reads the profile against appetite and asks for one multiple. Rs 648 crore against Rs 900 crore is 72.0 per cent, a comfortable-sounding sentence and, on its own, almost useless. The other question earns its place in the meeting: how much worse would the year have to be before capital reached the bank's own floor? The answer, 3.70 times, survives the balance sheet growing, survives a change of scale and can be asked again next year against a different set of figures.

A business head reads utilisation against the limit and, in most institutions, never sees capacity at all. Rs 648 crore against Rs 810 crore is 80.0 per cent, and the relevant fact for that reader is how much room is left before an authorisation is exhausted. Seeing only the cap is exactly as it should be. The gap between the limit and appetite has to exist for that reason: a reader who only ever sees the cap has no way of knowing how much of the institution's own statement their cap represents.

An analyst outside the institution cannot see any of these figures, and can still test the document. Where a bank publishes the shape of its appetite statement, the testable questions are whether each clause is stated in a unit somebody could measure, whether a current position is given beside it, and whether anything at all sits underneath it between board meetings. A statement of eight clauses where four have nothing beneath them tells an outside reader something real about how the institution runs, and it does so without a single confidential number changing hands.

And the same five objects exist wherever somebody is deciding how much of something they are willing to carry. Nirjhar Industries Limited, invented, the steel and alloys maker that is this bank's largest single exposure, runs its own treasury with caps of exactly this kind: TL1 holds exposure to any one bank to Rs 180 crore and TL5 requires at least Rs 120 crore of liquidity at all times. TL1 and TL5 are limits in precisely the sense settled above, granted to a named treasurer and measured against a live position, and how a corporate treasury sets and runs them is covered separately. The household from the opening of this guide has all five as well. The household never writes the fourth one down, and that is why the person doing the shopping renegotiates it every month.