Risk Limit

Overview

Risk limits translate appetite and tolerance into operational constraints. They may restrict transaction value, credit exposure, asset concentration, leverage, withdrawal velocity, privileged actions, downtime, or unresolved control exceptions.

A limit must specify scope, calculation, period, data source, aggregation, owner, and breach response. Poorly designed limits can be bypassed through account splitting, delayed data, related entities, multiple systems, or exposures measured with inconsistent definitions.

Organizations should monitor utilization, warn before breaches, prevent or escalate actions as intended, and document temporary exceptions. Limits need periodic recalibration using losses, near misses, capacity, market conditions, customer outcomes, and stress scenarios. Related accounts and instruments should be aggregated before applying threshold decisions.

A risk limit is a measurable boundary on exposure, activity, loss, concentration, or another risk indicator that triggers action when approached or exceeded. A risk limit is effective only when its measurement, ownership, aggregation, enforcement, exception process, and breach response are unambiguous.

For Risk Limit, the assessment should evaluate a measurable boundary on exposure, activity, loss, concentration, or another risk indicator that triggers action when approached or exceeded. The assessment record should separate observed evidence supporting a measurable boundary on exposure, activity, loss, concentration, or another risk indicator that triggers action when approached or exceeded from assumptions, state the time horizon and existing controls, and identify who owns any remaining exposure. Monitoring should test whether the conditions described in a measurable boundary on exposure, activity, loss, concentration, or another risk indicator that triggers action when approached or exceeded have changed enough to require a new rating, treatment, or approval.

Decision-makers should use findings about a measurable boundary on exposure, activity, loss, concentration, or another risk indicator that triggers action when approached or exceeded to select treatment, assign remediation, set review thresholds, and document why any residual exposure is accepted.