Summary Governance failures in banks are seldom explained by missing committees. They are explained by overlapping remits, unclear escalation, and decision rights that shift with personalities rather than with structure. This article sets out a durable division of accountability across the board risk committee, the Chief Risk Officer, the asset and liability committee (ALCO) and executive risk committees.
The board risk committee The board risk committee is the ultimate custodian of risk appetite. Its role is to approve appetite, approve the frameworks that operationalise it, oversee the effectiveness of the risk function, and challenge material risk decisions. It is not an executive body. It should not approve individual credits, individual product launches, or individual limit changes; those are executive decisions taken under authorities delegated by the board.
The Chief Risk Officer The CRO is accountable to the board — typically with a dotted reporting line to the chief executive — for the design and operation of the risk framework, the sufficiency of second-line challenge, and the escalation of material risk matters. The CRO has direct access to the board risk committee and the ability to escalate independently. Independence is a structural property, not a personal one; it is protected through appointment, remuneration and dismissal arrangements as much as through reporting lines.
ALCO The asset and liability committee owns the balance sheet within board-approved appetite. Its remit covers funding, liquidity, interest-rate risk in the banking book, capital planning and pricing decisions that shape the balance sheet. ALCO is an executive committee that operates day-to-day authority; it does not set appetite, but it operates within it and reports against it.
Executive risk committees An executive risk committee (sometimes titled Group Risk Committee) is the CRO's forum for cross-risk oversight, aggregation and escalation. Its remit differs from ALCO's — it is horizontal, spanning credit, market, operational, conduct and model risk, whereas ALCO is vertical on the balance sheet. Both are needed. Confusion arises when a bank tries to compress them into one.
Interaction patterns Effective governance is defined by how the bodies interact, not just by what each does. ALCO approvals affecting appetite are reported into the executive risk committee and, where material, to the board risk committee. Financial crime and conduct matters are horizontal, escalated through the executive risk committee. Model risk decisions with material capital or pricing implications flow into ALCO or the credit committee for use, and into the board risk committee for framework approval.
CRO and board implications Boards should test governance by walking through recent material decisions: which body approved, on what basis, with what challenge recorded, and whether the escalation path was followed. A governance map that survives that test is fit for purpose. One that does not is a diagram, not a control.
Practical implementation Board risk committee charter reserving appetite, framework and effectiveness matters; CRO reporting lines documented and reviewed; ALCO terms of reference distinguishing balance sheet execution from appetite setting; annual governance effectiveness review including cross-committee flows; joint agenda planning across executive and board committees.
Limitations Structural clarity is necessary but not sufficient. Governance is ultimately behavioural; even well-designed structures fail if challenge is discouraged or if minutes systematically under-record dissent.
Related reading See [Banking Risk](/expertise/banking-risk), [Corporate Governance](/expertise/corporate-governance), [Governance, Risk and Compliance](/expertise/grc) and the dedicated [Governance](/governance) page.
Frequently asked questions
What should risk leaders know about the board risk committee?
The board risk committee is the ultimate custodian of risk appetite. Its role is to approve appetite, approve the frameworks that operationalise it, oversee the effectiveness of the risk function, and challenge material risk decisions. It is not an executive body. It should not approve individual credits, individual product launches, or individual limit changes; those are executive decisions taken under authorities delegated by the board.
What should risk leaders know about the Chief Risk Officer?
The CRO is accountable to the board — typically with a dotted reporting line to the chief executive — for the design and operation of the risk framework, the sufficiency of second-line challenge, and the escalation of material risk matters. The CRO has direct access to the board risk committee and the ability to escalate independently. Independence is a structural property, not a personal one; it is protected through appointment, remuneration and dismissal arrangements as much as through repo...
What should risk leaders know about aLCO?
The asset and liability committee owns the balance sheet within board-approved appetite. Its remit covers funding, liquidity, interest-rate risk in the banking book, capital planning and pricing decisions that shape the balance sheet. ALCO is an executive committee that operates day-to-day authority; it does not set appetite, but it operates within it and reports against it.
What should risk leaders know about executive risk committees?
An executive risk committee (sometimes titled Group Risk Committee) is the CRO's forum for cross-risk oversight, aggregation and escalation. Its remit differs from ALCO's — it is horizontal, spanning credit, market, operational, conduct and model risk, whereas ALCO is vertical on the balance sheet. Both are needed. Confusion arises when a bank tries to compress them into one.
What should risk leaders know about interaction patterns?
Effective governance is defined by how the bodies interact, not just by what each does. ALCO approvals affecting appetite are reported into the executive risk committee and, where material, to the board risk committee. Financial crime and conduct matters are horizontal, escalated through the executive risk committee. Model risk decisions with material capital or pricing implications flow into ALCO or the credit committee for use, and into the board risk committee for framework approval.