Raymond Cheung
Chartered Actuary · CRO · Board Adviser · Singapore
Most Singapore risk appetite frameworks are technically complete and operationally inert — approved by the board, filed with MAS, and absent from every decision that matters. As a statutory CRO I signed off on a few of them. Here is how to tell whether yours is doing any work, and how to wire it back into the underwriting, investment and capital decisions it was built for.
As a statutory chief risk officer I once presented the annual risk appetite refresh to a board risk committee. Twenty-two metrics, each with a green, amber or red band, all green bar one amber on operational losses. It was approved in about six minutes. Later in the same meeting the committee approved a reinsurance restructuring that materially changed the tail of the book — and nobody put the two items in the same sentence. The framework and the decision lived on different pages of the same pack.
The test: name one decision it changed
Here is the diagnostic I give every board. Point to one decision in the last twelve months that went differently because of a risk appetite limit. A deal repriced. A line that was not allowed to grow. An investment allocation pulled back. A reinsurance retention set where it was because the net position would otherwise have breached tolerance. If nobody in the room can name one, the framework is documentation, not governance — no matter how sophisticated the metrics look.
Most people I ask cannot name one immediately. That is not because the business is reckless. It is because the framework was built to satisfy MAS Notice 126 and the board's assurance needs, and those are reporting purposes. It was never wired into the underwriting, investment and capital processes where the risk is actually taken.
“A risk appetite framework that only appears in the board pack is a reporting artefact. It is not influencing anything.”
Why frameworks go inert
- The metrics measure outcomes, not decisions. "Solvency ratio above X" tells you the result after everything has been decided. It gives an underwriter or a portfolio manager nothing to act on at the moment of the decision.
- Tolerances are set where the business already sits. If every limit was calibrated to current exposure plus headroom, the framework will never bind — by construction.
- No owner below the CRO. If a metric goes amber and the only consequence is a paragraph in the next quarterly report, nobody has to do anything by any date.
- Qualitative statements with no teeth. "We have a low appetite for reputational risk" is not a constraint. It cannot be breached, so it cannot bite.
- The framework and the business plan are built separately. The plan assumes growth the appetite would not permit, and the two are never reconciled because different people own them on different timelines.
What a framework that works looks like
The frameworks I have seen actually influence decisions share a few features. They are smaller. They cascade into the places where decisions are made. And they show up outside the board pack.
- Fewer metrics, each tied to a lever. Not twenty-two — closer to eight, and every one maps to something a person can actually pull: underwriting authority, per-risk and per-catastrophe limits, asset allocation ranges, reinsurance retention, counterparty concentration.
- Cascaded into delegated authorities. The board's appetite is translated into the underwriting guidelines, the investment mandate and the delegations of authority, so a front-line decision-maker is working inside it without having to read the risk appetite statement.
- A defined response to amber and red. Each threshold has a named owner and a required action within a set time — reprice, de-risk, bring a paper, escalate. Not "monitor".
- Reviewed when the strategy changes, not only once a year. A new product, an acquisition, a shift in asset mix — each should trigger the question "does this fit our stated appetite" before the decision, not in the following year's refresh.
- Visible in management papers. The investment committee paper references the asset-risk tolerance; the underwriting forum references the catastrophe limit. If risk appetite appears only in board-level documents, it is not operational.
The MAS Notice 126 angle
For a Singapore insurer this is not optional housekeeping. MAS Notice 126 requires the board to set a risk appetite as part of the enterprise risk management framework and to satisfy itself that the framework is genuinely operating rather than merely documented. MAS Circular ID 01/26, issued in January 2026, made clear the regulator is reading ORSA submissions closely and can tell engagement from ratification. A risk appetite statement that cannot be connected to a single management decision is exactly the kind of gap a thematic review surfaces.
The board's job here is narrow and specific. Not to write the metrics, but to ask whether they bind. When the CRO presents the annual refresh, the question is not "are we within appetite" — it is "show me where this framework changed what we did".
Where to start if yours is inert
- Run the one-decision test at the next committee meeting and record the answer honestly.
- Cut the metric set to the ones that map to a real lever; move the rest to an appendix.
- For each surviving metric, name the owner and write the required action for amber and for red.
- Reconcile the framework against the current business plan and flag every place they disagree.
- Put risk appetite references into the next investment and underwriting papers and watch whether they change the discussion.
A risk appetite framework is not meant to be an annual disclosure. It is meant to be the thing that makes someone pause before writing a large line, or trim an allocation before it is made. If yours has not done that in a year, the fix is not more metrics or a longer statement. It is fewer metrics, real owners, and a deliberate effort to push it off the board table and into the places where the risk is actually taken.
Common Questions
What is a risk appetite framework?
A risk appetite framework is the set of statements, metrics and thresholds by which a board defines how much risk, and what types of risk, the organisation is willing to accept in pursuit of its strategy. For a Singapore insurer it typically spans capital and solvency, insurance and underwriting risk, market and credit risk, liquidity and operational risk, and is required under MAS Notice 126.
How do you know if a risk appetite framework is working?
Name one decision in the last twelve months that went differently because of a risk appetite limit — a deal repriced, a line capped, an allocation trimmed, a reinsurance retention set to stay within tolerance. If no one can point to such a decision, the framework is functioning as a reporting artefact rather than a governance tool, however detailed its metrics.
What does MAS Notice 126 require on risk appetite?
MAS Notice 126 requires the board of a licensed Singapore insurer to establish and approve a risk appetite as part of the enterprise risk management framework, review it at least annually, and satisfy itself that the framework is operating in practice. MAS Circular ID 01/26 (January 2026) signalled closer scrutiny of whether boards genuinely engage with these frameworks or simply ratify them.
How many metrics should a risk appetite statement have?
There is no fixed number, but frameworks that influence decisions tend to be tighter — often around eight core measures, each mapped to a specific lever such as underwriting authority, catastrophe limits, asset allocation ranges or reinsurance retention. Long lists of outcome measures such as the solvency ratio tend to describe results after decisions have been made rather than guide them.
About the author
Raymond Cheung is a Chartered Actuary, C-suite executive and board adviser with more than 20 years of experience across Asia in risk management, insurance, ESG and corporate governance. He is the CEO of CER Consultancy and an accredited trainer at SMU Academy and the Singapore College of Insurance.