Regulation, Governance, Ethics and Risk Culture

Introduction

Banking is conducted under conditions of uncertainty, leverage, maturity transformation and information asymmetry. Regulation and governance therefore do more than constrain misconduct: they shape how banks identify, measure, monitor and respond to risk. A bank may have sophisticated models and substantial capital, yet remain vulnerable if its board misunderstands risk, managers pursue poorly designed incentives, employees fear escalation, or supervisors receive incomplete information.

This chapter examines the institutional foundations of sound risk management. It focuses on Basel standards, supervisory review and disclosure, the three-lines model, board and senior-management responsibilities, risk committees, internal audit, fiduciary duties, ethical conduct, incentive systems, accountability and organizational culture. The central argument is that risk management is both a technical and social system. Quantitative controls are necessary, but their effectiveness depends on authority, independence, transparency and values.

Learning Objectives

By the end of this chapter, the reader should be able to:

1. Explain the structure and purpose of the Basel regulatory framework.
2. Distinguish minimum capital requirements, supervisory review and market discipline.
3. Evaluate the responsibilities of boards, senior management, risk committees and internal audit.
4. Apply the three-lines model to the allocation of risk-management responsibilities.
5. Analyse fiduciary duties, ethical conduct and incentive design in banking.
6. Assess how organizational culture influences risk-taking and escalation.
7. Recommend governance improvements in a practical banking scenario.

1. Why Regulation and Governance Matter in Banking

Banks perform socially important functions, including accepting deposits, allocating credit, operating payment systems and providing liquidity. Their liabilities are often short term and withdrawable, while their assets are longer term and less liquid. This structure creates vulnerability to runs and contagion. In addition, deposit insurance and the prospect of public support may create moral hazard: shareholders and managers may receive the benefits of risk-taking while some losses are transferred to depositors, taxpayers or the financial system.

Regulation responds to several market failures:

• Information asymmetry: depositors and investors cannot continuously assess the quality of a bank’s assets or controls.
• Externalities: the failure of one institution may impair confidence in others.
• Moral hazard: protection mechanisms can weaken incentives for prudent behaviour.
• Agency problems: managers may pursue growth, compensation or prestige rather than the long-term interests of shareholders and stakeholders.
• Coordination failures: individually rational actions, such as withdrawing liquidity, may produce system-wide instability.

Regulation cannot eliminate risk. Its objective is to make risk-taking more transparent, better capitalized, more accountable and less likely to generate unacceptable harm. Effective governance complements regulation by ensuring that rules are interpreted and applied responsibly rather than treated as a compliance checklist.

2. The Basel Framework

The Basel framework is developed by the Basel Committee on Banking Supervision and provides internationally agreed principles and standards for prudential regulation. It is not, by itself, a national law. Its requirements become legally binding through implementation by national or regional authorities, and implementation can differ across jurisdictions.

The framework is commonly understood through three pillars:

2.1 Pillar 1: Minimum Capital Requirements

Capital absorbs unexpected losses and protects depositors and other creditors. A simplified risk-based capital ratio is:

Eligible regulatory capital is capital recognized under applicable prudential rules. Risk-weighted assets, or RWA, are exposures adjusted for regulatory risk weights and relevant calculation methods. Both numerator and denominator are generally expressed in the same currency, so the ratio is dimensionless. The ratio is meaningful only when capital is measured according to regulatory definitions and RWA are calculated consistently.

Basel capital is organized into quality categories. Common Equity Tier 1 capital generally represents the highest-loss-absorbing form of capital. Additional Tier 1 capital consists mainly of going-concern instruments with specified loss-absorption features. Tier 2 capital provides supplementary gone-concern protection. Regulatory deductions may apply to items such as certain intangible assets or deferred tax assets.

A bank may have a high total capital ratio but weak resilience if much of its capital is of lower quality. Accordingly, supervisors examine the composition, permanence and loss-absorption capacity of capital, not only the headline ratio.

The leverage ratio provides a non-risk-based constraint. In simplified form:

The leverage exposure measure generally includes on-balance-sheet exposures and specified off-balance-sheet items, subject to applicable regulatory adjustments. This ratio acts as a backstop because risk weights may underestimate exposures during periods of innovation, model error or stress.

Basel standards also address liquidity. The Liquidity Coverage Ratio is designed to promote sufficient high-quality liquid assets to withstand a defined short-term stress scenario. Conceptually:

The numerator is the eligible stock of high-quality liquid assets after applicable adjustments. The denominator is stressed cash outflows less permitted cash inflows, subject to regulatory caps and assumptions. The ratio must not be interpreted as a general guarantee of solvency; a bank can be liquid but insolvent, or solvent but unable to obtain liquidity immediately.

The Net Stable Funding Ratio addresses structural funding resilience:

Available stable funding reflects the stability of funding sources over the relevant horizon. Required stable funding reflects the liquidity characteristics and residual maturities of assets and commitments. The ratio is intended to reduce excessive reliance on unstable short-term funding.

2.2 Risk Measurement and Model Governance

Basel requirements may permit standardized approaches or, subject to supervisory approval, internal-model approaches. Internal models can be more risk-sensitive, but they introduce model risk, data limitations, estimation uncertainty and opportunities for regulatory arbitrage. Model approval does not transfer accountability from management to the model or to the supervisor.

Sound model governance requires:

• clear ownership and purpose;
• documented assumptions and data lineage;
• independent validation;
• performance monitoring and back-testing where appropriate;
• controls over changes and overrides;
• stress testing beyond historical experience; and
• explicit recognition of model limitations.

A model can be technically valid and still be unsuitable if its outputs are misunderstood or used outside the population, period or conditions for which it was designed.

2.3 Pillar 2: Supervisory Review

Pillar 2 recognizes that minimum ratios cannot capture every material risk. Supervisors evaluate a bank’s Internal Capital Adequacy Assessment Process, or ICAAP, and its Internal Liquidity Adequacy Assessment Process, or ILAAP, where applicable. They consider governance, risk appetite, concentration risk, interest-rate risk in the banking book, pension risk, reputational risk, strategic risk and risks arising from weak controls.

Supervisory review commonly includes:

1. evaluation of the bank’s risk profile and strategy;
2. assessment of board and management effectiveness;
3. review of capital and liquidity planning;
4. analysis of stress tests and scenarios;
5. examination of risk data aggregation and reporting;
6. targeted examinations and remediation requirements; and
7. the imposition of additional capital, liquidity or governance measures when necessary.

Stress testing should not be reduced to a single forecast. A useful programme includes severe but plausible scenarios, reverse stress testing, management actions and assessment of second-round effects. Reverse stress testing begins with a failure outcome and asks which combinations of events could make that outcome plausible.

2.4 Pillar 3: Disclosure and Market Discipline

Disclosure allows investors, counterparties and analysts to evaluate a bank’s exposures, capital quality, risk processes and resilience. Effective disclosure should be accurate, timely, comparable and understandable. Excessive aggregation can conceal concentrations; excessive technical detail can obscure the message.

Disclosure is not identical to transparency. A bank may comply formally while communicating material risks poorly. Good disclosure connects quantitative information to strategy, risk appetite, governance and uncertainty. It also explains changes over time and significant management judgments.

3. The Three-Lines Model

The three-lines model clarifies accountability without implying that risk is owned only by specialists.

First line: business and operational management. Business units originate transactions, serve customers and operate processes. They own the risks created by their activities and are responsible for controls, escalation and compliance with approved limits.

Second line: risk and compliance functions. These functions establish frameworks, advise the first line, monitor exposures, challenge decisions and report independently to senior management and relevant committees. They do not replace business ownership.

Third line: internal audit. Internal audit provides independent, objective assurance on governance, risk management and internal control. It should have unrestricted access to records, sufficient resources, professional competence and direct communication with the audit committee.

The model is not a rigid organizational chart. Some institutions combine responsibilities or use specialist functions such as legal, finance, model risk, cybersecurity and data governance. The critical questions are whether responsibilities are clear, conflicts are controlled, challenge is credible and assurance is independent.

A common failure is “responsibility diffusion.” The business assumes risk owns the problem; risk assumes the business owns the decision; internal audit discovers the weakness only after loss occurs. A well-designed model assigns a named owner, establishes escalation thresholds and records challenge and resolution.

4. Board and Senior-Management Responsibilities

4.1 The Board

The board is ultimately responsible for the governance and long-term soundness of the institution, subject to the applicable legal framework. It should approve:

• strategy and business model;
• risk appetite and material risk limits;
• capital and liquidity plans;
• remuneration principles;
• succession and fitness standards for senior officers;
• major outsourcing and technology-risk arrangements; and
• frameworks for compliance, conduct and internal control.

A board should not manage individual transactions, but it must understand the aggregate consequences of strategy. Effective oversight requires informed questioning. Examples include: What assumptions make this growth plan achievable? Which risks are outside appetite? How quickly could losses emerge? What information would indicate that a limit is no longer meaningful? What would management do under stress?

Boards have collective responsibility, but collective responsibility should not become untraceable responsibility. Minutes should record material decisions, dissent, information requested and follow-up actions.

4.2 Senior Management

Senior management translates board-approved risk appetite into policies, limits, systems, staffing and incentives. It is responsible for execution, timely escalation and the integrity of management information. A risk appetite statement is effective only if it is linked to business planning, pricing, limits, approval authorities and performance evaluation.

Senior management must also ensure that risk functions have sufficient stature. If the chief risk officer can be dismissed or overruled without meaningful board visibility, formal independence may be weak in practice. Independence does not mean isolation: risk professionals must understand commercial activity sufficiently to provide relevant challenge.

4.3 Risk Committees

A board risk committee normally oversees the institution’s risk profile, appetite, frameworks and major exposures. An executive risk committee may coordinate management decisions across credit, market, liquidity, operational, technology and conduct risks. The audit committee focuses especially on financial reporting, internal control and internal audit, although committee structures vary by jurisdiction and institution.

Effective committees have:

• a clear charter and decision rights;
• members with relevant expertise and sufficient independence;
• high-quality, timely papers;
• defined escalation procedures;
• records of challenge and decisions; and
• systematic tracking of remediation.

Committee quantity does not equal governance quality. Too many committees can fragment accountability and encourage papers to circulate without decisions.

5. Internal Audit and Assurance

Internal audit is an independent assurance function, not an operational control owner. It evaluates whether governance, risk management and controls are designed appropriately and operating effectively. It should adopt a risk-based audit plan that reflects the institution’s strategy, risk profile, regulatory concerns, emerging risks and previous findings.

Internal audit quality depends on independence, competence, access and reporting lines. The chief audit executive should have direct access to the audit committee chair and should be able to raise concerns without management filtering. Auditors must maintain professional skepticism while avoiding the assumption that every unfamiliar practice is automatically unsafe.

Assurance mapping can reduce duplication among internal audit, compliance, risk and external assurance providers. However, reliance on another function requires assessment of its competence, objectivity and scope. “Assurance” is not a substitute for ownership.

6. Fiduciary Duties, Ethics and Conduct

Fiduciary duties arise from law and the relationship between an institution or officeholder and those whose interests are entrusted to them. Their precise content varies by jurisdiction and legal form, but commonly includes duties of care, loyalty, honesty, good faith and proper purpose. Directors must act within authority, manage conflicts and make informed decisions. They must not use institutional information or position for improper personal advantage.

Banking ethics extends beyond legal compliance. Conduct may be technically lawful yet inconsistent with fair treatment, professional integrity or the bank’s stated values. Important conduct risks include mis-selling, manipulation of benchmarks or markets, misuse of confidential information, unsuitable lending, discriminatory service, retaliation against whistleblowers and concealment of control failures.

A practical ethical decision process asks:

1. Is the action legal and within policy?
2. Is it consistent with the bank’s purpose and values?
3. Who bears the downside if the decision is wrong?
4. Would the decision be defensible if publicly disclosed?
5. Have conflicts been identified and managed?
6. Has a credible dissenting view been considered?

Whistleblowing systems should provide confidential reporting, protection from retaliation, independent investigation and feedback on outcomes. A policy that encourages reporting but punishes inconvenient information is ethically defective.

7. Incentives, Accountability and Risk Culture

Compensation influences risk-taking through both financial rewards and social status. Poorly designed incentives may reward loan volume, trading revenue or short-term profit without charging for capital, liquidity, operational costs or future losses. Appropriate design may include deferred compensation, malus, clawback, risk-adjusted performance measures and balanced scorecards.

Risk-adjusted return on capital can be expressed conceptually as:

The numerator should reflect relevant income less expected losses and other material costs; the denominator is the economic capital allocated to the activity. Definitions vary, so comparisons are valid only when methodology is consistent. RAROC is a decision aid, not a complete measure of performance. It may omit conduct, model, liquidity or systemic risks if these are not properly incorporated.

Accountability requires more than identifying a person after failure. It includes clear authority, appropriate resources, reliable information, documented decisions and proportionate consequences. A “no-blame” culture can support learning from honest mistakes, but it must not protect negligence, concealment or reckless disregard of controls.

Risk Culture

Risk culture is the shared pattern of values, beliefs, expectations and behaviours concerning risk. It is revealed by what employees observe, not merely by formal statements. Indicators of a healthy culture include:

• employees escalate bad news promptly;
• leaders respond to challenge respectfully;
• limits are treated as decision boundaries rather than obstacles;
• mistakes are analysed for systemic causes;
• customer and long-term outcomes matter;
• promotions reflect judgment and integrity as well as results; and
• management information is not selectively edited to create comfort.

Culture can be assessed through surveys, interviews, focus groups, conduct incidents, turnover, whistleblowing data, audit findings, limit breaches, incentive outcomes and observations of meetings. These indicators are imperfect. A low number of reported incidents may indicate either strong controls or fear of reporting.

8. Applied Case: Northbridge Bank

The following is an illustrative fictional case.

Background

Northbridge Bank expanded its commercial real-estate portfolio rapidly during a period of low interest rates. The board approved ambitious growth targets. Relationship managers were rewarded mainly for new loan volume and annual revenue. The risk function was small and reported administratively to the chief financial officer, while the chief risk officer attended board meetings only when invited.

Problem

Internal reports showed increasing concentrations in a small number of property sectors and geographic regions. Several loans relied on optimistic rental and valuation assumptions. Risk officers raised concerns, but business executives described them as barriers to growth. Internal audit identified weaknesses in collateral monitoring, but remediation deadlines were repeatedly extended.

When interest rates rose and property values declined, delinquencies increased. The bank remained above its minimum capital ratio, but projected losses under a severe scenario would have breached its internal capital target. Liquidity pressure also emerged because some wholesale funding matured at the same time as deposit outflows increased.

Analysis

The failure was not caused by one defective model. It reflected interconnected governance weaknesses:

• the board approved growth without sufficiently analysing concentration and stress scenarios;
• risk appetite was not translated into enforceable portfolio limits;
• incentives rewarded origination but did not reflect future credit performance;
• the second line lacked independence and authority;
• internal audit findings were not escalated effectively;
• management information emphasized average portfolio performance and concealed concentrations; and
• challenge was interpreted as disloyalty.

The bank’s capital ratio provided limited comfort because it was backward-looking and based on risk estimates that did not fully reflect correlated property exposures. Pillar 2 analysis should have considered concentration, interest-rate and valuation risks together.

Approach and Solution

The board established a special risk committee chaired by an independent director and strengthened the chief risk officer’s direct access to the committee. Management introduced sector and geographic concentration limits, independent valuation review and forward-looking stress testing. New lending incentives were changed to include portfolio quality, risk-adjusted returns and subsequent arrears. Deferred compensation and clawback provisions were applied where legally permissible.

Internal audit conducted a follow-up review of collateral controls and reported unresolved high-risk findings directly to the audit committee. The bank also introduced a conduct dashboard covering limit breaches, escalation timeliness, customer complaints, staff turnover and whistleblowing outcomes.

Outcome

The bank slowed origination, raised additional capital, lengthened selected funding maturities and sold a portion of higher-risk exposures. Profit declined in the short term, but the institution improved resilience and restored supervisory confidence. The board also revised its meeting practices so that dissenting risk views were included in decision papers.

Learning Points

1. A satisfactory minimum ratio does not prove that risk is well governed.
2. Growth targets become dangerous when risk appetite is not operationalized.
3. Independence must exist in reporting lines, access, status and consequences.
4. Incentives should reflect the timing and distribution of risk, not only current revenue.
5. Culture is observable through decisions, escalation and responses to challenge.

9. Contemporary Developments and Limitations

Climate-related financial risk, cyber risk, artificial intelligence, third-party concentration and data-quality failures increasingly challenge conventional governance. AI systems may accelerate credit decisions or surveillance, but they can introduce bias, opacity, privacy concerns, model drift and dependency on vendors. Boards do not need to become data scientists, but they must understand use cases, accountability, validation, human oversight and failure consequences.

Operational resilience has also become central. Banks are expected to identify important business services, set impact tolerances, map dependencies and test severe disruptions. Outsourcing does not outsource accountability. Cloud providers, fintech partners and data vendors may create concentration and service-continuity risks.

Regulatory frameworks have limitations. International standards may be implemented unevenly; capital requirements may encourage procyclical behaviour; disclosure may produce information overload; and supervisory judgment can vary. Regulation may also lag innovation. These limitations support a layered approach combining capital, liquidity, governance, supervision, disclosure, resolution planning and ethical accountability.

10. Best-Practice Framework for Banking Institutions

A mature governance system should:

1. define a clear purpose and risk appetite;
2. align strategy, capital, liquidity and incentives;
3. assign explicit ownership under the three-lines model;
4. provide the board with concise, forward-looking information;
5. empower independent risk, compliance and internal-audit functions;
6. use stress testing and scenario analysis to challenge plans;
7. monitor concentrations and interconnected risks;
8. reward sustainable performance rather than short-term volume;
9. protect challenge, escalation and whistleblowing;
10. investigate incidents for both individual and systemic causes; and
11. review culture, technology and third-party dependencies continuously.

These practices should be proportionate to the institution’s size, complexity and systemic importance. Proportionality does not mean exemption from sound principles; it means applying them in a way that is appropriate and effective.

Chapter Summary

Banking regulation and governance create the institutional conditions for responsible risk-taking. The Basel framework combines minimum prudential requirements under Pillar 1, supervisory review under Pillar 2 and market discipline through Pillar 3 disclosure. Capital and liquidity ratios are essential indicators, but they cannot capture every concentration, model, conduct or cultural risk.

The three-lines model allocates ownership to business management, challenge and monitoring to risk and compliance, and independent assurance to internal audit. Boards set strategy, appetite and oversight expectations, while senior management converts them into limits, processes, systems and incentives. Risk committees and audit committees require clear mandates, expertise and decision rights.

Fiduciary duties and ethical conduct require more than formal compliance. Incentives must account for delayed losses, capital, liquidity, conduct and long-term outcomes. Risk culture is expressed through actual behaviour: whether bad news is escalated, whether challenge is welcomed and whether leaders accept accountability. Effective governance is therefore a continuous process combining regulation, professional judgment, transparency and ethical leadership.

Key Terms

Basel framework: International prudential standards developed by the Basel Committee.

Pillar 1: Basel requirements for minimum capital and related prudential measures.

Pillar 2: Supervisory review of risks, governance, capital and liquidity adequacy.

Pillar 3: Public disclosure intended to support market discipline.

Risk-weighted assets: Assets and exposures adjusted according to regulatory risk characteristics.

Common Equity Tier 1: High-quality regulatory capital primarily comprising common equity and retained earnings.

Leverage ratio: A non-risk-based ratio comparing Tier 1 capital with a broad exposure measure.

Liquidity Coverage Ratio: A short-term liquidity resilience measure based on liquid assets and stressed net cash outflows.

Net Stable Funding Ratio: A structural funding measure comparing stable funding available with stable funding required.

ICAAP: Internal Capital Adequacy Assessment Process.

Three-lines model: A framework distinguishing business ownership, second-line challenge and third-line independent assurance.

Risk appetite: The amount and type of risk an institution is willing to accept in pursuing its objectives.

Fiduciary duty: A legal duty of loyalty, care, good faith or related responsibility arising from entrusted authority.

Conduct risk: The risk of harm arising from inappropriate behaviour toward customers, markets or other stakeholders.

Malus: Reduction or cancellation of deferred compensation before it vests.

Clawback: Recovery of previously awarded compensation under specified conditions.

Risk culture: Shared values and behaviours that influence how an organization understands and manages risk.

Operational resilience: The ability to continue important services within acceptable limits during disruption.

Model risk: The risk of loss or poor decisions arising from model errors, misuse or limitations.

Review Questions

Short Answer Questions

1. What are the three pillars of the Basel framework?
2. Why is the leverage ratio used as a backstop to risk-based capital requirements?
3. What is the primary responsibility of the first line in the three-lines model?
4. How does malus differ from clawback?
5. Identify two observable indicators of a healthy risk culture.

Long Answer Questions

1. Explain how Pillar 1, Pillar 2 and Pillar 3 complement one another, and discuss why none is sufficient alone.
2. Evaluate the responsibilities of a bank’s board and senior management in implementing risk appetite.
3. Discuss the independence, role and limitations of internal audit.
4. Analyse how fiduciary duties and ethical conduct extend beyond technical compliance with regulation.
5. Explain how compensation systems can encourage excessive risk-taking and propose safeguards.

Analytical / Application Questions

1. A bank reports strong capital ratios but has rapidly increasing exposures to one property sector. Using Basel pillars and governance principles, design a supervisory and board response.
2. A chief risk officer is formally independent but cannot attend board risk-committee meetings without management approval. Assess the governance implications and recommend changes.
3. Employees rarely report incidents, while management claims that this proves the bank has an excellent culture. Critically evaluate this conclusion and propose a broader culture-assessment approach.

Multiple Choice Questions with Answers

Question 1

Which Basel pillar is primarily concerned with public disclosure and market discipline?

A. Pillar 1

B. Pillar 2

C. Pillar 3

D. The resolution pillar

Correct Answer: C. Pillar 3

Question 2

In the three-lines model, who owns the risks created by business activities?

A. The first line, consisting of business and operational management

B. The external auditor

C. The board risk committee alone

D. The central bank supervisor

Correct Answer: A. The first line, consisting of business and operational management

Question 3

What is the principal purpose of the leverage ratio?

A. To replace all liquidity requirements

B. To provide a non-risk-based backstop to risk-weighted capital measures

C. To measure customer satisfaction

D. To calculate expected credit losses

Correct Answer: B. To provide a non-risk-based backstop to risk-weighted capital measures

Question 4

Which action best reflects effective Pillar 2 supervision?

A. Reviewing only the bank’s published annual report

B. Assessing governance, stress testing, capital planning and risks not fully captured by minimum ratios

C. Setting employee sales targets

D. Approving every individual loan

Correct Answer: B. Assessing governance, stress testing, capital planning and risks not fully captured by minimum ratios

Question 5

What is the primary role of internal audit?

A. To own operational controls

B. To originate profitable loans

C. To provide independent assurance on governance, risk management and controls

D. To set the bank’s risk appetite without board approval

Correct Answer: C. To provide independent assurance on governance, risk management and controls

Question 6

Which incentive feature is designed to reduce rewards for performance that later proves harmful?

A. Immediate payment of all bonuses

B. Malus or clawback arrangements

C. Removal of risk limits

D. Unconditional commission payments

Correct Answer: B. Malus or clawback arrangements

Question 7

Which statement best describes risk culture?

A. The number of pages in the risk policy manual

B. The shared values and behaviours that influence how risk is understood and managed

C. The bank’s regulatory capital ratio only

D. The external auditor’s annual opinion

Correct Answer: B. The shared values and behaviours that influence how risk is understood and managed

Question 8

Why may a high total capital ratio provide misleading comfort?

A. Capital ratios are never relevant to solvency

B. The ratio may contain lower-quality capital or fail to reflect concentrations and model limitations adequately

C. Capital is measured only in physical assets

D. High ratios automatically create liquidity risk

Correct Answer: B. The ratio may contain lower-quality capital or fail to reflect concentrations and model limitations adequately

Question 9

Which practice most directly supports effective board challenge?

A. Removing dissenting views from meeting papers

B. Providing concise forward-looking information and recording material challenge and follow-up

C. Allowing only the chief executive to ask questions

D. Delegating all oversight to external consultants

Correct Answer: B. Providing concise forward-looking information and recording material challenge and follow-up

Question 10

A bank’s employees report very few incidents. What is the most appropriate conclusion?

A. The bank definitely has an excellent risk culture

B. The bank definitely has ineffective controls

C. The result is ambiguous and should be assessed alongside reporting, survey, audit and conduct indicators

D. Incident reporting is unrelated to culture

Correct Answer: C. The result is ambiguous and should be assessed alongside reporting, survey, audit and conduct indicators