Whilst looking at the various parties that have an opinion on risk in financial institutions, it is clear that many rules are in place to control these risks. However, in many cases these rules consider only one aspect of a financial institution. In contrast, risk frameworks look at financial institutions, or even systems, as a whole and try to manage all of these risks in a consistent manner. There are three broad types of risk framework:

1. • mandatory

2. • advisory

3. • proprietary

Mandatory risk frameworks must be followed in order for an organisation to carry out some types of business. However, they often have features that are useful to a wider range of institutions. Advisory risk frameworks offer guidelines for firms wishing to set up their own risk management framework. These are usually generic whichmeans that they can be used for many different types of organisation, but also that a considerable amount of work must be carried out to tailor them to specific institutions. Finally, there are proprietary risk frameworks. These are frameworks used by firms for some specific purpose, the most common of which is credit rating.

All of the risk frameworks covered here are comprehensive, covering a range of risk types for an organisation. This is what differentiates a framework from a more narrowly-focussed code.

Mandatory Risk Frameworks

Mandatory risk frameworks are those that must be complied with by firms working in particular industries. Two of the most important – and relevant – are Basel II and Solvency II. The former is concerned with solvency in the banking sector, whilst the latter deals with the insurance industry.

The Basel Accords

The Basel Accords constitute the global risk framework designed to promote stability in the banking sector. They are published and updated by the Basel Committee on Banking Supervision (BCBS), which was established in 1974 by the governors of the central banks of the Group of Ten (G10) countries under the auspices of the Bank for International Settlements (BIS). It has no formal supranational authority and merely recommends statements of best practice. However, these recommendations are taken up by not just by regulators in G10 countries, but also by those in other countries, although the exact implementation can differ substantially from country to country.