Look the risk in the face and decide how much of it you want – that’s the core of risk appetite. For that reason, setting a risk appetite for climate risk first requires banks to comprehend the nature, scale and complexity of the risk, which the PRA argues is greater than firms are used to modelling and managing. The starting point is acknowledging that climate risk is systemic; to varying extents it will “affect every customer, every company, in all sectors of the economy and across all geographies.”¹ Only once the scale and nature of the risk has been grasped can a bank compare actual exposure to the level of risk it’s comfortable accepting. Rudimentary quantification (e.g., exposure to the oil and gas sector, proportion of mortgage book built on flood plains) is not even close to the level of awareness the PRA envisages. Instead, firms will need to invest in cutting edge techniques to develop their understanding of their climate risk profile.

They should clearly articulate the transmission channels through which physical and transition risks are likely to impact more established risk types, as well as the likely effects on future revenues and profitability.

To set risk appetite limits, the PRA expects firms to undertake climate scenario analysis (CSA), reverse stress testing and sensitivity analysis, including analysis of tail risks. A bank should understand what losses are associated with a “wide range” of plausible yet extreme scenarios and over a range of different time horizons.¹ Those exercises will help the bank grasp where its material concentrations lie and under what circumstances such losses would threaten the resilience of the business model.

To maximise the insightfulness of results, banks should use conceptually sound CSA models that are supported by relevant (and published) scientific, technical and economic research. The models should allow for the possibility of non-linearity and tipping points as well as second order and compound risks. They should also consider the possibility of negative price shocks and the emergence of new correlations when looking at climate risk’s impact on market risk quantification.

An important component of ‘conscious risk taking’ is being aware of model limitations. Here, the PRA highlights the need for firms to understand the weaknesses of models or data and to account for them in how model outputs are both interpreted and used as inputs for risk appetite setting. ‘Conscious risk taking’ also implies that bank personnel will have the right skills and training to generate, interpret and challenge the calculation of climate risk exposure.

Risk appetite has always been intended to generate an enterprise-wide understanding of aggregate risk exposure. To that end, the PRA suggests climate risk appetite setting will need to be based on:

• the full range of material risks and climate risk interactions (including credit, market, liquidity, operational resilience, reputation, litigation and third-party risks);
• the entirety of business operations that generate climate risk exposures (clients, counterparties, investees, policyholders);
• a range of climate scenarios combined with transition pathways that reflects our current uncertainty;
• an appropriate range of time horizons (since climate change operates outside traditional short-term planning cycles);
• a comprehensive view of relationships that looks at clients’ climate transition plans, the vulnerability of their supply chains and their reliance on emerging technologies; and
• IT systems that can collect and aggregate reliable and accurate climate-related risk data as part of the firm’s overall data governance and infrastructure.

The ultimate aim of risk appetite has always been to control the types and amounts of risk that accumulate on a firm’s balance sheet. When a firm detects that exposure is moving beyond an acceptable range, it should be willing and able to: (1) take corrective action, thereby avoiding a breach of risk appetite; or (2) refine risk appetite if there has been a genuine change in circumstances.

The PRA’s views on climate risk appetite fully align with this approach. Having understood the impact of climate-related risks on a firm, the PRA expects the board “to be able to address these risks effectively within the firm’s overall business strategy and risk appetite.”¹ Not only should there be climate-specific risk appetite statements to give top-down direction on risk taking, risks should also be categorised (for example, as accept, manage or avoid) with quantitative limits set on risk exposures to be managed and exclusion policies to specify those to be avoided.

With respect to climate-related risk appetite reporting, the point is to give the board enough insightful and timely information so it can “discuss, challenge and make decisions relating to the firm’s management of these risks and its climate-related strategy.”¹ This last point is important as the PRA envisages that the climate risk appetite metrics and triggers should achieve two control objectives for a firm: (1) assess whether they are within their set risk appetite; and (2) monitor progress against their climate-related strategy.

The PRA’s considerations regarding consistency and coherence are both detailed and fine-tuned:

• The treatment of climate risk should be aligned to how other risks are managed, meaning firms should “utilise existing tools and risk management techniques commonly used for other risk types”¹.
• There should be consistency between the firm-wide view of risk appetite and the business-line view – with adjustments made where necessary.
• Risk appetite setting should acknowledge that climate risks will manifest in either physical or transition risk (but never in neither) – so a scenario with lower physical risk will be one with higher transition risk.
• At least one of the climate scenarios considered should be consistent with the climate targets applicable in the jurisdiction relevant for the firm’s exposures.
• If the firm has adopted a climate goal or target, it should be able to demonstrate to the PRA how its plan to meet those goals or targets is integrated into overall strategy.
• Firms should use consistent risk assessments across material relationships with clients, counterparties, investees and policyholders.
• Those assessments should verify the degree of alignment between the climate transition plans of the bank and of its clients, counterparties, investees and policyholders.

As with the Final guidelines on the management of ESG risks published by the European Banking Authority (EBA), the PRA suggests climate risk appetite will be a central focus of its climate risk management scrutiny. However, unlike the EBA, the PRA has few suggestions for how firms might turn a qualitative expression of appetite into a quantitative set of measures (aka: “the calibration problem”).

That said, board setting of risk appetite limits should be informed by an analysis of the losses associated with a range of climate stress scenarios – using a variety of possible calibrations from “plausible central case” to “severe but plausible tail risks.”¹ Sensitivity analysis should be used to understand the materiality of model choice and calibration.

As for time frame, the PRA refrains from definitions but does offer practical guidance: calibrate horizons to business model, nationally-relevant net zero targets, maturities/run-offs of loans/policies, and business model adaptation timescales – all of which suggests that firms would do well to consider far longer horizons than a typical credit or economic cycle.

Firms should also define a climate risk appetite hierarchy, with firm-wide appetite set by the board and business-line appetite reflecting material risks identified for each business line. Both sets of appetite should be subject to quantitative calibration.

On the topic of business-line appetite, the PRA noted that few firms’ climate-risk appetites are effectively cascaded from the board to business lines, let alone supported by any framework of risk metrics or limits. This is our impression too. Yet a proper cascade is foundational to a well-run risk appetite framework. It’s hard to imagine how a risk appetite framework could work unless it achieved effective cascade.

Unsurprisingly, the PRA expects the board to own and set overall climate risk appetite (as it does for every other material risk), and this should be based on analysis presented by the risk management function and shared across the organisation. Adherence to risk appetites should be supported by quantitative risk metrics and limits and there should be a two-way feedback process between firm-wide and business line risk appetites to ensure consistency and identify where things need adjusting. Business-line specific climate risks (where material) should be considered by business line management and their independent risk management functions and reflected in business line risk appetite statements.

The smooth functioning of a bank’s risk appetite is a central focus of supervisors when assessing the calibre of risk management. The PRA is careful to set out that its proposals are “supervisory expectations” rather than “rules for banks and insurers to follow”¹ but the distinction may be missed in practice. The regulator also notes that both climate risks and the methods used to quantify and manage them are evolving rapidly – therefore, any assessments of materiality, concentrations or overall risk appetite should be revisited on a regular basis, with the board ensuring mechanisms are in place to achieve that end.