What best defines risk appetite creep?

What best defines risk appetite creep?

• A. Sudden, large leaps in risk beyond approved appetite; prevented by monthly audits.
• B. Gradual expansion of risk beyond approved appetite; prevented by regular appetite reviews, clear governance, and escalation protocols.
• C. A temporary tolerance for risk during crisis; prevented by outsourcing risk.
• D. A shift in risk appetite caused by external regulation; prevented by reducing risk.

Answer: (B)

Risk appetite creep is the gradual expansion of risk beyond what has been approved, occurring as decisions slowly exceed the stated appetite without formally updating it. This happens through small, ongoing relaxations in risk controls or approvals that accumulate over time, so the organization ends up taking more risk than intended without recognizing it at the oversight level. The way to prevent it is through regular appetite reviews, clear governance, and escalation protocols that ensure any shift in risk levels is challenged, documented, and approved by the board or risk function before it becomes embedded. An abrupt jump in risk would be a different pattern, typically not caught by routine governance and often described as a breach rather than creeping expansion. A temporary crisis tolerance or outsourcing of risk also describes distinct situations that don’t capture the slow, incremental nature of appetite creep. External regulation shifting risk levels is a separate cause and usually requires different controls.

Risk appetite creep is the gradual expansion of risk beyond what has been approved, occurring as decisions slowly exceed the stated appetite without formally updating it. This happens through small, ongoing relaxations in risk controls or approvals that accumulate over time, so the organization ends up taking more risk than intended without recognizing it at the oversight level. The way to prevent it is through regular appetite reviews, clear governance, and escalation protocols that ensure any shift in risk levels is challenged, documented, and approved by the board or risk function before it becomes embedded.

An abrupt jump in risk would be a different pattern, typically not caught by routine governance and often described as a breach rather than creeping expansion. A temporary crisis tolerance or outsourcing of risk also describes distinct situations that don’t capture the slow, incremental nature of appetite creep. External regulation shifting risk levels is a separate cause and usually requires different controls.