Risk Culture & Risk Strategy Development

Risk culture describes the totality of norms, attitudes, and behaviors that shape risk awareness and risk handling within an organization. MaRisk (AT 3) requires management to develop, promote, and integrate an appropriate risk culture across all levels. BaFin emphasizes that risk culture is not a side issue but must permeate the daily thinking and actions of all employees. The 9th MaRisk amendment 2026 further tightens these requirements.

A Risk Appetite Statement (RAS) defines the type and extent of risks an institution is willing to take to achieve its strategic objectives. It derives from the business strategy and includes quantitative metrics (capital ratios, VaR limits, concentration thresholds) and qualitative guidelines (reputational risk tolerance, compliance principles). The RAS bridges business strategy and risk strategy and is approved by the executive board and endorsed by the supervisory board.

Risk strategy is the overarching document defining objectives, principles, and measures of risk management, consistent with business strategy per MaRisk AT 4.2. Risk appetite is a subset that quantifies how much risk the institution is willing to accept. The Risk Appetite Framework (RAF) operationalizes risk appetite through limits, thresholds, and escalation mechanisms. The risk strategy contains risk appetite but also governance, processes, and reporting channels.

Measurement covers three dimensions: First, quantitative indicators such as risk report escalations, limit breaches, compliance violations, and whistleblower reports. Second, qualitative assessments including structured leadership interviews, tone-from-the-top analysis, and decision process observation. Third, employee surveys on risk awareness perception, psychological safety, and error handling. ADVISORI uses a proprietary risk culture assessment approach with benchmark comparison.

Under MaRisk, the board bears overall responsibility for risk culture. It must actively demonstrate it (tone from the top), define the risk strategy, and monitor its implementation. This means: regular communication on risk appetite, incorporating risk considerations in strategic decisions, fostering an open error culture, and including risk behavior in performance evaluations. BaFin explicitly examines board involvement in risk management during SREP assessments.

The 9th MaRisk amendment, consulted in April 2026, tightens requirements for risk strategy and culture. New focus areas include: stronger integration of ESG risks into risk strategy, expanded requirements for risk data management, deeper specifications for risk culture across all organizational levels, tighter requirements for business model analysis, and heightened expectations for IT governance in risk management. Institutions must review and adapt their existing strategies promptly.

Typical project budgets range from EUR 80,000 to 250,000 depending on institution size and maturity. The scope includes risk culture assessment (four to six weeks), risk strategy development including risk appetite statement (six to ten weeks), and implementation support with change management (eight to twelve weeks). ADVISORI offers modular packages from risk culture quick checks through complete strategy development to ongoing support for cultural anchoring.