Supporting banks in responding to challenges related to internal governance, risk governance and risk culture.
Governance & Risk Culture
Introduction
For many years, supervisors have emphasised the importance of internal governance and have assessed banks’ governance and organisational arrangements as part of the annual Supervisory Review and Evaluation Process (SREP). Their findings have not always been satisfactory. This is reflected, for example, in the comparatively weak European Central Bank (ECB) SREP scores for governance, with four out of five banks receiving a score of 3 or 4.
In 2024, the ECB published a draft guide on governance and risk culture, highlighting common deficiencies and observed best practices in governance, risk culture, and risk appetite. Following the release of revised European Banking Authority (EBA) Internal Governance Guidelines in 2025, the ECB will provide a “best practices document”, demonstrating that governance and risk culture remain a key area of ECB supervisory focus.
Challenges you might be facing
- Management Bodies
- Risk Appetite
- Risk Culture
- OSIs
Management Bodies
The effectiveness and functioning of management bodies, both in management and supervisory function, is one of the most frequent points of criticism in the ECB’s SREP. The ECB has stipulated a number of expectations with that regard, including practices and organisation, interaction with committees and documentation of meetings.
Risk Appetite
The ECB regards risk appetite as “a cornerstone of a sound governance framework”. Banks are expected to formalise their risk appetite to establish consistency and maintain a holistic view of their risk profile. Risk appetite should be aligned with the budget, Internal Capital Adequacy Assessment Process (ICAAP), Internal Liquidity Adequacy Assessment Process (ILAAP), recovery plan, and remuneration framework; embedded in decision-making; and monitored, presented, and discussed by the management body.
Risk Culture
Often, the ECB starts to question a bank’s risk culture when deficiencies in other risk or governance areas become evident (e.g. as a result of the SREP or onsite-inspections ( OSIs)). As a minimum, the ECB expects banks to define their risk culture and values, as well as monitoring and measuring adherence to it. This is best achieved by setting up a formalised risk culture framework, by performing annual risk culture surveys as well as by defining and monitoring risk culture key performance indicators (KPIs).
OSIs
Governance is not only one of the assessment areas of the SREP but is also frequently evaluated in-depth by the ECB in on-site inspections. In the past, we have seen many OSIs focusing holistically on governance. Recently, however we observe a slightly shifting focus that is taking account of specific governance aspects, such as risk culture.
How we can help
PwC has supported numerous banks in various Governance & Risk Culture related projects.
As a leading consulting firm, we can work closely with your organisation to deliver high-quality outcomes across all aspects of Governance & Risk Culture. We can also advise on value-adding initiatives, identify areas requiring enhancements, and support clients on ensuring compliance with regulatory requirements.
We can assist you with the following topics:
- Organisational structure, responsibilities and suitability
- Functioning and effectiveness of management bodies (including committee setup, fit & proper requirements) and internal control functions
- Adequacy of internal policies and guidelines
- Consistency of the risk management framework (including strategies, policies, methodologies and reporting)
- Setup of risk appetite frameworks and alignment of risk appetite to business projections, limit setting
- Monitoring of risks
- Setup of risk culture frameworks
- Structuring and conducting annual risk culture surveys
- Establishing and monitoring risk culture KPIs
