The Global Risks Alliance (GRA)
Many bank failures trace back to governance: boards that did not understand the risks being taken, incentives that rewarded growth over prudence, or control functions without the standing to challenge. This page sets out how governance, risk culture and internal control shape a bank's risk, how supervisors assess them, and how recovery and resolution planning add a final safeguard when governance fails.
GRA · Established · service level R0
Bank governance is the system by which a bank's board directs and controls its risk-taking. Many failures trace to boards that did not understand the risks taken, incentives that rewarded growth over prudence or control functions without standing to challenge. Supervisors assess governance in the SREP and expect risk data aggregation under BCBS 239.
For bank governance, in GRA's spatial-finance reading, the map opens on population density and night lights with built-up and settlement extent from NASA GIBS, framed on Western Europe; every other NASA layer, live feed and forecast waits in the layer list.
The interactive map needs JavaScript; the layer list and sources are below.
Layers 2
People and hazards, for this page
Keyboard, with the map focused
Hold Ctrl or ⌘ and scroll to zoom
Latest available
NASA GIBS / EOSDIS · ASTER GDEM (METI, NASA) · Blue Marble (NASA) · © OpenStreetMap contributors (ODbL) · Natural Earth
Loading the latest NASA imagery.
Drag to move. Ctrl or ⌘ and scroll, pinch or the buttons to zoom; hover for the values under the pointer; reset returns to the region.
For bank governance, in GRA's spatial-finance reading, the map opens on population density and night lights with built-up and settlement extent from NASA GIBS, framed on Western Europe; every other NASA layer, live feed and forecast waits in the layer list.Satellite and model products as NASA publishes them, each with its own date; indicators, not assessments of any place; claim ceiling INTEGRATED.
Layers and dates
The working screen behind this subject: its structure, terms and states. Names are placeholders and values illustrative.
Bank governance · Bank B · Reporting date Q1
% of RWA vs requirement and buffers
% vs minimum
Boards, risk culture and controls. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
The board approves strategy, risk appetite and senior appointments. Without the expertise and information to challenge management, it cannot see when risk-taking drifts beyond the appetite it set.
Remuneration tied to short-term revenue encourages risk-taking whose costs appear later. Deferral, malus and clawback aim to align pay with the risk outcome as it is realised.
Risk management, compliance and internal audit form the second and third lines of defence. Their effectiveness depends on independence, resources, data and direct access to the board.
Norms about speaking up, escalating problems and respecting limits decide whether small breaches are corrected or accumulate. Weak risk culture often precedes misconduct and large losses.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Three lines of defence | A model separating business units, risk and compliance functions, and internal audit in a bank's control system. |
| BCBS 239 | The Basel Committee principles for effective risk data aggregation and risk reporting. |
| Malus and clawback | Arrangements that reduce or recover variable pay when risks or misconduct come to light. |
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Board members with banking or risk expertise | share of board | annual | Governance disclosures | DECLARED |
| Independent directors | share of board | annual | Governance disclosures | DECLARED |
| Risk appetite limit breaches | count by severity | quarterly | Risk reporting to the board | REPORTED |
| Variable remuneration subject to deferral | percent of variable pay | annual | Remuneration disclosures | DECLARED |
| Internal audit findings past due date | count by rating | quarterly | Internal audit reports | REPORTED |
| Supervisory assessment of internal governance | SREP score for internal governance and risk management | annual | Supervisory review | OFFICIAL |
| Conduct and misconduct costs | currency units | annual | Financial statements and enforcement records | REPORTED |
The topic as a computational graph: named sources feed the methods, an evidence review gates the outputs, and the decisions stay with the authorities that hold them.
Fig. 02Nodes carry their type, two metric rows and a state; connectors show what feeds what; dashed frames name the owners; the timeline is the cadence. Design of the pipeline, not a record of a run.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| BCBS Corporate governance principles for banks | Standards for boards, risk governance, compliance, audit and remuneration | Free, BIS terms of use |
| EBA Guidelines on internal governance and on SREP | Supervisory expectations and assessment methodology for governance | Free, attribution |
| ECB supervisory priorities and aggregate SREP results | Thematic findings on governance and risk data aggregation | Free, attribution |
| FSB guidance on supervisory interaction with financial institutions on risk culture | Indicators supervisors use to assess risk culture | Free, attribution |
| Bank annual reports and Pillar 3 remuneration disclosures | Board composition, remuneration and risk governance arrangements | Public, bank terms |
| Supervisory enforcement records | Published sanctions for governance and conduct failures | Public, authority terms |
Banking Nexus prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Bank board and nomination committee | Whether board skills, independence and information are adequate for the bank's risk profile | Board effectiveness reviews, skills matrices and risk reports |
| Board remuneration committee | How to structure variable pay, deferral and malus to reflect risk | Risk-adjusted performance, conduct outcomes and regulatory requirements |
| Prudential supervisor | Whether governance weaknesses warrant Pillar 2 measures, fit and proper action or restrictions | SREP governance assessment and inspection findings |
| Resolution authority | Whether a bank is resolvable and which impediments it must remove | Resolution plans, recovery plan quality and operational continuity arrangements |
Whether directors have the expertise and information to challenge management.
How remuneration and performance measures affect risk-taking.
Whether risk management, compliance and internal audit are independent and effective.
How climate, cyber, AI and third-party risks are brought into governance.
The three lines model separates business units that own risk, risk and compliance functions that oversee it, and internal audit that provides independent assurance. Its effectiveness depends on the authority and independence of the second and third lines.
Incentives shape behaviour. Remuneration tied to short-term revenue can encourage risks whose costs appear later. Deferral, clawback and risk adjustment aim to align pay with long-term outcomes.
Risk culture is the set of norms that determine whether people raise concerns and whether leaders listen. Failures often follow cultures where challenge was unwelcome.
Board composition matters. Directors with relevant expertise and independence from management are better placed to challenge strategy and risk appetite.
Emerging risks test governance. Boards must understand technology, climate and third-party dependencies that did not feature in traditional banking expertise, and decide how much reliance to place on management information they cannot easily verify themselves.
| Method or data | What it shows | Its limit |
|---|---|---|
| Governance reviews | Structures and practices | Form may differ from substance |
| Culture surveys | Attitudes to risk and speaking up | Social desirability bias |
| Failure case studies | Governance causes of past failures | Hindsight bias |
| Comparative research | Governance and outcomes across banks | Causality hard to establish |
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.