Maintain Risk Appetite Statement + Risk Limits + Concentration Risk Management + Limit Breach Protocols per 12 CFR Part 30 Appendix D Sections II.E + II.F + II.G + II.H + II.I + II.K. Risk Appetite Statement per Section II.E must (a) be a written statement of aggregate risk the covered bank is willing to accept in pursuit of strategic objectives + with qualitative and quantitative components, (b) cover all material risk categories per the Risk Governance Framework, (c) include forward-looking elements addressing the planning horizon and stress scenarios, (d) be approved by the Board + reviewed at least annually + revised after significant change. Risk Limits per Section II.F must (a) be quantitative and qualitative limits cascading from the Risk Appetite Statement to business unit + product + portfolio + risk category granular limits, (b) be approved by management and the Board as appropriate to materiality, (c) be reviewed at minimum annually. Risk Appetite review and monitoring per Section II.G must operate continuously with periodic reporting to the Board. Limit breach processes per Section II.H must (a) define escalation thresholds + escalation paths + decision authority + remediation timelines, (b) document breach occurrences + root causes + remediation + lessons learned, (c) inform Risk Governance Framework + Risk Appetite Statement updates. Concentration Risk Management per Section II.I + II.F.2 must (a) identify concentrations by counterparty + sector + geographic + product + collateral type + funding source + similar, (b) set concentration limits + monitor + escalate breaches, (c) integrate with capital and liquidity planning + stress testing. Relationship of risk appetite to other processes per Section II.K must ensure risk appetite drives capital planning + strategic planning + new product approval + compensation design.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.