Looking away from a risk is a decision that needs an owner

A decision to look less closely at an area is a risk decision, and it needs a named owner and a date. Where nobody records it, the budget round makes it instead, and nobody answers for the result.

Why the claim holds

Every risk function has areas it examines less than others. No team has the capacity to test every control, review every supplier and exercise every plan each year, so some areas will always receive less attention. The only open question is who chose which ones.

At the end of September 2026 a senior European supervisor put this on the record. Frank Elderson, Vice-Chair of the ECB Supervisory Board, told a conference of banking supervisors that the ECB has "consciously increased our supervisory risk tolerance" through a dedicated risk tolerance framework. He described the framework as clarifying how much residual supervisory risk can be accepted, and he stated that de-prioritisation "is not a passive outcome or a resource-driven omission" (Elderson, 2026). It is an active judgment, made within an institutional framework.

That is a supervisor describing its own practice, not a rule for banks. The principle carries over without change. A risk appetite statement usually says what the board wants to avoid. It seldom says where the institution has decided to accept more residual risk because it will look there less often. The international standard for risk appetite frameworks expects appetite to be expressed in a written statement and to be turned into limits that management can act on (Financial Stability Board, 2013). A limit tells people where to stop. It does not tell them where the institution has agreed to look away.

Without that second half, the choice still gets made. It is made by whichever area has the smallest budget, the least senior sponsor or the quietest owner. The result looks like prudence and works like neglect, because nobody decided it and nobody can be asked to defend it.

The strongest objection

A supervisor has a statutory mandate, a wide system of other safeguards around it and an explicit duty to use scarce resources well. A bank is in a different position. Writing down that it will look less closely at an area creates a document that an auditor, a regulator or a plaintiff can later read as an admission. Silence is safer than a record, so the sensible course is not to write it down.

That objection deserves weight. A written decision to accept more risk is more exposed than an unwritten one on the day it is discovered.

The answer

The exposure exists either way. The area was tested less, the people involved know it, and the first incident in that area will bring the question of who knew and who agreed. An institution with a record can show that the choice was made deliberately, against stated criteria, by a named person, with a date for review. An institution without one can show only that the area was neglected and that nobody took the decision.

A written choice can also be challenged and reversed before an incident instead of after it. The supervisor's own wording points the same way: it describes de-prioritisation as something done within a framework, which is what makes it defensible. Field observation, not research, suggests that the unwritten version is by far the more common one. The record does not need to be long. It needs the area, the reason, the residual risk accepted, the owner and the date it will be looked at again.

The carried fact

Pick the area your teams tested, reviewed or audited least last year. Then try to find the decision that put it there, with a name and a date beside it. If you can find it, the area is a choice. If you cannot, it is a gap that the budget created, and the next step is to give it an owner this month, whether or not the answer is to look more closely.

Where to read more

The related knowledge base answer on setting a tolerance to business harm, not to current capability, is at bazzi.ai under "setting-disruption-tolerances".

References

Elderson, F. (2026) Supervisory risk appetite, efficiency and effectiveness. Speech at the BCBS international conference of banking supervisors, Bali, 30 September. Frankfurt: European Central Bank. Available at: https://www.bankingsupervision.europa.eu//press/speeches/date/2026/html/ssm.sp260930~8b08062e83.en.html (Accessed: 11 October 2026).

Financial Stability Board (2013) Principles for an effective risk appetite framework. Basel: FSB. Available at: https://www.fsb.org/uploads/r_131118.pdf (Accessed: 11 October 2026).