My name is Evgeny Telenkov. I have worked in risk management for more than 15 years, in technology companies, industry and banking. For a time I built the risk management system at one of the Sber group companies and saw up close how risk management works at the parent bank. It is a living, working system, far from box-ticking and rules gathering dust on a shelf. Below are its three pillars.
The short answer to the question that most often brings people here: a risk appetite statement in a large bank is a document approved by the supervisory board with numeric boundaries per risk type — capital adequacy, credit and market risk limits, liquidity, acceptable operational losses, cyber risk metrics. The boundaries cascade into limits for business units, and any breach is reviewed by the audit and risk committee. How the same thing works in an ordinary company, and how to formulate an appetite in a single meeting, is covered in risk appetite.
1. Operational risk and fraud prevention, backed by numbers
The first thing that surprised me was how thoroughly the bank manages operational risk, in particular fraudulent transactions. The bank does more than just “fight fraudsters”. Fraud risk is assessed in numbers, and protective measures are justified through risk management: this is what the losses would be without this system, so the investment in it is justified.
The calculation covers direct financial losses and also reputational risks and customer safety. The situation is assessed as a whole, and not as one line in a report. The system works with real incidents: data on fraud cases are collected, including from independent sources. If a risk materialises, a chain starts: “root cause analysis → reporting → strict monitoring of how the team has implemented the fixes and reduced the risk”.
2. The CRO's role: risk management as an equal partner of the business
In many companies, risk is a function inside the finance unit, reporting to the CFO. At Sber it is different: the Chief Risk Officer (CRO) reports directly to the CEO. This means risk is an equal voice at the decision-making table. It is not a support function that comes “after the business”.
The CRO has a large team (across the group about a thousand people work on risk) and the full range of risks: credit, market, operational, model and ESG risks. The high status lets the CRO influence strategy, deals, processes and products, but the CRO also has their own accountability and KPIs. The key point: the CRO says “yes” or “no” because they understand how the decision will affect resilience and profit, and not because “that is what the methodology says”.
3. Cyber risk is managed at every level
For cyber risk there are quantitative metrics and a risk appetite statement: clear boundaries that must not be crossed. This makes it possible to act within the strategy instead of fighting every threat blindly. Product teams build cyber risk measures straight into the products. The effectiveness of protection is checked by independent auditors and regular tests, both internal and with external experts.
If an incident does happen, it is documented and investigated, and the results are reported to the highest level, the audit and risk committee. Responsibility for cybersecurity is assigned to every employee, from intern to member of the management board.
What an ordinary business can take from this
A mid-sized business works at a different scale, but the principles carry over in full:
- Risk takes part in decisions and does not act as a “brake”. Give risk a voice at top-management level instead of hiding it in the finance department.
- Measure risk in money. Justify protective measures by the losses they prevent. Owners understand this language.
- Set your risk appetite. Define the boundaries within which you are willing to take risks, so that you do not react to everything.
- Review incidents. Every failure gets a root cause review and a check of the fixes. It is not something to “hush up”.
Mature risk management is an environment where both stability and growth are possible. It is not bureaucracy.
Frequently asked questions
What is a CRO, and how does the role differ from that of a CFO?
A CRO (Chief Risk Officer) is the head of risk. In a mature model, the CRO reports directly to the CEO, is responsible for all types of risk, not only financial ones, and takes part in strategic decisions on an equal footing with the business.
What is risk appetite?
It is a set of boundaries, defined in advance, within which a company is willing to take risk to reach its goals. A risk appetite statement helps you set priorities instead of reacting blindly to every threat.
Does this apply to small and mid-sized businesses?
Yes, in a simplified form. You do not need a thousand people. You need principles: a voice for risk in decision-making, risk assessment in money, clear risk limits and incident reviews.
From the risk register to management decisions
Check whether your risks reach the people who make decisions. The dashboard shows the status on one screen; the turnkey system makes it work in practice.
