sabine lautenschlager : good governance and the role of supervisory boards speech by ms sabine lautenschlager, member of the executive board of the european central bank and vice - chair of the supervisory board of the european central bank, at the luncheon of chairs of supervisory boards of banks in germany, frankfurt am main, 6 november 2018. * * * what must a bank be able to do? as always, the answer depends on whom you ask. bankers or bank shareholders are likely to say that a bank must be able to make a profit. but as a supervisor i would tell you that a bank must be able to manage its risks. these answers do not contradict each other. a bank that can ’ t make a profit will fail, as will a bank that does not properly manage its risks. so the real question is what each of us should focus on. what ’ s the focus of supervisory boards? what do you yourselves focus on? in a sense, you are caught between two stools. on the one hand, you are bankers. on the other hand, you are also supervisors. supervisory boards play a major role in managing risks. they contribute to the checks and balances that every bank needs. they are a core element of good governance. and we have high expectations of you and of what you can do to make your bank more resilient. we expect supervisory boards to assess and oversee the work of management bodies – independently and thoroughly. most of all, they have to ensure that strategic decisions are always based on a sound analysis of risks. in this regard, you serve as the management ’ s good conscience. in a nutshell, this is what supervisory boards should do. whether they really do it, whether they are able to do it, depends on many things. it depends on individuals and it depends on structures. those who chair a board, who are members of board committees or who interact with internal control functions need to be available and possess the right knowledge and experience, not only to meet today ’ s needs but also tomorrow ’ s challenges. in our view, supervisory boards still have some room to improve, particularly with regard to their collective knowledge. assessing and overseeing management bodies requires ever more technical knowledge. just think of digitalisation and it, of internal models or new rules. while no one expects every individual board member to be an expert in all of these areas, the collective knowledge of the board needs to be well - balanced. and it

. but it ’ s not the only element. the frame that a bank builds around the risks it takes – the risk appetite framework – is equally important. the risk appetite framework comprises the principles, processes, internal controls and systems, as well as the responsibilities and the limits of material risks that the bank wants to take on or has already taken on. and, of course, the supervisory board plays an important role in building a sensible risk appetite framework. over the past few years, banks have made good progress in designing their risk appetite frameworks. still, there is scope for improvement. even though risk appetite frameworks now cover many more types of risk, one category is often overlooked : non - financial. reputational risks, it risks or legal risks are often either not covered at all or just in part. i know that it ’ s difficult to measure these risks, but neglecting them is no solution either. once the risk appetite has been defined, risk limits play a major role. they ensure that the risks taken are in line with the risks defined ; they make the risk appetite operational. it is important that banks break down these limits by business lines, entities or countries. not all banks do that. and when they do, the local limits are not always consistent with those at the consolidated level. this is something banks need to work on. another problem is that banks often set the limits so high that they are no of help in steering risk taking. it is obvious that this puts the entire risk appetite framework in question. building a sensible risk - appetite framework is not that easy. and it ’ s not enough to just build one ; 2 / 3 bis central bankers'speeches it also has to be applied. that ’ s the crucial point. banks must turn the risk appetite framework into a key element of their risk culture and their decision - making. what does that mean? it means that all parts of risk management must be precisely aligned to each other – including the risk appetite frameworks. and they must be aligned to the rest of the organisation as well. what good is a well - defined risk appetite if the remuneration schemes set different incentives? what good is a well - defined risk appetite if it ’ s not finely - tuned to the business model or the business strategy? in our view, too many banks still see their risk appetite framework as a separate tool. it is not. it must become an integral part of decision - making. most banks do not use the defined risk