The cost of poor risk management in Ghana is not hypothetical. It is quantified, documented, and written into the balance sheets of banks that no longer exist.
What Is Risk Management and Why It Is a Board-Level Responsibility
Risk management is involves identifying, assessing, prioritising, and controlling threats to an organisation’s capital, operations, reputation, and strategic objectives. The risk management meaning, at its core, is about making uncertainty governable; converting unknown exposure into known, bounded, and actively managed risk.
For boards in Ghana, this definition carries particular weight. Risk management is not a management function that the board receives reports on. It is a board-level accountability, one that determines whether the organisation survives downturns, satisfies regulators, retains investor confidence, and creates durable value.
The two risk categories that most directly test board oversight in Ghana are credit risk and operational risk. Both are real, present, and measurable. Both have broken institutions when boards failed to take them seriously.
The Risk Context Ghanaian Boards Are Operating In
Ghana’s financial sector has spent the better part of the last decade recovering from a governance and risk management failure of historic scale. The 2017–2019 financial sector clean-up saw the collapse of nine universal banks — institutions that held depositor funds, employed thousands, and served real businesses. The proximate cause in nearly every case was not market forces. It was board failure: failure to oversee credit risk, failure to enforce risk limits, and failure to hold management accountable for the quality of the loan book.
The consequences are still being felt. As of December 2025, Ghana’s NPL ratio stood at 18.9 percent, down from 21.8 percent in 2024, but the Bank of Ghana Governor acknowledged that despite the improvement, 18.9 percent remained high.
The Bank of Ghana has set a target NPL ratio of 10 percent by the end of 2026; an ambitious timeline that reflects the central bank’s commitment to restoring prudent lending standards and protecting depositors’ funds, with banks given clear timelines to reduce their NPL ratios toward the prudential benchmark.
That 10 percent target is not a background statistic. It is a board mandate. Institutions that do not close the gap through strengthened credit and operational risk management will face regulatory consequences with direct board implications.
Credit Risk Management: What Boards Must Own
Credit risk is the risk of financial loss arising from a borrower’s failure to meet contractual obligations. For financial institutions, it is the dominant risk category. For non-financial companies, it surfaces in trade receivables, supplier credit, and working capital exposure. In both cases, the board’s role is to set the framework, approve the appetite, and hold management accountable for outcomes.
What the Bank of Ghana Requires
The Bank of Ghana’s 2025 Guidelines on the Measurement and Management of Credit Concentration Risk effective January 2027, make board accountability explicit. Regulated financial institutions must have a documented board-approved credit concentration risk limit structure that reflects the institution’s risk appetite, with robust management information systems and processes to facilitate timely identification, aggregation, and reporting of credit concentration risk to senior management and the board on a regular basis.
This is not a technical requirement that can be delegated to the credit department. It requires boards to formally approve risk appetite parameters, receive regular concentration risk reports, and demonstrate active oversight, not passive receipt of management updates.
The Board Governance Gap in Credit Risk
Research specifically examining Ghanaian financial institutions found that the quality of board oversight is the critical variable in whether credit risk frameworks actually work. In the wake of Ghana’s 2017–2019 financial sector clean-up, analysis of failed banks revealed that board risk committee meetings were often “ceremonial,” with poor attendance and a rubber-stamp culture; allowing aggressive lending to connected parties and risky sectors to proceed unchecked. In contrast, surviving banks with active board risk committees were better at enforcing risk limits, thereby making their credit risk management systems effective.
The lesson is unambiguous: a credit risk policy without board enforcement is not risk management. It is documentation.
Research on listed banks in Ghana further found that the only significant dissimilarity between stated sound practices and actual credit risk management practice was the role of the board of directors in defining acceptable types of loans and maximum maturities for the various types of loans. Boards that are not actively engaged in setting these parameters are leaving a critical governance gap open.
What Effective Board-Level Credit Risk Management Looks Like
Boards with functional credit risk oversight share the following practices: approving a documented credit risk appetite statement with quantitative thresholds; receiving and interrogating NPL trend data at every board meeting; ensuring the board risk committee meets substantively, not ceremonially, with independent expert membership; setting explicit limits on concentration risk by sector, counterparty, and geography; and requiring management to present forward-looking credit quality projections, not only retrospective data.
As Ghana phases in Basel III capital buffers, credit standards must be paired with stricter credit screening, forward-looking provisioning, and transparent board oversight with region-wide banking integration under the African Continental Free Trade Area requiring Ghanaian banks to align risk models with peers in Nigeria, Kenya, and South Africa. Boards that are not building these capabilities now will be catching up under regulatory pressure.
Operational Risk Management: The Invisible Threat Boards Underestimate
Operational risk is the risk of loss resulting from inadequate or failed internal processes, people, systems, or external events. It is harder to quantify than credit risk, which makes it easier to underestimate, and more dangerous when it materialises.
Operational risk management (ORM) covers process failures, human error, fraud, technology breakdowns, cybersecurity incidents, third-party failures, and compliance breaches. For Ghanaian organisations, the operational risk landscape also includes infrastructure instability, regulatory change velocity, and the governance risks that arise from rapid digitalisation without matching oversight maturity.
What the Research Says About Ghanaian Banks
Research on the relationship between risk culture and operational risk management practices in Ghanaian banks found that the board of directors and senior management have a vital role in establishing and maintaining communication channels so that operational risk information flows vertically and horizontally throughout the organisation; with the two communication lines requiring top priority being communication between the board and senior management, and communication between the three lines of defence.
The three lines of defence model where business units own risk, risk and compliance functions oversee it, and internal audit provides independent assurance, only works when the board actively enforces the architecture. In institutions where the board receives only filtered information, operational risk failures accumulate silently until they become crises.
The Three Lines of Defence: A Board’s Operating Framework
The three lines of defence model provides the structural logic for operational risk governance. For Ghanaian boards, applying it means:
First line – business units own the day-to-day identification, assessment, and management of operational risks within their processes. The board sets the culture and appetite; management executes it.
Second line -the risk management and compliance functions monitor and challenge the first line, maintain the risk framework, and report to the board on aggregate operational risk exposure. This function must have direct access to the board, not be filtered through management.
Third line – internal audit provides independent assurance to the board that the first and second lines are functioning as intended. Independence is not optional here; it is the entire point.
Enterprise Risk Management: Connecting Credit and Operational Risk Into a Board-Level System
Credit risk and operational risk are related but distinct. The role of enterprise risk management (ERM) is to ensure the board sees both within a single coherent framework, so that risk exposure is managed as a portfolio, not in silos.
Gartner’s 2025 Leadership Vision for Heads of Enterprise Risk Management identifies three primary challenges for risk leaders: managing an accelerating emerging risk universe, driving enterprise risk ownership effectiveness, and expanding risk insight with ERM technology and analytics.
For boards in Ghana, each of these challenges maps to a practical obligation. Managing an accelerating risk universe means ensuring the board’s risk register is updated faster than annually. Driving risk ownership effectiveness means holding executives accountable for risk outcomes, not just risk reporting. Expanding risk insight through analytics means ensuring the board has access to meaningful risk data. not just compliance-formatted reports.
Effective collaborative risk management requires clear governance structures with defined responsibilities and owner accountability, with cross-functional teams working together using unified frameworks for risk assessment and escalation procedures; connecting enterprise risk management, legal, compliance, audit, and security functions.
The Risk Appetite Statement: The Board’s Most Important Risk Tool
At the centre of an effective ERM framework is the risk appetite statement, a board-approved document that defines how much risk the organisation is willing to accept in pursuit of its strategy. For credit risk, it translates into maximum NPL thresholds, concentration limits, and minimum credit quality standards. For operational risk, it translates into acceptable loss event frequency, system downtime tolerance, and compliance failure thresholds.
A risk appetite statement forces the board to have the conversations that matter, not about whether to accept risk, but about how much, what kind, and under what conditions.
What High-Performing Boards Do Differently on Risk Management
The boards that stay ahead of risk in Ghana’s current environment share several practices that distinguish genuine oversight from governance theatre:
They convene active, expert board risk committees. Not audit-plus-risk hybrid committees where risk is a 20-minute agenda item, but dedicated risk committees with directors who have relevant expertise and the confidence to challenge management on risk exposures.
They approve a risk appetite statement and hold management to it. Annually reviewed, quantitatively anchored, and distributed to risk owners across the organisation.
They require forward-looking risk reporting. Boards that only receive historical data cannot manage emerging risk. Forward-looking indicators; NPL migration rates, early warning signals on credit portfolios, operational loss incident trends, are the tools that enable proactive oversight.
They treat the three lines of defence as a board accountability structure, not a management one. This means ensuring internal audit reports independently to the board, the risk function has direct board access, and escalation pathways are clear and tested.
They connect risk to strategy. Gartner’s ERM framework guidance emphasises that without a universally accepted standard on the structure of enterprise risk governance, boards must make deliberate choices about governance documentation, defining structure and accountability with risk committee charters, and guiding risk owner behaviour through ERM standards and guidelines. Every strategic decision the board makes carries risk implications; boards that separate the two conversations are not managing either effectively.
Risk management is not what your risk department does. It is what your board decides, enables, and enforces.
In Ghana’s current environment, with NPL ratios still nearly double the Bank of Ghana’s 2026 target, Basel III buffers coming into force, and operational complexity rising with digital transformation, the quality of board-level risk management has never been more consequential.
The institutions that will meet the Bank of Ghana’s 10 percent NPL target, attract institutional capital, and sustain performance through the next cycle of disruption are the ones where the board is asking the hard questions about credit quality, operational resilience, and whether the risk frameworks in place are actually working.
That is what risk management at board level looks like. And in Ghana right now, it is the difference between boards that lead and boards that react.
