A risk manager's first question about a held action is whether the problem is the action or the bound. Some holds ask them to accept one exception; others are really requests to change a limit for every future case. They test the action against risk appetite and the evidence, set an expiry on any exception, and decide with a reason.
What reaches a risk manager's queue?
Front-line reviewers clear most holds. The ones routed to risk are different in kind:
- Exceptions to risk appetite: an action the firm's own limits forbid, requested for a good business reason.
- Temporary limit changes: raising a customer, product or agent limit for a period.
- Incident classifications drafted by an agent from monitoring data, which determine who must be told.
- Risk acceptances: a known control gap the business wants to live with for a time.
- Concentration breaches: one counterparty, sector or region exceeding a threshold.
Each is a held action: drafted, waiting for a named person, with the deciding bound recorded.
What should the risk manager check?
Single action or standing change? Approving one payment holiday outside policy is an exception. Approving "payment holidays for all customers in this postcode" is a change to the firm's limits, which needs the limit owner and probably a record in the risk register. Treat them differently.
Which bound decided. The minimum chain checks role scope, certificate, sources, the firm's own limits and the platform guardrails. A hold on the firm's limits is yours to weigh. A hold because the agent's certified depth is below what the action needs is not something a risk manager can approve around; depth is earned from certification evidence, and the lower of the role's ceiling and evidence wins.
Evidence quality. Is the case for the exception built on sealed data from the firm's own systems, or on declared figures from a customer or a business line?
Reversibility and expiry. Can the exception be unwound? When does it end? An exception with no end date is a new limit by default.
Who else must know. Compliance, the limit owner, the board risk committee if appetite is affected.
Approve, edit or decline
| Decision | Use when | Record |
|---|---|---|
| Approve | The exception is justified, bounded and reversible | Justification, expiry, conditions |
| Edit | The exception is justified but too wide or too long | What was narrowed and why |
| Decline | The action breaches appetite without adequate reason, or needs a higher authority | Reason, and who it went to |
The most common good answer is an edit: yes, but for fewer customers, a shorter period, a lower amount, and with a review date.
A worked example
Take a retail bank after flooding in one region. The collections agent drafts payment holidays of three months for 220 mortgage customers in affected postcodes. The bank's own limits allow the agent to offer one month, so the action is held and routed to the risk manager.
The risk manager checks the postcode list against the bank's own address records, which are sealed, rather than the agent's summary. Thirty customers are outside the flooded area. She edits the action to 190 customers, approves three months with an expiry and a review at six weeks, and records the justification. She then raises a separate request with the limit owner: should the bank's limits include a standing hardship rule for declared emergencies? That is a policy question, not a queue item.
What controls keep this safe?
- Every exception carries an expiry, enforced in the firm's limits.
- Standing changes go through the limit owner, not through a single approval.
- Risk managers do not approve their own business line's exceptions.
- The record links each exception to its justification, so a regulator can reconstruct why the firm stepped outside its appetite.
Operations and property managers see holds with lower stakes and similar structure; compare how operations managers handle held actions and how property managers handle them. Market rules shape the detail; see risk manager training in retail banking in Canada. For the full role map, see AI agent skills by role.
Where the Academy fits
Risk managers who approve exceptions and set limits usually need more than the Operator track. Pryme Intelligence Academy's Architect track is for people who lead regulated, multi-agent deployments, and ends in a capstone and a board review with two Pryme assessors. The free Foundations course covers the decision chain and depth, and is a sensible start for risk staff new to agents.
Questions people ask
Can a risk manager raise an agent's depth?
No. Depth is earned from certification evidence, capped by the role's ceiling. A risk manager can narrow or widen the firm's own limits, which is a different lever.
How long should an exception last?
As short as will do the job, with a review date before expiry. Long exceptions should become limit changes, made openly.
What if a business line keeps sending the same exception?
That is a signal the limit or the business practice needs to change. Raise it with the limit owner rather than approving it again.