For those of you with a defined risk appetite, do you define it at business unit level and then work to ensure you match employee preference for risk taking to the appetite for risk you want a particular business unit to have? Perhaps you feel this is done implicitly? Is that good enough? Is it needed?
Here are some thoughts I had on the subject back in Feb 2013 which hold true today.