From Regulation to Practice: Bridging the Risk Management Policy–Practice Gap in Ghanaian Commercial Banks

Abstract

Effective risk management is central to the safety, soundness, and sustainability of commercial banks because banking involves continuous exposure to credit, liquidity, market, operational, compliance, and increasingly technological and climate-related risks. This article examines the gap between formal risk-management requirements and their translation into organisational and operational practice in Ghanaian commercial banking. It revisits an earlier study of risk-management policies and practices and reframes the analysis at the sector level, removing the identity of the original focal institution. The study adopts a qualitative-dominant documentary and descriptive case-informed approach, drawing on documentary evidence, financial information, internal risk-management policies and procedures, interviews with selected banking and regulatory stakeholders from the original study, regulatory materials, and relevant literature. The empirical fieldwork was conducted in 2014; subsequent regulatory developments are therefore used as contextual evidence rather than as observations from the original fieldwork. The analysis examines credit, operational, market, liquidity, governance, risk reporting, and internal-control practices. The findings indicate broad alignment between formal risk-management principles and core operational controls, including credit appraisal, approval authorities, segregation of duties, risk monitoring, internal controls, risk reporting, liquidity management, and business continuity arrangements. However, the translation of policy into practice is constrained by information asymmetry, borrower defaults, technology and compliance costs, data limitations, operational vulnerabilities, human-capacity requirements, and tensions between control procedures and customer-service efficiency. The article argues that the effectiveness of regulation depends not merely on the existence or sophistication of rules but on institutional capacity to operationalise them through accountable governance, risk ownership, reliable information, appropriate technology, skilled personnel, effective monitoring, and a strong risk culture. The article contributes a policy-to-practice perspective that helps explain why formal regulatory strengthening does not automatically produce uniform implementation outcomes across banking organisations.