Building portfolio stress testing and risk-appetite oversight