Formulating a risk management program without defining your Risk Appetite is like designing a bridge without knowing which river it needs to span. The bridge will be too long or too short, too high or too low, and certainly not the best structure to cross the river in question.
The term ‘Risk Appetite’ is becoming increasingly used in the corporate environment. Despite its growing profile, many organisations are still grappling with the concept. The best starting point is to adopt a simple definition of Risk Appetite:
“How much risk does an organisation need to take in order to achieve its objectives?”
For example, at what point does a company start to feel uncomfortable if a large percentage of its annual revenue is derived from a concentrated source that keeps increasing?
An organisation’s Risk Appetite is derived from its strategy and objectives. It enables the organisation to properly understand:
A properly articulated and implemented Risk Appetite helps the organisation achieve its objectives in the safest and most effective manner.
A well defined Risk Appetite Statement should have the following characteristics:
The following factors impact upon the Board, Management and the organisation as a whole:
A properly developed and implemented Risk Appetite framework is the foundation of an effective risk management program within the organisation. It provides the following benefits:
• Linking Board Expectations to Management Behaviour: Risk Appetite Statements facilitate top-down direction from the Board with ongoing monitoring and control in a language that is understandable by everyone. Conversely, they provide bottom-up information and insight from the business via the calibration of risk limits and triggers, as well as reporting on risk profile vs Risk Appetite.
• Linking Business Decision to Business Strategy: Understanding Risk Appetite helps boards and management to make better decisions. It reduces the likelihood of unpleasant surprises.
• Encouraging Consistent Behaviour: Internal communication of Risk Appetite provides the business with a clear mandate for the amount and type of risk to accept and manage and the risks to avoid. External communication of Risk Appetite assists in shaping realistic stakeholder expectations.
• Enhanced Clarity over Risk: Articulation of Risk Appetite provides greater clarity over the risks the organisation is prepared to accept and those it deems undesirable that need to be controlled or avoided.
• Increasing the Capacity to Take Risk: Understanding Risk Appetite helps an organisation in the efficient allocation of risk management resources. It enables the pursuit of business opportunities that, without an understanding of Risk Appetite, would otherwise be rejected.
• Improved Risk Reporting: Reporting frameworks are more sensitive to risk tolerance levels allowing more meaningful early warning indicators and risk limits. It also makes risk assessment tools more effective as they need to take into consideration the ‘bigger picture’.
Risk appetite is an integral link between company objectives and its overall risk management profile. When clearly articulated to all levels of a company, Risk Appetite can create a positive culture of risk awareness and accountability.
Risk appetite requires ongoing maintenance and monitoring according to current markets and future business objectives in order to fully appreciate its benefits.