Risk Appetite

Formulating a risk management program without defining your Risk Appetite is like designing a bridge without knowing which river it needs to span. The bridge will be too long or too short, too high or too low, and certainly not the best structure to cross the river in question.

The term ‘Risk Appetite’ is becoming increasingly used in the corporate environment. Despite its growing profile, many organisations are still grappling with the concept. The best starting point is to adopt a simple definition of Risk Appetite:

“How much risk does an organisation need to take in order to achieve its objectives?”

For example, at what point does a company start to feel uncomfortable if a large percentage of its annual revenue is derived from a concentrated source that keeps increasing?

An organisation’s Risk Appetite is derived from its strategy and objectives. It enables the organisation to properly understand:

• What risks will the business accept?
• What risks will the business not accept?
• What risk will the business treat on a case-by-case basis?
• What risks will the business escalate for further consideration?

A properly articulated and implemented Risk Appetite helps the organisation achieve its objectives in the safest and most effective manner.

A well defined Risk Appetite Statement should have the following characteristics:

• Reflective of corporate strategy, including organisational objectives, business plans and stakeholder expectations;
• Reflective of all key aspects of the business operations;
• Recognises that certain risks need to be controlled within defined parameters or avoided altogether;
• Acknowledges a willingness and capacity to take on acceptable risk to grow the business;
• Is documented in a formal manner and available to relevant stakeholders;
• Considers the skills, resources and technology required to manage and monitor risk exposures in the context of Risk Appetite;
• Is periodically reviewed and reconsidered with reference to evolving industry and market conditions; and
• Has been approved by the Board.

The following factors impact upon the Board, Management and the organisation as a whole:

Board

• Risk Appetite is ultimately the responsibility of the Board
• It enables the Board to set and monitor the risk taking by the organisation
• It enables the Board to make better strategic decisions

Management

• Risk Appetite enables Management to better understand their risk responsibilities
• It needs to be built into business operations and actively monitored by management

Organisation

• Risk Appetite is the foundation of sound risk management
• It is both a Governance and a Management tool
• It is as much about ‘enabling’ responsible risk taking as ‘constraining’ adverse risks
• It is both a Governance and a Management tool

A properly developed and implemented Risk Appetite framework is the foundation of an effective risk management program within the organisation. It provides the following benefits:

• Linking Board Expectations to Management Behaviour: Risk Appetite Statements facilitate top-down direction from the Board with ongoing monitoring and control in a language that is understandable by everyone. Conversely, they provide bottom-up information and insight from the business via the calibration of risk limits and triggers, as well as reporting on risk profile vs Risk Appetite.
• Linking Business Decision to Business Strategy: Understanding Risk Appetite helps boards and management to make better decisions. It reduces the likelihood of unpleasant surprises.
• Encouraging Consistent Behaviour: Internal communication of Risk Appetite provides the business with a clear mandate for the amount and type of risk to accept and manage and the risks to avoid. External communication of Risk Appetite assists in shaping realistic stakeholder expectations.
• Enhanced Clarity over Risk: Articulation of Risk Appetite provides greater clarity over the risks the organisation is prepared to accept and those it deems undesirable that need to be controlled or avoided.
• Increasing the Capacity to Take Risk: Understanding Risk Appetite helps an organisation in the efficient allocation of risk management resources. It enables the pursuit of business opportunities that, without an understanding of Risk Appetite, would otherwise be rejected.
• Improved Risk Reporting: Reporting frameworks are more sensitive to risk tolerance levels allowing more meaningful early warning indicators and risk limits. It also makes risk assessment tools more effective as they need to take into consideration the ‘bigger picture’.

Risk appetite is an integral link between company objectives and its overall risk management profile. When clearly articulated to all levels of a company, Risk Appetite can create a positive culture of risk awareness and accountability.

Risk appetite requires ongoing maintenance and monitoring according to current markets and future business objectives in order to fully appreciate its benefits.