Establishing a Risk Appetite Framework for Corporates

What is risk appetite?

A risk appetite statement is a way of formalising how an organisation has arrived at an expression of firstly what risks the organisation is willing to take; and secondly in what quantum in order to reach its strategic and commercial objectives.  It is therefore about making explicit the risk-return trade-offs, and finding practical and pragmatic ways to incorporate these trade-offs into day-to-day planning and decision-making.

In many organisations, the parameters governing risk-return trade-offs are not clearly defined and, given the complexity facing most organisations, an intuitive or rule of thumb approach is unlikely to provide optimal results.  However, by articulating the risk-return trade-offs that organisations are willing to make to achieve their strategic, commercial and financial objectives, the risk appetite statement can provide a mandate and parameters from the Board for executive management to operate within.

How do we arrive at an agreed risk appetite statement?

The Board is ultimately responsible for setting and approving the risk appetite. However, from a practical perspective, Executive management is likely to propose a risk appetite to the Board.  We would nonetheless envisage that the approach used to develop the risk appetite at Exco and Board level should be the same.

The key steps in a risk appetite process are:

Step 1: Confirm and prioritise the scope of risks to be incldued in the risk appetite framework.  The starting point for agreeing the risks in scope will for listed companies be the Princiapl Risks.

Step 2: For each of the risks in scope – determine the risk preference of the Board.  Practically, this could mean that the Board reviews a proposal put forward by management.  However, at the end of the day, the Board is responsible for setting the risk appetite.

When agreeing on the risk preference for each of the risks in scope, the Board has three main choices.  It can be risk averse, risk neutral or risk tolerant.

Step 3: In order for risk appetite to become an effective management and oversight tool, the risk appetite needs to be embedded into day-to-day activities.  This can include cascading the risk appetite into the individual businesses.

How can risk appetite add value to the organisation?

In the first instance, we need to be clear on what risk appetite is there to deliver.  Risk appetite is NOT a mechanism to reduce risk or limit the ability of management to run the business.  On the contrary, Risk appetite is a management tool that can be used effectively for decision-making but also to increase the cost-effectiveness of governance and oversight. Risk appetite can, and therefore should be, cascaded to the level of the organisations where the decisions are being made.

As set out above, the trade-offs and linkages need to be explicit.  In particular, it needs to be clear that there is a cost to risk aversion – as a consequence, the investment in mitigation and control will be higher for risks where the organisation is risk averse. However, risk appetite should also be an integral part of the strategy discussion and should have close links with the Board’s strategy considerations.  Therefore, strategy and strategic options can be evaluated more effectively with a clear appreciation & articulation of the risk appetite.

Embedding risk appetite can be achieved with an effective cascade and roll-out of risk appetite to Business Units and Divisions.  In most organisations, a large range of decisions are taken within Business Units and Divisions, and one of the benefits of a cascaded risk appetite statement is that it drives consistent decision-making within the agreed risk parameters. It also enables the Board to test rigorously the business cases that get submitted for approval at Board level to make sure that they align with risk appetite.