Executive Summary - The Institute of Risk Management
Executive Summary - The Institute of Risk Management
Executive Summary - The Institute of Risk Management
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
Appetite<strong>Risk</strong> & Tolerance<strong>Executive</strong> <strong>Summary</strong>
<strong>Risk</strong> Appetite and Tolerance<strong>Executive</strong> <strong>Summary</strong>Foreword 1Introduction 4About IRM 6About the Author 6<strong>Risk</strong> appetite –principles and approach 7<strong>Risk</strong> appetiteand performance 10Putting it into practice 12Five tests for riskappetite frameworks 14Questions for the boardroom 15Supported by:A guidance paper fromthe <strong>Institute</strong> <strong>of</strong> <strong>Risk</strong> <strong>Management</strong>September 2011©2011 <strong>The</strong> <strong>Institute</strong> <strong>of</strong> <strong>Risk</strong> <strong>Management</strong>All rights reserved. No part <strong>of</strong> this publication may bereproduced, stored in a retrieval system or transmittedin any form or by any means, electronic, mechanical,photocopying, recording or otherwise without the expresspermission <strong>of</strong> the copyright owner. Permission will generallybe granted for use <strong>of</strong> the material from this documenton condition that the source is clearly credited as beingthe <strong>Institute</strong> <strong>of</strong> <strong>Risk</strong> <strong>Management</strong>.
Foreword<strong>Risk</strong> appetite today is a coreconsideration in any enterpriserisk management approach.As well as meeting the requirementsimposed by corporate governancestandards, organisations in all sectorsare increasingly being asked by keystakeholders, including investors, analystsand the public, to express clearly the extent<strong>of</strong> their willingness to take risk in order tomeet their strategic objectives.<strong>The</strong> <strong>Institute</strong> <strong>of</strong> <strong>Risk</strong> <strong>Management</strong>,now in its 25 th year, has a key role to playin establishing sound practices in this areaand building consensus in what has, fortoo long, been a nebulous subject.By providing practical advice on howto approach the development andimplementation <strong>of</strong> a risk appetiteframework we believe we will be helpingboards and senior management teams bothto manage their organisations better andto discharge their corporate governanceresponsibilities more effectively.We are particularly pleased that alarge number <strong>of</strong> pr<strong>of</strong>essional bodies aresupporting this work – risk is everyone’sbusiness and a common understandingand approach helps us work togetherto address this challenging area.Alex HindsonChairman<strong>The</strong> <strong>Institute</strong> <strong>of</strong> <strong>Risk</strong> <strong>Management</strong>1
This paper will be helpful to seniormanagers in public service organisationswho are trying to understand risk appetitein the context <strong>of</strong> their own strategic andoperational decision making. In its recentlypublished Core Competencies in PublicService <strong>Risk</strong> <strong>Management</strong>, Alarm identifiedthe need to understand the organisation’srisk appetite and risk tolerance, as part <strong>of</strong>the key function <strong>of</strong> identifying, analysing,evaluating and responding to risk. <strong>The</strong>‘questions for the boardroom’, set out inthis paper, could easily be translated into‘questions for the public organisation’ssenior executive committee’ and as suchmay be <strong>of</strong> value to many Alarm membersand their organisations.Dr Lynn T DrennanChief <strong>Executive</strong>Alarm, the public riskmanagement association<strong>The</strong> Chartered <strong>Institute</strong> <strong>of</strong> InternalAuditors welcomes this contribution fromthe <strong>Institute</strong> <strong>of</strong> <strong>Risk</strong> <strong>Management</strong> to thedebate on risk appetite and risk tolerance.In theory, the idea <strong>of</strong> deciding how muchrisk <strong>of</strong> different types the organisationwishes to take and accept sounds easy.In practice, it is difficult and needs ongoingeffort both from those responsible forgovernance in agreeing what is acceptableand from all levels <strong>of</strong> management incommunicating how much risk they wishto take and in monitoring how muchthey are actually taking. Anythingthat stimulates debate on the practicalchallenges <strong>of</strong> risk management is tobe welcomed.Jackie CainPolicy DirectorChartered <strong>Institute</strong><strong>of</strong> Internal AuditorsWhile the Financial Reporting Council haskick-started the debate on risk appetiteand risk tolerance in the UK, it is a debatethat resonates around the world. As anintegrated global risk consulting business,I can testify to the fact that our clients aredebating risk appetite. That is why weare pleased to support the work <strong>of</strong> the<strong>Institute</strong> <strong>of</strong> <strong>Risk</strong> <strong>Management</strong> in movingthis debate forward. We look forward toactively engaging with IRM and othersin promoting this thought-provokingdocument and turning risk appetite intoa day-by-day reality for boards and riskmanagement pr<strong>of</strong>essionals around theworld.CIPFA is pleased to endorse this workby IRM on risk appetite and tolerancewhich provides welcome leadership on achallenging subject for both the publicand private sectors. We look forwardto taking the debate further with ourmembership in pursuit <strong>of</strong> our commitmentto sound financial management and goodgovernance.Diana MelvilleGovernance AdviserChartered <strong>Institute</strong> <strong>of</strong> Public Financeand AccountancyLarry RiegerCEO, Crowe HorwathGlobal <strong>Risk</strong> Consulting2
All successful organisations need to beclear about their willingness to accept riskin pursuit <strong>of</strong> their goals. Armed with thisclarity, boards and management can makemeaningful decisions about what actionsto take at all levels <strong>of</strong> the organisationand the extent to which they must dealwith the associated risks. But definingand implementing risk appetite is workin progress for many. CIMA thereforewarmly welcomes this new guidancefrom the <strong>Institute</strong> <strong>of</strong> <strong>Risk</strong> <strong>Management</strong>as a sound foundation for developingbest practice on this critical topic.This document is an important contributionto a key area <strong>of</strong> board activity and helpfullyaddresses one <strong>of</strong> the issues highlighted inthe Financial Reporting Council’s Guidanceon Board Effectiveness. ICSA is pleasedto support the work started here by the<strong>Institute</strong> <strong>of</strong> <strong>Risk</strong> <strong>Management</strong>, and looksforward to a well-informed debate andsome useful conclusions.Seamus GillenDirector <strong>of</strong> Policy<strong>Institute</strong> <strong>of</strong> Chartered Secretariesand Administrators (ICSA)Gillian LeesHead <strong>of</strong> Corporate GovernanceChartered <strong>Institute</strong> <strong>of</strong> <strong>Management</strong>Accountants (CIMA)This paper sends out a clear statement thatthe principle <strong>of</strong> risk appetite emanatingfrom the board is the only effectiveway to initiate an ERM implementation.Charterhouse <strong>Risk</strong> <strong>Management</strong> isdelighted to be associated with the launch<strong>of</strong> this paper after contributing to theconsultation process. Our own experiencewith clients confirms that this approach isnot only critical, but that the whole processmust be undertaken with a practical ratherthan theoretical vigour. This is an essentialingredient <strong>of</strong> our delivery capability.References to ‘appetite’ and ‘hunger’ onlyreinforce the living nature <strong>of</strong> the requiredapproach.Neil MockettCTOCharterhouse <strong>Risk</strong> <strong>Management</strong>3
Introduction<strong>The</strong> UK Corporate Governance Codestates that “the board is responsiblefor determining the nature andextent <strong>of</strong> the significant risks itis willing to take in achieving itsstrategic objectives.”<strong>The</strong> intent <strong>of</strong> this document is to providehigh level guidance to directors and seniorexecutives on how to address this part<strong>of</strong> the Code, which essentially requiresconsideration <strong>of</strong> the subjects <strong>of</strong> ‘riskappetite’ and ‘risk tolerance’.This summary will tell you:• what you need to know• what you need to do, and• where can you turn for moredetailed guidanceIt became apparent during thedevelopment <strong>of</strong> our paper that there isconsiderable interest in this topic inthe public sector as well as the privatesector, and also beyond the UK. So, whilesome specifics might differ, we feel thatthe underlying principles hold true forall sectors and all geographical locations.We have prepared this guidance underthe overall direction <strong>of</strong> a working group<strong>of</strong> the <strong>Institute</strong> <strong>of</strong> <strong>Risk</strong> <strong>Management</strong>. Ourwork has produced this executive summary,which is designed to provide an overview<strong>of</strong> the subject for general use, particularlyby board members, and a more detailedversion which is primarily designed to assistthose whose task it is to advise boards onthese matters. <strong>The</strong> detailed version <strong>of</strong> ourguidance is available for free downloadfrom IRM’s website * .Following the financial collapse,precipitated by banks which we allassumed were outstanding at managingrisk, which was after all their raisond’être, first the Walker Report, and thenthe review <strong>of</strong> Corporate Governance bythe FRC highlighted the need for boardsto re-evaluate just how good they areat managing risk. As a consequence <strong>Risk</strong>Appetite and <strong>Risk</strong> Tolerance are nowon the agenda for all listed companies.Importantly, our work has shown thatthis interest extends outside the listedsector to organisations in all walks <strong>of</strong> life.But managing risk appetite represents amassive challenge: risk pr<strong>of</strong>essionals havebeen divided as to how to determine riskappetite and there is precious little in terms<strong>of</strong> useful guidance.4* <strong>Risk</strong> Appetite and Tolerance – Guidance Paper availablefrom www.theirm.org/publications/risk_appetite.html
We do not regard this guidanceas the last word on the subject:thinking will continue to develop and, if,as we hope, this booklet is supersededbefore too many reporting seasons comeand go, then we will know that theconcept <strong>of</strong> risk appetite is beginningto take root.It is our view that risk appetite, correctlydefined, approached and implemented,should be a fundamental business conceptthat could make a substantial difference tohow businesses and organisations are run.We fully expect that the initial scepticismabout risk appetite will be graduallyreplaced as boards and executive directorsgain greater insight into its usefulness.We also anticipate that analysts will soonbe asking chief executives, chairmen andfinance directors about risk appetite.After all, this subject is at the heart <strong>of</strong> theorganisation: risk-taking, whether private,public or third sector, whether large orsmall, is what managing an organisationis about. <strong>The</strong> approach <strong>of</strong> the new UKCorporate Governance Code representsan opportunity to place risk management,and in particular risk appetite, right at thecentre <strong>of</strong> the debate on effective corporategovernance and the role <strong>of</strong> the board inrunning organisations.Richard AndersonDeputy Chairman,<strong>Institute</strong> <strong>of</strong> <strong>Risk</strong> <strong>Management</strong>Members <strong>of</strong>the Working GroupRichard Anderson,Deputy Chairman <strong>of</strong> IRM andManaging Director <strong>of</strong> CroweHorwath Global <strong>Risk</strong> ConsultingBill Aujla,CRO at EtisalatGemma Clatworthy,Senior risk consultant at NationwideBuilding SocietyRoger Garrini,Audit manager at Selex GalileoPaul Hopkin,Director <strong>of</strong> IRM and technicaldirector <strong>of</strong> AIRMICSteven Shackleford,Senior academic in audit and riskmanagement at Birmingham CityUniversityJohn Summers,Chief advisor – risk at Rio TintoCarolyn Williams,Head <strong>of</strong> thought leadership at IRM5
About IRM<strong>The</strong> <strong>Institute</strong> <strong>of</strong> <strong>Risk</strong> <strong>Management</strong> (IRM)is the world’s leading enterprise riskmanagement education <strong>Institute</strong>. We areindependent, well-respected advocates <strong>of</strong>the risk pr<strong>of</strong>ession, owned by practising riskpr<strong>of</strong>essionals. We provide qualifications,short courses and events at a range <strong>of</strong>levels from introductory to board leveland support risk pr<strong>of</strong>essionals by providingthe skills and tools needed to deal withthe demands <strong>of</strong> a constantly changing,sophisticated and challenging businessenvironment. We operate internationallywith members and students in over 90countries, drawn from a variety <strong>of</strong> riskrelateddisciplines and a wide range <strong>of</strong>industries in the private, third andpublic sectors.About the AuthorRichard Anderson, the principal author<strong>of</strong> this booklet, is Deputy Chairman <strong>of</strong>IRM. Richard is also Managing Director<strong>of</strong> Crowe Horwath Global <strong>Risk</strong> Consultingin the UK. A Chartered Accountant, andformerly a partner at a big-4 practice,Richard has also run his own GRC practicefor seven <strong>of</strong> the last ten years. Richardhas been pr<strong>of</strong>essionally involved with riskmanagement since the mid-ninetiesand has broad industry sector experience.He wrote a report for the OECD onCorporate <strong>Risk</strong> <strong>Management</strong> in the bankingsector in the UK, the USA and France.He is a regular speaker at conferencesand contributes to many journals on riskmanagement and governance issues.“It is interesting, but not surprising,that whilst a significant proportion<strong>of</strong> financial organisations who haveformally articulated a risk appetitestatement have been compelled to doso by regulatory requirements, nonfinancialorganisations have developedrisk appetites in order to assist in theachievement <strong>of</strong> strategic goals.”Source: Jill Douglas,Head <strong>of</strong> <strong>Risk</strong>,Charterhouse <strong>Risk</strong> <strong>Management</strong>6
<strong>Risk</strong> appetite –principles and approachIt is <strong>of</strong>ten said that no companycan make a pr<strong>of</strong>it without takinga risk. <strong>The</strong> same is true for allorganisations: no organisation,whether in the private, publicor third sector can achieve itsobjectives without taking risk.<strong>The</strong> only question is how muchrisk do they need to take?And yet taking risks withoutconsciously managing thoserisks can lead to the downfall <strong>of</strong>organisations. This is the challengethat has been highlighted by thelatest UK Corporate GovernanceCode issued by the FinancialReporting Council in 2010.<strong>The</strong> following key principles haveunderpinned our work on risk appetite:1 <strong>Risk</strong> appetite can be complex. Excessivesimplicity, while superficially attractive,leads to dangerous waters: far betterto acknowledge the complexity anddeal with it, rather than ignoring it.2 <strong>Risk</strong> appetite needs to be measurable.Otherwise there is a risk that anystatements become empty andvacuous. We are not promoting anyindividual measurement approach butfundamentally it is important thatdirectors should understand how theirperformance drivers are impactedby risk. Shareholder value may be anappropriate starting point for someprivate organisations; stakeholdervalue or ‘Economic Value Added’ maybe appropriate for others. We alsoanticipate more use <strong>of</strong> key risk andcontrol metrics which should be readilyavailable inside or from outside theorganisation. Relevant and accuratedata is vital for this process and weurge directors to ensure that there isthe same level <strong>of</strong> data governance overthese metrics as there would be overroutine accounting data.7
3 <strong>Risk</strong> appetite is not a single, fixedconcept. <strong>The</strong>re will be a range <strong>of</strong>appetites for different risks which needto align and these appetites may wellvary over time: the temporal aspect <strong>of</strong>risk appetite is a key attribute to thiswhole development.4 <strong>Risk</strong> appetite should be developedin the context <strong>of</strong> an organisation’srisk management capability, whichis a function <strong>of</strong> risk capacity andrisk management maturity. <strong>Risk</strong>management remains an emergingdiscipline and some organisations,irrespective <strong>of</strong> size or complexity, do itmuch better than others. This is in partdue to their risk management culture(a subset <strong>of</strong> the overall culture), partlydue to their systems and processes,and partly due to the nature <strong>of</strong> theirbusiness. However, until an organisationhas a clear view <strong>of</strong> both its risk capacityand its risk management maturity itcannot be clear as to what approachwould work or how it should beimplemented.5 <strong>Risk</strong> appetite must take into accountdiffering views at a strategic, tacticaland operational level. In other words,while the UK Corporate GovernanceCode envisages a strategic view <strong>of</strong>risk appetite, in fact risk appetiteneeds to be addressed throughoutthe organisation for it to make anypractical sense.6 <strong>Risk</strong> appetite must be integrated withthe control culture <strong>of</strong> the organisation.Our framework explores this by lookingat both the propensity to take risk andthe propensity to exercise control. <strong>The</strong>framework promotes the idea thatthe strategic level is proportionatelymore about risk taking than exercisingcontrol, while at the operational levelthe proportions are broadly reversed.Clearly the relative proportions willdepend on the organisation itself, thenature <strong>of</strong> the risks it faces and theregulatory environment within whichit operates.8
<strong>Risk</strong> and controlWe think that this dual focus ontaking risk and exercising control isboth innovative and critical to a properunderstanding <strong>of</strong> risk appetite and risktolerance. <strong>The</strong> innovation is not in lookingat risk and control – all boards do that.<strong>The</strong> innovation is in looking at theinteraction <strong>of</strong> risk and control as part <strong>of</strong>determining risk appetite. Proportionatelymore time is likely to be spent on risktaking at a strategic level than at anoperational level, where the focus ismore likely to be on the exercise <strong>of</strong>control. One word <strong>of</strong> caution though,we are not equating strategy with boardlevel and operations with lower levels<strong>of</strong> the organisation.A board will properly want to knowthat its operations are under controlas much as it wants to oversee thedevelopment and implementation <strong>of</strong>strategy. In the detailed paper we haveincluded a few suggestions as to howboards might like to consider these dualresponsibilities. Above all, we are verymuch focused on the need to take riskas much as the traditional pre-occupation<strong>of</strong> many risk management programmes,which is the avoidance <strong>of</strong> harm.Hungry for risk?<strong>The</strong> word “appetite” brings connotations <strong>of</strong> food, hunger and satisfying one’sneeds. We think that this metaphor is not always helpful in understanding thephrase “risk appetite”. When those two words appear together we think it ismore appropriate to think in terms <strong>of</strong> ‘fight or flight’ responses to perceived risks.Most animals, including human beings, have a ‘fight or flight’ response to risk.In humans this can be over-ruled by our cognitive processes. Our interpretation <strong>of</strong>risk appetite is that it represents a corporate version <strong>of</strong> exactly the same instinctsand cognitive processes. However, since these instincts are not ”hardwired“ in ourcorporate “nervous and sensory” systems we use risk management as a surrogate.9
<strong>Risk</strong> appetiteand performanceOur view is that both risk appetite andrisk tolerance are inextricably linked toperformance over time. We believe thatwhile risk appetite is about the pursuit<strong>of</strong> risk, risk tolerance is about what youcan allow the organisation to deal with.Organisations have to take some risksand they have to avoid others. <strong>The</strong> bigquestion that all organisations have toask themselves is: just what does successfulperformance look like? This question mightbe easier to answer for a listed companythan for a government department,but can usefully be asked by boardsin all sectors.<strong>The</strong> illustrations on these pages showthe relationship between risk appetite,tolerance and performance. Diagram 1shows the expected direction <strong>of</strong>performance over the coming period.Diagram 2 illustrates the range <strong>of</strong>performance depending on whetherrisks (or opportunities) materialise. <strong>The</strong>remaining diagrams demonstrate thedifference between:• all the risks that the organisation mightface (the “risk universe”- Diagram 3)• those that, if push comes to shove,they might just be able to put up with(the “risk tolerance” - Diagram 4) and• those risks that they actively wishto engage with (the “risk appetite” -Diagram 5).PerformancePerformanceCurrent direction<strong>of</strong> travel for performancet0 Time t 1Diagram 1Where you mightget to if some“good” things happent0 Time t 1Where you mightget to if some“bad” things happenDiagram 210
We believe that the appetite will be smallerthan the tolerance in the vast majority <strong>of</strong>cases, and that in turn will be smaller thanthe risk universe, which in any case willinclude “unknown unknowns”.Performance<strong>Risk</strong>Universe<strong>Risk</strong> tolerance can be expressed in terms <strong>of</strong>absolutes, for example “we will not exposemore than x% <strong>of</strong> our capital to losses ina certain line <strong>of</strong> business” or “we will notdeal with certain types <strong>of</strong> customer“.t0 Time t 1Where you mightget to if some“bad” things happenDiagram 3<strong>Risk</strong> appetite, by contrast is about what theorganisation does want to do and how itgoes about it.It therefore becomes the board’sresponsibility to define this all-importantpart <strong>of</strong> the risk management systemand to ensure that the exercise <strong>of</strong> riskmanagement throughout the organisationis consistent with that appetite, whichneeds to remain within the outerboundaries <strong>of</strong> the risk tolerance. Differentboards, in different circumstances, will takedifferent views on the relative importance<strong>of</strong> appetite and tolerance.Performancet0 Time t 1Where you mightget to if some“bad” things happenDiagram 4<strong>Risk</strong>TolerancePerformance<strong>Risk</strong>Appetitet0 Time t 1Where you mightget to if some“bad” things happenDiagram 511
Putting it into practiceWe have sought to develop anapproach to risk appetite that:1 is theoretically sound (but the theorycan quickly disappear into thebackground)2 is practical and pragmatic: we do notwant to create a bureaucracy, rather weare looking to help find solutions thatcan work for organisations <strong>of</strong> all shapesand sizes, and3 will make a difference.Boardroom debate - we suspect thatin the early days particularly, a successfulapproach to reviewing risk appetite andrisk tolerance in the boardroom willnecessarily lead to some tensions. In otherwords we think that it should make adifference to the decisions that are made,otherwise it will diminish into a mere tickboxactivity – and nobody needs any more<strong>of</strong> those in the boardroom. It is essentialthat the approach that we are setting outin the detailed guidance can and shouldbe tailored to the needs and maturity <strong>of</strong>the organisation: it is not a one-size-fits-allapproach.Consultation - in our paper we haveset out an illustrative process for thedevelopment <strong>of</strong> an approach to riskappetite. This includes appropriateconsultation with those external andinternal stakeholders, with whom theboard believes it appropriate to consult onthis matter. It also includes a review processby the board, or an appropriate committee<strong>of</strong> the board, and finally it includes areview process at the end <strong>of</strong> the cycle sothat appropriate lessons can be learned.<strong>Risk</strong> Committees - in his 2009 Review<strong>of</strong> Corporate Governance in UK Banksand Other Financial Industry Entities,Sir David Walker recommended thatfinancial services organisations shouldmake use <strong>of</strong> board risk committees.<strong>The</strong> Economic Affairs Committee <strong>of</strong> theHouse <strong>of</strong> Lords recently suggested thatlarge organisations in other sectors shouldalso consider creating such committees.*We think that the creation and monitoring<strong>of</strong> approaches to risk appetite and risktolerance should be high on the agenda<strong>of</strong> these committees. In the detaileddocument, we have included a brief sectionon the role <strong>of</strong> the board or risk committee:we are suggesting that governance needsto be exercised over the framework atfour key points: approval, measurement,monitoring and learning.12* House <strong>of</strong> Lords Economic Affairs Committee. (2011)Second Report - Auditors: Market concentration and their role
Flexibility - all <strong>of</strong> this needs to be carriedout with the basic precept in mind thatrisk appetite can and will change over time(as, for example, the economy shifts fromboom to bust, or as cash reserves fall). Inother words, breaches <strong>of</strong> risk appetitemay well reflect a need to reconsiderthe risk appetite part way through areporting cycle as well as a more regularreview on an annual cycle. Rapid changesin circumstances, for example as werewitnessed during the financial crisis in2008-9, might also indicate a need foran organisation to re-appraise its riskappetite or at least the application <strong>of</strong> itsrisk appetite framework. In a fast changingeconomic climate, it is especially importantfor firms to have not only a clearly definedstrategy, but also a clearly articulated riskappetite framework so that they are ableto react quickly to the challenges andopportunities presented during such times.13
Five tests for risk appetiteframeworksIn summary, there are five tests thatDirectors should apply in reviewing theirorganisation’s risk appetite framework:1 Do the managers making decisionsunderstand the degree to which they(individually) are permitted to exposethe organisation to the consequences<strong>of</strong> an event or situation? Any riskappetite framework needs to bepractical, guiding managers to makerisk-intelligent decisions.2 Do the executives understand theiraggregated and interlinked level <strong>of</strong>risk so they can determine whetherit is acceptable or not?3 Do the board and executive leadershipunderstand the aggregated andinterlinked level <strong>of</strong> risk for theorganisation as a whole?4 Are both managers and executives clearthat risk appetite is not constant? It maychange as the environment and businessconditions change. Anything approvedby the board must have some flexibilitybuilt in.5 Are risk decisions made with fullconsideration <strong>of</strong> reward? <strong>The</strong> riskappetite framework needs to helpmanagers and executives take anappropriate level <strong>of</strong> risk for thebusiness, given the potential for reward.We believe that by following the guidanceset out in detail in our document, directorswill be able to be confident that they canpass all <strong>of</strong> those five tests.“<strong>The</strong> risk appetite statement isgenerally considered the hardestpart <strong>of</strong> any Enterprise <strong>Risk</strong><strong>Management</strong> implementation.However, without clearly defined,measurable tolerances the wholerisk cycle and any risk frameworkis arguably at a halt.”Jill Douglas, Head <strong>of</strong> <strong>Risk</strong>,Charterhouse <strong>Risk</strong> <strong>Management</strong>14
Questions forthe boardroomBelow we set out some questions thatwe think boards may want to consider,as part <strong>of</strong> an iterative process over time,as they develop their approaches to riskappetite and which will enable them toremain at the forefront <strong>of</strong> the discussion.One clear outcome from our consultationexercise was that, despite the expectedvariation in views on the technical aspects<strong>of</strong> risk appetite, there was a commonacceptance <strong>of</strong> these questions as a usefulstarting point for board discussion.Background1 What are the significant risks theboard is willing to take? What are thesignificant risks the board is not willingto take?2 What are the strategic objectives <strong>of</strong>the organisation? Are they clear?What is explicit and what is implicitin those objectives?3 Is the board clear about the natureand extent <strong>of</strong> the significant risks it iswilling to take in achieving its strategicobjectives?4 Does the board need to establish clearergovernance over the risk appetite andtolerance <strong>of</strong> the organisation?5 What steps has the board taken toensure oversight over the management<strong>of</strong> the risks?15
Designing a risk appetite6 Has the board and managementteam reviewed the capabilities <strong>of</strong> theorganisation to manage the risks thatit faces?7 What are the main features <strong>of</strong> theorganisation’s risk culture in terms<strong>of</strong> tone at the top? Governance?Competency? Decision making?8 Does an understanding <strong>of</strong> risk permeatethe organisation and its culture?9 Is management incentivised for goodrisk management?10 How much does the organisationspend on risk management each year?How much does it need to spend?11 How mature is risk management in theorganisation? Is the view consistent atdiffering levels <strong>of</strong> the organisation?Is the answer to these questions basedon evidence or speculation?Constructing a risk appetite12 Does the organisation understandclearly why and how it engageswith risks?13 Is the organisation addressing allrelevant risks or only those that can becaptured in risk management processes?14 Does the organisation have aframework for responding to risks?Implementing a risk appetite15 Who are the key external stakeholdersand have sufficient soundings beentaken <strong>of</strong> their views? Are those viewsdealt with appropriately in the finalframework?16 Has the organisation followeda robust approach to developingits risk appetite?17 Did the risk appetite undergoappropriate approval processes,including at the board (or riskoversight committee)?18 Is the risk appetite tailored andproportionate to the organisation?19 What is the evidence that theorganisation has implementedthe risk appetite effectively?16
Governing a risk appetite20 Is the board satisfied with thearrangements for data governancepertaining to risk management dataand information?21 Has the board played an active part inthe approval, measurement, monitoringand learning from the risk appetiteprocess?22 Does the board have, or does it need,a risk committee to, inter alia, overseethe development and monitoring <strong>of</strong>the risk appetite framework?<strong>The</strong> journey is not over -final thoughts23 What needs to change for nexttime round?24 Does the organisation have sufficientand appropriate resources and systems?25 What difference did the process makeand how would we like it to have animpact next time round?17
Crowe Horwath Global <strong>Risk</strong> ConsultingContact: Richard AndersonE richard.anderson@crowehorwathgrc.netCharterhouse <strong>Risk</strong> <strong>Management</strong> LtdContact: Andy JenkinsonE andy.jenkinson@charterhouse-group.com<strong>The</strong> <strong>Institute</strong> <strong>of</strong> <strong>Risk</strong> <strong>Management</strong>6 Lloyd’s AvenueLondon EC3N 3AXT +44(0)20 7709 9808E enquiries@theirm.orgW www.theirm.org