A Risk Appetite Statement is a formal document that articulates the level and type of risk an organisation is willing to take in pursuit of its strategic objectives, given its financial capacity. However, determining the appropriate level of risk can be challenging. This is where the role of the Board comes in.
As we know, one of the Board’s key roles is to establish an organisation’s strategy. However, in doing so, the Board must also consider the level of risk it is comfortable with, as it determines the strategic direction. This willingness to take risks is influenced by organisation’s financial capacity, including factors such as performance, profitability, and solvency etc. For example, while pursing growth through mergers and acquisitions may carry higher risks, it can offer greater rewards.
Increased risk may lead to higher returns, but it could result in catastrophic failure. Finding the right balance between risk and reward is crucial, and the Board needs to determine the risk appetite in conjunction with development of the strategy.
Where do we start?
The first step is to understand the organisation’s risk capacity. Risk capacity refers to the amount of risk the organisation can handle without jeopardising its financial viability.
Once the capacity is considered, the organisation defines its objectives and establishes its willingness to take risks toward achieving those objectives. The risk appetite is then determined at both business objectives and key risks level.
Key components of a Risk Appetite Statement
A Risk Appetite Statement is often poorly understood and inadequately integrated into many organisations, particularly in the non-financial services sector. This is partly due to the development of risk appetite as a document to meet requirements without a clear understanding by management. It must be developed with clarity on how it will be implemented, embedded and practically utilised within the organisation.
Let’s examine the key elements of a well-constructed Risk Appetite Statement:
- A Risk Appetite for each objective and key risk should be articulated in qualitative terms.
- It should include an appetite scale or continuum on which each risk can be assessed. It’s also important to determine whether this continuum has three, four, or more levels.
- The Risk Appetite Statement should incorporate quantitative measures to ensure the following:
- The appetite can be monitored within predefined tolerance levels
- Preventative or corrective actions can be taken
- The underlying reasons for approaching or exceeding tolerance limits can be understood, such as control failures.
- It is important to define how risks approaching or breaching tolerance levels will be escalated by management, the actions that will be taken to rectify or bring the risk back within the appetite, and the period during which higher level of risk would need to be accepted.
The Board’s role in the Risk Appetite Statement
It is the Board’s responsibility to establish the risk appetite for an organisation. However, commonly senior management needs to lead the development process based on their understanding of risk capacity and appetite. This is typically achieved through iterative consultations and workshops facilitated by an independent risk subject matter expert, leading to management’s view of the organisation’s risk appetite.
The Board should be kept informed of management’s process and the planned approach for board engagement, including review, challenging assumptions, and ultimately setting the appetite for the organisation. The Board’s approval of the Risk Appetite Statement completes the formal process of developing a Risk Appetite Statement.
However, for an organisation to benefit from a Risk Appetite Statement, management needs to:
- Communicate the Risk Appetite Statement effectively
- Implement and integrate it into the key business processes
- Monitor the appetite regularly
- Review the appetite periodically.
What are the uses of a Risk Appetite Statement?
A well-implemented and embedded Risk Appetite Statement has numerous benefits, including:
- Providing guardrails and parameters for decision-making
- Allowing for a calculated acceptance of risks within boundaries
- Acting as a key enabler for effective enterprise risk management
- Serving as the basis for delegations of authority within the organisation
- Providing a foundation for escalation and response to risk-related matters.
Questions to consider when assessing your Risk Appetite Statement
To assess the relevance and effectiveness of your Risk Appetite Statement consider the following questions:
- Do you have a Risk Appetite Statement that aligns with your current strategy which has been approved by the Board?
- Is it effectively embedded and integrated into key business processes within your organisation?
- Can your organisation benefit from a structured approach to considering risk appetite in key decision-making?
- Is your business and corporate strategy informed by your risk appetite?
If you want to learn more about Risk Appetite Statements or understand how your organisation can benefit from one, contact BDO’s risk management team.