The Definition of Risk Appetite
One of the cornerstones of corporate risk management is the concept of (management’s) risk appetite: the amount of risk, on a scale from negligible to catastrophic, associated with a given set of objectives within the context of an organisation’s risk tolerance and acceptable levels of risk; sometimes referred to as “acceptable risk”.
The risk appetite is not about avoiding risk.
It’s also not about taking risks mindlessly—it’s about being willing to remain unaware of the dangerous side effects of accepting certain risks.
Instead, with a defined risk appetite, an organisation should be able to constantly tune its exposures to risk to provide the maximum potential benefit (an optimal decision mix) while also ensuring that the risks taken are consistent with the firm’s strategy and risk culture.
The Importance of Risk Appetite
Intellectually grasping risk appetite is crucial for sound risk control and mitigation. It provides a true north for all decision protocols, resource allocation, and the development of overarching risk management systems.
Risk appetite serves the organisation well when it is carefully defined and articulated, but the organisation risks falling short when it silently ignores or struggles to express its risk appetite.
When risk appetite is clear, an organisation’s risk management systems will pivot in line with its articulated risk appetite.
Stakeholders, from board directors and risk managers to business managers and employees, will be on the same page regarding recognising the risk acceptable to the business.
Articulating risk appetite through a properly worded, leadership-supported risk appetite statement can promote a unified risk attitude across the enterprise.
The Components of Risk Appetite
Quantitative Factor Examples
Financial thresholds are set to reflect some level of acceptable risk. An example of a financial threshold would be the maximum allowable loss per quarter. Thresholds can differ depending on financial strength, liquidity risk, and capital reserves. An organisation with solid liquidity and substantial capital reserves will likely be able to set high financial thresholds and, therefore, operate under higher levels of risk.
Risk Exposure Ratios such as debt-to-equity, current ratio, and interest coverage ratio can all impact risk appetite. These financial measurements give a glimpse into the health of the organisation or its risk profile and can inform the debate over setting risk parameters. Low debt-to-equity or gearing may indicate a higher risk tolerance for one organisation than another, which now levers significantly higher.
Monitoring these base metrics of risk can help organisations dynamically maintain an appropriate risk profile and provide the tools necessary to make rational decisions about heightened risk.
Qualitative Factor Examples
Risk appetite must be aligned with and support strategic goals and objectives. A company that wants to create dramatic growth will likely have a higher risk appetite that will be more supportive of bolder ventures. An organisation that wants stability for itself and its clients will likely have a much more conservative risk appetite. This alignment of risk appetite and strategic objectives will ensure that risk-taking activities are more likely to be sustainable and prosperous.
The organisation’s appetite for risk also relates to reputation. If people think the company is irresponsible, it can affect stakeholder trust and brand. The business will want to remain conservative to avoid stakeholder mistrust and negative reputational impact on the brand, especially in industries where reputation is essential. Concerns about reputational consequences can affect risk attitudes; more ambitious risk-taking could result in a poorer reputation and lower stakeholder confidence. Thus, sound risk management considers the consequences of an organisation’s actual and perceived behaviour from imprudent risk-taking actions.
Establishing Risk Tolerance Levels
Risk Categories
Risks of all types should be categorised, such as operational, market, credit, and tolerance levels for each essential category set.
The operational risk might be tolerated less since it is more likely to disrupt business continuity. Market risk might be more significant in relation to strategic strategies and financial goals.
Categorising allows for different kinds of risk to have different allocations towards resilience.
Risk Appetite Statements
The business must explicitly state what that means.
Creating clear, concise risk appetite statements that declare risk boundaries, such as ‘We allow up to 5% market volatility annually,’ will guide all risk-taking activities throughout the enterprise.
These risk-appetite statements must be specific and measurable, using metrics such as residual and inherent risk to get a complete picture of the organisation’s willingness to accept.
Alignment with Business Strategy
Such risk appetite needs to be calibrated against likely rewards, consistent with the culture of risk-taking and the organisation’s strategy, and enable the firm to seize the right opportunities without threatening its strategic objectives. In this way, risk appetite adds a powerful new dimension to an organisation’s risk management, assessments and capabilities. Strategic planning can be enhanced by integrating risk appetite, ensuring risk-based behaviour is aligned with strategic objectives and values.
Risk Appetite – Formalising the Framework
Involvement of Leadership
The role of senior management and the board in defining the risk appetite is paramount: their engagement and ‘buy-in’ are likely to be critical to creating an effective risk appetite framework that properly reflects the organisation’s strategy and risk culture and that’s integrated within decision-making processes and held responsible for outcomes.
Specific Metrics
Risk appetite statements must be accompanied by metrics to assess actual, observed risk levels, be it credit rating thresholds or ratios of liquid assets relative to deadweight assets or liabilities.
The aim is to put flesh on skeletal ideas such as ‘we’re managing risk as prudently as possible’, ‘we’re comfortable with risk in this area’, or ‘we want to build market share’ by offering up some measurable point of reference. It’s one thing to specify in a one-sentence statement the desirability of a given state of affairs, but such a statement is no more than a vision or aspiration.
Internal and External Communication
It sets the limits for each organisation’s employees: the risk boundaries within which they can take risks. Organisations communicate risk appetite by holding training sessions, sending memos, and conducting workshops. The goal is to make the risk appetite part of corporate culture; this is how it shapes individual behaviour and organisation-wide action. By explicitly communicating risk tolerance levels, the organisation helps individuals understand how their actions should align with what the organisation wants to accomplish. This also entails sharing the willingness to take risks with the ultimate stakeholder – the investor. Sharing the appetite reduces agency-principal risk with owners, investors and borrowers. Again, as with setting the process in place, transparency in communicating boundaries improves relations, including with regulators. Communicating this willingness to take risks demonstrates to external parties that you are serious about managing risk.
Monitoring and Adjusting
Key Performance Indicators (KPIs)
Keep tabs on KPIs associated with risk, such as market volatility and credit risk exposure. Regularly review risk appetite statements and adjust according to these KPIs to keep pace with the organisation’s strategic goals. KPIs help identify potentially irrecoverable amounts so that firms can avoid constantly being on the defensive against escalating losses.
Scenario Testing
Risk boundaries can be stressed through scenario testing (simulating extreme events) to assess their robustness. As a result, risk management strategies can be tuned and risk appetites adjusted. Scenario testing also allows organisations to build expectations about responding to adverse conditions and build capabilities to respond productively to change.
Adaptability
Adjusting the risk appetite framework is necessary in a dynamic business environment. An organisation must amend its risk appetite in response to economic downturns, industry disruptions and other changing conditions, emerging with the proper calibration to achieve resilience and remain strategically aligned.
Final Thoughts
A robust risk appetite framework complements the risk management process.
From setting clear boundaries for an organisation’s exposure to risk to ensuring that risk-taking is aligned with strategic goals and from ensuring periodic review of the framework to regular calibration of the appetite, organisations establish a culture for robust risk management and given the dynamism in today’s business environment with its inherent uncertainties, organisations must endeavour to be informed about their environments and continually show clear signs in effectively managing their accepted risks.
Organisations must take proactive steps in establishing and periodically reviewing their risk appetite frameworks to ensure sustenance in their strategic pursuits. With suitable risk identification, assessment, and management processes, organisations can achieve the right mix of risk and reward to ensure sustained growth and stability.
