Guidance Paper - The Institute of Risk Management

More documents

Recommendations

Info

Develop 408 The development of the risk appetite approach should now be well-informed by the background work, the preliminary sketch and the dialogue with relevant stakeholders. The amount of detail that is required will vary from organisation to organisation. Of course, the detail needs to be tailored and proportionate to the organisation. Approve 409 If we are right in thinking that the development of risk appetite thinking in organisations has the potential to change the way that organisations are run, then it goes without doubt that boards, and in the event that they exist, risk oversight committees should review and approve the risk appetite document. Implement 410 Implementation is going to take some time. It is unlikely that an organisation will be able to get the risk appetite framework right first time. In particular the cultural aspects, the data gathering and the ramifications of divergences from the statement will need to be worked through. There is little point in defining 411 an appetite without clearly articulating consequences. Further, it is important the organisation is seen to take action in conjunction with the appetite. For example, some Boards and senior management state they have a zero tolerance risk appetite regarding any compliance or regulatory breaches. All well and good, but the organisation’s staff policy handbook must clearly follow the same lines and one would expect that once proved, disciplinary proceedings for the staff responsible would be automatic. For the risk appetite statement to be taken seriously throughout the firm it cannot be defined in isolation to the rest of the organisation. Report 412 We envisage that reporting against risk appetite statements will broadly take two forms: • Internal: this will require reporting on a frequency similar to regular internal management reporting,; and • External: this will require annual reporting to relevant stakeholders, including (where they exist) shareholders, and perhaps others included in the stakeholder engagement stage above. Review 413 At the end of each reporting cycle, and before the risk appetite statement is resketched, there should be a review, perhaps undertaken by the board or the risk oversight committee into what worked well, what failed, and what needs to be done differently next time. Learning the lessons, especially in the early days of implementing a risk appetite statement will be critically important. Implementing a risk appetite - questions for the boardroom • Has the organisation followed a robust approach to developing a risk appetite • Who are the key external stakeholders and have sufficient soundings been taken of their views Are those views dealt with appropriately in the final documentation • Is the risk appetite tailored and proportionate to the organisation • Did the risk appetite undergo appropriate approval processes, including at the board (or risk oversight committee) • What is the evidence that the organisation has implemented the risk appetite effectively 32
V Governing a risk appetite “Making sure it fits” 501 The final strand of thinking that we want to touch on in this paper is the governance over a risk appetite statement. If a risk appetite is to be of any use to an organisation, it is essential that it is subject to good governance. We believe that there are four critical elements to the governance that need to be clearly articulated as set out in Figure 13 below: With this in mind, we believe 502 that it is of the utmost importance that the board (or risk oversight committee if it exists) should retain governance over the framework at four key points: • Approval: as discussed in the development of the risk appetite statement • Measurement: there needs to be regular and consistent measurement against the framework and demonstration that the framework is used in real life • Monitoring: the board will need to deal with breaches of the appetite, or tensions that arise from its implementation. If there are no breaches and no tensions then the likelihood is that it has not been properly developed, and • Learning: as discussed in the development section, the board needs to ensure that the organisation learns from the implementation of the risk appetite framework so that it becomes more embedded into the organisation. Learn Area for governance Approve Board Monitor Figure 13 - Governing a Risk Appetite Main components Measure 1. Approve Oversight of setting process 2. Measure Measure and assess risk appetite to identify impact on business performance 3. Monitor Identify breaches of, or tensions arising from risk appetite on a regular basis 4. Learn What was good What needs doing better What needs changing 33
Page 1 and 2: Risk Appetite & Tolerance Guidance
Page 3 and 4: The Chartered Institute of Internal
Page 5 and 6: In writing this paper, we are consc
Page 7 and 8: Executive Summary Principles and ap
Page 9 and 10: Putting it into practice We have so
Page 11 and 12: I Background “What is this all ab
Page 13 and 14: The original BS31100 109 contained
Page 15 and 16: A word of caution 122 The word “a
Page 17 and 18: 203 This framework has several key
Page 19 and 20: Risk Management Maturity 206 Risk m
Page 21 and 22: Multiple risk appetites 209 We beli
Page 23 and 24: III Constructing a risk appetite
Page 25 and 26: Tactical 308 Many organisations str
Page 27 and 28: Control Issues Irrespective of risk
Page 29 and 30: Strategic 319 At a strategic level
Page 31: Sketch 403 Risk appetite should be
Page 35 and 36: VI The journey is not over 601 It i
Page 37 and 38: Appendix A: Determining the risks t
Page 39 and 40: Appendix B: List of respondents to
Page 42: Crowe Horwath Global Risk Consultin

Guidance Paper - The Institute of Risk Management

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?