Guidance Paper - The Institute of Risk Management

All of this needs to be carried
503 out with the basic precept in
mind that risk appetite can
and will change over time as,
for example, the economy shifts from
boom to bust, or as cash reserves fall. In
other words, breaches of risk appetite may
well reflect a need to reconsider risk
appetite part way through a reporting
cycle as well as a more regular review on
an annual cycle. Rapid changes in
circumstances, for example as were
witnessed during the financial crisis in
2008/9, would certainly indicate a need for
an organisation to re-appraise its risk
appetite.
Our expectation is that the risk
504 appetite document will be at
the heart of the organisation.
It will be informed by the
vision of the company, and in turn will
inform the way in which the operation
will be managed as shown in Figure 14.
Propensity to take control
Risk Assurance
Controls
Process
Board and Senior
Management
Vision
Strategy
DATA
Policy
Operating
Model
Risk Appetite
Propensity to exercise risk
This view of the criticality of
505 data supporting information
flows in the organisation also
underpins the importance of
developing actionable management
information. Traditionally the data and
information used in most organisations is
oriented to accounting and reporting. It is
our view that data governance from a risk
management perspective is becoming a
key issue underpinning the development
of relevant and effective risk appetite
frameworks. Measurement will only work
where the underlying data sets are
reliable, accurate, complete and timely
with minimal off-line manipulation.
Exactly like those used for accounting
and reporting systems.
This is a new area of
506 endeavour for many
organisations and their
boards. The House of Lords
Economic Affairs Committee addressed a
recommendation made by Sir David
Walker in his review of governance of
banks and other financial institutions. It is
neither the purpose nor the remit of this
paper to comment on this, except to the
extent that if a board institutes such a
committee, we believe that risk appetite
and risk tolerance should be high on their
agenda
“We strongly support the development
of separate risk committees in banks
and major financial institutions. Other
large companies should institute them
where appropriate. Such committees
will increasingly require specialist skills
and external advice. This advice should
not be provided by the firm which is the
company’s auditor.”
Source: House of Lords, Economic Affairs
Committee. Second Report: “Auditors:
Market concentration and their role”.
Figure14 - Risk Appetite In the Organisation
Governing a
risk appetite -
questions for the
boardroom
• Has the board played an
active part in the approval,
measurement, monitoring and
learning from the risk appetite
process
• To what extent did the board
identify tensions arising from
the implementation of the risk
appetite
• How much resource has it taken
to develop and implement
risk appetite Was this level
of resource appropriate Does
it need to be amended going
forward
• Does the board have, or does it
need, a risk committee to, inter
alia, oversee the development
and monitoring of the risk
appetite framework
• Is the board satisfied with
the arrangements for data
governance pertaining to
risk management data and
information
34