Executive Summary - The Institute of Risk Management

More documents

Recommendations

Info

3 Risk appetite is not a single, fixedconcept. There will be a range ofappetites for different risks which needto align and these appetites may wellvary over time: the temporal aspect ofrisk appetite is a key attribute to thiswhole development.4 Risk appetite should be developedin the context of an organisation’srisk management capability, whichis a function of risk capacity andrisk management maturity. Riskmanagement remains an emergingdiscipline and some organisations,irrespective of size or complexity, do itmuch better than others. This is in partdue to their risk management culture(a subset of the overall culture), partlydue to their systems and processes,and partly due to the nature of theirbusiness. However, until an organisationhas a clear view of both its risk capacityand its risk management maturity itcannot be clear as to what approachwould work or how it should beimplemented.5 Risk appetite must take into accountdiffering views at a strategic, tacticaland operational level. In other words,while the UK Corporate GovernanceCode envisages a strategic view ofrisk appetite, in fact risk appetiteneeds to be addressed throughoutthe organisation for it to make anypractical sense.6 Risk appetite must be integrated withthe control culture of the organisation.Our framework explores this by lookingat both the propensity to take risk andthe propensity to exercise control. Theframework promotes the idea thatthe strategic level is proportionatelymore about risk taking than exercisingcontrol, while at the operational levelthe proportions are broadly reversed.Clearly the relative proportions willdepend on the organisation itself, thenature of the risks it faces and theregulatory environment within whichit operates.8
Risk and controlWe think that this dual focus ontaking risk and exercising control isboth innovative and critical to a properunderstanding of risk appetite and risktolerance. The innovation is not in lookingat risk and control – all boards do that.The innovation is in looking at theinteraction of risk and control as part ofdetermining risk appetite. Proportionatelymore time is likely to be spent on risktaking at a strategic level than at anoperational level, where the focus ismore likely to be on the exercise ofcontrol. One word of caution though,we are not equating strategy with boardlevel and operations with lower levelsof the organisation.A board will properly want to knowthat its operations are under controlas much as it wants to oversee thedevelopment and implementation ofstrategy. In the detailed paper we haveincluded a few suggestions as to howboards might like to consider these dualresponsibilities. Above all, we are verymuch focused on the need to take riskas much as the traditional pre-occupationof many risk management programmes,which is the avoidance of harm.Hungry for risk?The word “appetite” brings connotations of food, hunger and satisfying one’sneeds. We think that this metaphor is not always helpful in understanding thephrase “risk appetite”. When those two words appear together we think it ismore appropriate to think in terms of ‘fight or flight’ responses to perceived risks.Most animals, including human beings, have a ‘fight or flight’ response to risk.In humans this can be over-ruled by our cognitive processes. Our interpretation ofrisk appetite is that it represents a corporate version of exactly the same instinctsand cognitive processes. However, since these instincts are not ”hardwired“ in ourcorporate “nervous and sensory” systems we use risk management as a surrogate.9
Page 1 and 2: AppetiteRisk & ToleranceExecutive S
Page 3 and 4: ForewordRisk appetite today is a co
Page 5 and 6: All successful organisations need t
Page 7 and 8: We do not regard this guidanceas th
Page 9: Risk appetite -principles and appro
Page 13 and 14: We believe that the appetite will b
Page 15 and 16: Flexibility - all of this needs to
Page 17 and 18: Questions forthe boardroomBelow we
Page 19 and 20: Governing a risk appetite20 Is the

Executive Summary - The Institute of Risk Management

Create successful ePaper yourself

Delete template?

Save as template?