Executive Summary - The Institute of Risk Management

Five tests for risk appetiteframeworksIn summary, there are five tests thatDirectors should apply in reviewing theirorganisation’s risk appetite framework:1 Do the managers making decisionsunderstand the degree to which they(individually) are permitted to exposethe organisation to the consequencesof an event or situation? Any riskappetite framework needs to bepractical, guiding managers to makerisk-intelligent decisions.2 Do the executives understand theiraggregated and interlinked level ofrisk so they can determine whetherit is acceptable or not?3 Do the board and executive leadershipunderstand the aggregated andinterlinked level of risk for theorganisation as a whole?4 Are both managers and executives clearthat risk appetite is not constant? It maychange as the environment and businessconditions change. Anything approvedby the board must have some flexibilitybuilt in.5 Are risk decisions made with fullconsideration of reward? The riskappetite framework needs to helpmanagers and executives take anappropriate level of risk for thebusiness, given the potential for reward.We believe that by following the guidanceset out in detail in our document, directorswill be able to be confident that they canpass all of those five tests.“The risk appetite statement isgenerally considered the hardestpart of any Enterprise RiskManagement implementation.However, without clearly defined,measurable tolerances the wholerisk cycle and any risk frameworkis arguably at a halt.”Jill Douglas, Head of Risk,Charterhouse Risk Management14