Executive Summary - The Institute of Risk Management

Risk appetite –principles and approachIt is often said that no companycan make a profit without takinga risk. The same is true for allorganisations: no organisation,whether in the private, publicor third sector can achieve itsobjectives without taking risk.The only question is how muchrisk do they need to take?And yet taking risks withoutconsciously managing thoserisks can lead to the downfall oforganisations. This is the challengethat has been highlighted by thelatest UK Corporate GovernanceCode issued by the FinancialReporting Council in 2010.The following key principles haveunderpinned our work on risk appetite:1 Risk appetite can be complex. Excessivesimplicity, while superficially attractive,leads to dangerous waters: far betterto acknowledge the complexity anddeal with it, rather than ignoring it.2 Risk appetite needs to be measurable.Otherwise there is a risk that anystatements become empty andvacuous. We are not promoting anyindividual measurement approach butfundamentally it is important thatdirectors should understand how theirperformance drivers are impactedby risk. Shareholder value may be anappropriate starting point for someprivate organisations; stakeholdervalue or ‘Economic Value Added’ maybe appropriate for others. We alsoanticipate more use of key risk andcontrol metrics which should be readilyavailable inside or from outside theorganisation. Relevant and accuratedata is vital for this process and weurge directors to ensure that there isthe same level of data governance overthese metrics as there would be overroutine accounting data.7