How do you set and review risk appetite with your board and senior management?

In my experience, risk appetite at an entity level is often more a “feel good” exercise for Boards. Most companies do not quantify and aggregate risk with any rigor, and use qualitative ratings. How do you aggregate colors with any meaning? Risk is assessed to help make business decisions at many levels in a company within the context of a business objective. Risk has to be determined for each decision whether it be a project, strategy or routine process and usually the aggregate risk (by a typology) has very little meaning to operational decisions as risk appetite numbers are rarely disaggregated to arrive at a useable target. Board oversight for ERM is needed but by business objectives, not by siloed risk categories.

I am of the view that it is difficult to arrive at a consensus on risk appetite given the range of attitudes that may exist towards risk taking. Furthermore, when defining a risk appetite there should be a clear understanding of what success looks like for the organization. Boards and management of organizations with a lower risk appetite will usually react differently to their peers with a higher risk appetite. Typically, Boards and Management should agree on risk appetites, whilst at the same time for the risk appetite being meaningful at a practical operational level. The question that begs is – “Are companies just using risk appetite because it is a governance requirement and has no use for purpose”

Risk appetite can manifest in several ways. For instance, it can be defined through specific rules or limits set within the company, such as not investing in high-risk projects above a certain limit, or not keeping more than a certain percentage of cash in a single bank. These rules can be set by various stakeholders including regulators, the Board, or shareholders. Alternatively, risk appetite can also refer to an individual's or decision maker's preference for risk-reward trade-off in a given decision. For example, a high risk appetite may lead to a focus on high-growth, speculative investments, while a low risk appetite may result in a preference for more conservative, steady returns.

In my opinion the risk appetite statement is pivotal to the development of the eventual approach taken and the involvement of multiple stakeholders and different lenses at this stage is critical, quite often this is left to the risk professionals to craft resulting in a lack of ownership or subsequent multiple iterations to make this fit for purpose for the organization .

Developing a risk appetite should extend beyond a mere adherence to regulatory requirements, even though compliance with Solvency 2 or other regulation remains crucial. When risk appetite is integrated into the overall strategy, it proves highly valuable in overseeing the strategy, enhancing resilience, and seizing opportunities, among other beneficial applications.

Risk appetite, like safety, is a judgement of the acceptability of the risk. There are numerous models available to judge / quantify risk acceptability, but it remains subjective. My sense is that when reasonable people come together and have open, honest and frank conversations about risk and it’s acceptability, they generally make good decisions.

Risk appetite is just like food appetite: • it varies on the person (entity) • it varies based on the circumstances • it's difficult to document in full Nonetheless, defining the same is a key part of the overall risk management process. If it's measured, it gets managed. So, detailing and documenting - in the form of RAS (Risk Appetite Statement) and reviewing regularly is a must for any form of effective risk management.

The process typically begins by aligning risk tolerance with business goals, identifying key risks, and assessing their potential impact and likelihood. Regular communication between the board, senior management, and risk experts is crucial to ensure a shared understanding of risk appetite. Periodic reviews, facilitated by clear risk reporting and metrics, allow for adjustments to risk thresholds based on evolving market conditions and internal factors, ensuring that the organization's risk-taking aligns with its overall strategic direction.

I disagree with the use of the 'risk appetite framework' as a concept (maybe a new concept). Risk appetite cannot and should not be a separate framework outside of the enterprise risk management framework. Risk appetite is an integral part of making a well-informed decision about strategy, strategy choices, strategy implementation, and actions to achieve or exceed the strategy and related objectives. The way it is expressed makes it look like a stand-alone activity. Risk appetite does not work in isolation because it's just one part of enterprise risk management.

Setting risk appetite is different company by company and depends on the risk awareness maturity. Control functions help the improving of risk culture to make possible setting the right level of detail of "closed questions" so that the BoD has just to reply yes or no. For example: “do you consider acceptable to receive a fine of 5k€ amount once a year? Yes or No?". Then, when all the "closed questions" are identified and responded, it is possible to create a general statement to summarize the concept of risk appetite, such as “zero appetite for fines” or “fines are acceptable up to 1% of the overall annual revenues” or… With such a clear level of detail the controls can be implemented quite easily, otherwise it is a process to intentions.

In practice, engaging stakeholders and helping the board and senior management understand the importance of risk management is one of the most challenging tasks. As long as everyone is on the same page, everything else becomes, not easy, but easier!

In my experience, Board and it’s committee require great amount of understanding and education about risk and business before commenting upon Riis appetite. Usually all workshops on these topics are mostly driven by one or few members who are super expert drive the meeting with their agenda.

Engaging stakeholders is not just about informing them; it's about collaboration and alignment. By involving all relevant parties in the process, you create a shared understanding and commitment to the risk appetite framework. This collaborative approach ensures that the framework is not only accepted but actively supported across the organisation.

Distinguish between engagement as to determine risk and impacts that exist or can increase when decisions are made . Risk management by the very nature needs a independent dedicated experienced small team to set the tone, determine the scope and actions mitigate, manage, monitor and inform on. Birds eye view. The need is to build a information or intelligence network with in and outside the organisation to scan continuously for risk and change in risk that can affect the company goals. There is simply not enough time to go through a organisation consulting process. This risk in this are simply that this will affect the overall capability to execute risk appetite.

It's all about communication, and being able to position yourself as a business enabler. Key is that you understand what business objectives your stakeholder has and how to translate risk that it resonates with them.

What I have observed through practical experience is that the effective communication of risk appetite and tolerance level tends to be deficient. Understanding of risk appetite and tolerance level between the Board/Management and frontline employees is substantial.

Like anything, understanding and clarifying the business value of doing this goes a long way towards achieving it. So what does having and using a risk framework actually achieve? What is its purpose, the objectives? How will the organisation with this in place compare to one without it? Debating such contentious issues among management and specialists is an excellent way to tease out the most important aspects that resonate, before focusing on the implementation. It combines awareness with engagement, a powerful combination - and, by the way, continuing the dialogue or at least reinvigorating it from time to time helps achieve ad maintain progress. This is not a fire-and-forget weapon.

Communication is key to the success of any risk management strategy. It's not enough to have a well-defined risk appetite; it must be understood and integrated into daily operations. By embedding risk appetite into decision-making processes, you create a culture where risk management is not an afterthought but a fundamental part of how the organisation operates.

This refers to the management of risk And again the need to distinguish between Internal and External Risk Appetite Managing internal risk is embedded in policies and procedures Managing external risk is embedded in the level of confidence and their mandate (authority) in those that determine define and act on same. Policies and Procedures then have the tendency to negatively impact on the organisation and boards ability of to act on sometimes very small windows of opportunity. Mobility Flexibility and Ability to act fast within a clear mandate is in this case extremely important.

Like working with your main stakeholders you have to build champions within the organisation at all levels. You always need to understand "what is important" to your peer you are talking to. The CEO, the developer, the controller. If you understand what's important to them, you can translate the relevant bits and pieces to them in a meaningful way so that they support it.

Zero tolerance is meaningless in practice. Only way to eliminate the risk or bring the level to zero is to not be in the business. Adding to that, every organization that says they have zero appetite for a source of risk is still taking that risk!

What is risk appetite: 10% of the time risk appetite is imposed by laws and regulations, not set – Often risk appetite is imposed by government, regulators, markets, not set by management. Examples include zero-tolerances or limits on safety, bribery and corruption, AML, pollution, sanctions, privacy.

It is a common postulation that if you run away from risk, you run away from its reward. The monitoring of risk and reporting should be done on a consistent and regular basis by risk coordinators to riisk owners. Risk management in most organisations is done at two levels, mostly. I.e., at leadership/board and team management levels. The monitoring and reporting to team management should be done more frequently, e.g., monthly, with more risks reported. The monitoring and reporting to senior leadership should be done quarterly or annually, with only the key risks with the highest impacts and likelihood of occurrence. In managing risks, remember that we have the downside (risk) and the upside (opportunity).

Regular monitoring and reporting are vital to ensure that the risk appetite framework remains effective and relevant. By continuously analysing data and reporting deviations, you can quickly identify and address issues. This proactive approach ensures that risk management is not just a static policy but a dynamic process that adapts to the changing environment.

Effective monitoring requires well thought out built in highlighting of breaches and near breaches in the reporting. Risk can be cumulative or a singular breach event and both are important depending on the line of business and type of risk. Risk exposure can easily be missed in repetitive reports that do not clearly emphasize problematic areas. Therefore well thought out reporting and monitoring are one of the key aspect of this process.

A meeting for the sake of meeting? A report that is not read? With an independent and experienced team that monitors risk a dashboard approach with informed updates is preferred. As example is Formula 1 racing with the driver (the board) and the Pit Stop team that keeps the driver abreast of the vehicle performance (internal) and what is happening on the race course and around the driver (external). Operating any organisation is a fast pace event. There is simply no time for long risk sessions Get a good “engine” and excellent Pit Team with a good comms system!

Like mentioned before, I prefer talking about how resilient an organisation is. Whatever threat might occur a resilient organisation will be quicker in mitigating it and will have a lower impact. So I would monitor resilience continuously and try to find more touchpoints with your executives and board to find the right conversation about "are we doing enough? Where do we need to focus?". Continuous reporting and creating a data-driven risk approach with resilience/maturity as driver is a key to success.

There is a direct relationship between risk appetite and risk tolerance. Risk appetite is the amount of risk that a business is prepared to endeavour to oversee, monitor and contain. Risk tolerance on the other hand, is the actual buffer and/or capital resources which a business has to absorb losses emanating from ineffective management of risk appetite. Where the resources are eroded, It means that tolerance is exceeded.

What is risk appetite: 10% of the time risk appetite is the gentlemen’s agreement between Board and management – Boards have an important oversight role and help them set the direction and boundaries for management decision making. Those management decision making boundaries is risk appetite. Examples include deal approvals only by Board above a certain limit, limits on holding percentage of cash in certain pre-approved banks, market risk limits, credit risk limits, insurance thresholds, rules on credit limits for certain types of customers, limits on investments in different countries, etc.

Risk is not static, and neither should be the risk appetite framework. Regular reviews and updates ensure that the framework remains aligned with the organisation's objectives and capabilities. This adaptability is essential in a rapidly changing business environment, where new risks can emerge, and existing risks can evolve.

The more touchpoints you have with your business stakeholder the better. Situations change, budgets change, risks change and also the risk tolerance and appetite. So finding regular touchpoints can help adopting some agile techniques to allow better adjustment of your risk program and metrics.

When setting and reviewing risk appetite with your board and senior management it’s worth keeping in mind this quote from Mark Twain: "It ain't what you don't know that gets you into trouble. It's what you know for sure that just ain't so." I'd also add that you probably don't know what your biggest threats will be as they'll be different from what has happened historically. This is one of the drawbacks of the most commonly used Risk Appetite approaches. People are probably working now on the biggest risks to your organisation..... some of the biggest risks (and opportunities) will still be in R&D and not on the register!!

What is risk appetite: 80% of the time risk appetite is the risk reward trade-off for a specific decision – The key is making uncertainty around decisions presented to the Board transparent to allow decision makers choose the alternative which offers the most appropriate risk reward balance according to their individual appetites.

I feel it is important to communicate the risk appetite to the board and senior management in a clear and concise way by way of statements. This will help to ensure that they understand the level of risk that the organization is willing to accept. This should be reviewed regularly to ensure they are still aligned with the organizations objectives and risk profile.