In a previous post we looked at the breadth of activities covered by an effective organisational risk framework – illustrating the competency needed in the leadership team, but not offering a view on prioritising. Here we look at risk appetite as being a good starting point for driving value from risk management processes – whether or not a business has a mature risk management process in place to identify, safeguard and plan for key risks.
Why start with risk appetite?
There is a view, which we share, that too many businesses limit the value of their risk management processes by setting narrow expectations: just managing risk rather than managing risk and informing planning & decision making. If this is the limit of ambition for an organisation’s risk culture then there is little prospect of generating value through entrepreneurial leadership (see previous post for more on this).
A value adding risk culture, led from the top, will provide answers for:
- What risks are acceptable to implement our strategy?
- Where does our knowledge and expertise give a competitive advantage by accepting risk?
- What risks will we not tolerate?
- How does our risk profile fit our strategy and objectives?
In the absence of an ambitious risk culture, risk management will generate just half the answer to the last of these questions. Working to a predefined cycle the leadership team will be provided with regular updates to be able to take corrective action. At best information may also be relevant to an upcoming decision, providing a degree of risk intelligence. At worst, and if the first three questions have not been addressed, such processes can also lead to a false sense of security.
A better way to look at the above questions is in the context of a risk appetite framework.
Risk Appetite – Chicken soup or Strawberries?
Like true appetite, risk appetite is situational – if the business is feeling vulnerable the appetite may be much less adventurous than when enjoying buoyant conditions. This means that the pace and timing of information on risk needs to dovetail with other decision making and planning activities.
Here we’re taking the risk appetite framework to address both risk appetite: the range within which a business chooses to work, and risk tolerability: the range outside of which a business will not tolerate exposure. In framework terms, it is important the two are aligned as far as possible. For a given metric, the appetite defines the chosen area – and can be a source of competitive advantage where this extends further than other businesses. Operating beyond the threshold for appetite, but within tolerable limits indicates a requirement to reduce risk to as close to the appetite threshold as is reasonably practicable.
The risk appetite framework provides the basis for testing strategic objectives, and taking risk intelligent decisions. When integrated with the risk management processes (by calibrating the risk matrix for example), it allows risk accountabilities within the business to be actionable.
Defrosting Risk Management
At risk of pushing food analogy too far, a risk management process which is not adding value is a bit like a frozen meal. There is value there, but fresh is better and it needs to be defrosted to satisfy the appetite. An effective risk culture, underpinned by a risk appetite framework allows the business to work with fresh produce.
For some, this represents a paradigm shift to their approach to risk. Recognising the need for change, the options available and how best to move forward is challenging and set against other priorities can languish in the “too difficult” pile. However the first steps need not be difficult. A facilitated discussion with the leadership team can sketch out a risk appetite statement very quickly. Consulting with key stakeholders, both internal and external, will provide new insights into strategy formulation and decision making and better communication soon start thawing the risk processes. The leadership team can build a more dynamic risk culture out across the business – setting expectation and putting suitable training, risk champions and coaching in place.