Risk Appetite – what does ‘good’ look like?

Risk Appetite – what does ‘good’ look like?

Let’s begin with a definition of Risk Appetite. ISO 31000 (the international risk management standard) defines risk appetite as “the amount and type of risk that an organisation is prepared to pursue, retain or take”. Adding to this, we could say that risk appetite is the amount and type of risk that we’re willing to accept / take in order to achieve our objectives.

Risk Appetite is a fundamental component of any organisation’s risk management framework. The diagram below shows an example of components which may be in your risk management framework.

  • Risk Culture – Having an embedded and operationalised approach to risk management should assist with establishing and maintaining a strong risk management culture where risks are identified, managed and escalated accordingly.
  • Risk Assessments – Your risk assessment process will identify your key controls. These key controls should be monitored to ensure the organisation can stay within its stated appetite.
  • Policies – Similar to risk assessments, risk appetite is operationalised through the policies your organisation has in place. Your policies may already include limits or thresholds which could essentially be your risk appetite statements.
  • Strategic Plan – Your risk appetite is all about the levels and type of risk you can accept in order to achieve your objectives, and your objectives should be laid out in your strategic plan. When establishing or reviewing your strategic plan, it is best practice to also review and consider your stated risk appetite.
  • Reporting – Your risk appetite statements and metrics should form a key part of your reporting processes. Breaches of risk appetite should be escalated appropriately in relation to the size and scale of your organisation.
  • Compliance – This is often forgotten about when setting risk appetite. Ensure that your risk appetite statements and associated metrics align with your organisation’s compliance obligations, and that they don’t result in you accidentally stating that you are willing to accept a breach of an important rule or regulation.

What should my Risk Appetite look like?

Risk Appetite is commonly expressed as a series of qualitative Risk Appetite Statements and associated Risk Appetite Metrics (often referred to as Key Risk Indicators).

Risk Appetite Statements should be:

  • Comprehensive and linked to the organisation’s strategic plan (where applicable).
  • Clear and jargon-free such that you can easily communicate them to stakeholders (internal and external).
  • Forward looking to reflect potential growth, change in services / offering, etc.
  • Linked to the risk categories you use in your organisation.
  • Owned by a senior individual in the organisation.

Risk Appetite Metrics (or KRIs) should:

  • Be linked to an overarching Risk Appetite Statement.
  • Have associated thresholds and limits (explained in the diagram below).
  • Have a clear and consistent way of how they will be calculated (e.g., timelines).
  • Be owned by a named individual within the organisation.

An Example:

An organisation might have a risk appetite statement that states “we will only offer products / services that satisfy the needs of our customers / members / service users. All of our product / service offerings must also be compliant with all relevant regulation and legislation.”

The associated metrics might look something like the following:

  • The number of formal complaints received in a 30-day period.
  • The number of formal complaints received per 100 members / customers / service users in a 30-day period.
  • The number of product / service compliance issues identified in a 30-day period.

Conclusion:

When considering risk appetite, it is important to link it back to the regulatory environment in which your organisation must operate, to your strategic plan, and to your organisation’s risk management capability. This is the ability to manage risk exposures within your desired limits (metrics) and can include available skills and knowledge in the organisation, the controls you have in place, risk culture in the organisation and much more.

When establishing or updating your risk appetite statements and associated metrics, you should consider the appropriate governance forum at which this should be done – e.g., consider getting your board of directors involved in the process.

Finally, you should review your risk appetite on at least an annual basis.

More information

Click here to request a demo to learn more about how CalQRisk can help you with the tracking and reporting of your risk appetite and metrics.

Recent News

6 things you need to know about the Individual Accountability Framework (IAF)

The Central Bank of Ireland has recently released regulations and guidance on the Individual Accountability Framework (IAF). Here ...
Read More

Paysend chooses CalQRisk as their Risk Management Solution

Paysend, a next generation integrated global payment ecosystem, has recently implemented the CalQRisk solution in order to enhance ...
Read More

ESG and Sustainability Reporting

The practice of businesses promoting sustainability and social responsibility in their operations can be traced back to the ...
Read More

CalQRisk Wins Best RegTech Solution at National Fintech Awards

CalQRisk, a leading provider of Governance, Risk & Compliance solutions has won the ‘Best Regtech Solution Award’ at ...
Read More

CalQRisk shortlisted in National Fintech Awards

The CalQRisk solution is shortlisted for ‘Best Regtech Solution Award’ at the inaugural National Fintech Awards. The National ...
Read More

CalQRisk shortlisted in 2023 CIR Risk Awards

Having won ‘Risk Management Product of the Year’ at the 2022 CIR Risk Management Awards, CalQRisk is now ...
Read More

From Risk Capacity to Risk Appetite

Risk Capacity is the maximum amount of risk that an organisation is technically able to assume before breaching ...
Read More

SMT automates their approach to Risk Management with CalQRisk

SuMi TRUST Global Asset Services (“SMT”), a subsidiary of Sumitomo Mitsui Trust Bank Limited, one of the largest ...
Read More

Digital Operational Resilience for the Financial Sector Act (DORA)

The Digital Operational Resilience Act (DORA) entered into force on 16th  January 2023. It outlines EU regulations for information ...
Read More
Database

8 Things to Consider in a Data Breach Response

A data breach can lead to reputational damage, financial losses and much more. By effectively preventing and investigating ...
Read More