Risk Appetite – what does ‘good’ look like?

Risk Appetite – what does ‘good’ look like?

Let’s begin with a definition of Risk Appetite. ISO 31000 (the international risk management standard) defines risk appetite as “the amount and type of risk that an organisation is prepared to pursue, retain or take”. Adding to this, we could say that risk appetite is the amount and type of risk that we’re willing to accept / take in order to achieve our objectives.

Risk Appetite is a fundamental component of any organisation’s risk management framework. The diagram below shows an example of components which may be in your risk management framework.

  • Risk Culture – Having an embedded and operationalised approach to risk management should assist with establishing and maintaining a strong risk management culture where risks are identified, managed and escalated accordingly.
  • Risk Assessments – Your risk assessment process will identify your key controls. These key controls should be monitored to ensure the organisation can stay within its stated appetite.
  • Policies – Similar to risk assessments, risk appetite is operationalised through the policies your organisation has in place. Your policies may already include limits or thresholds which could essentially be your risk appetite statements.
  • Strategic Plan – Your risk appetite is all about the levels and type of risk you can accept in order to achieve your objectives, and your objectives should be laid out in your strategic plan. When establishing or reviewing your strategic plan, it is best practice to also review and consider your stated risk appetite.
  • Reporting – Your risk appetite statements and metrics should form a key part of your reporting processes. Breaches of risk appetite should be escalated appropriately in relation to the size and scale of your organisation.
  • Compliance – This is often forgotten about when setting risk appetite. Ensure that your risk appetite statements and associated metrics align with your organisation’s compliance obligations, and that they don’t result in you accidentally stating that you are willing to accept a breach of an important rule or regulation.

What should my Risk Appetite look like?

Risk Appetite is commonly expressed as a series of qualitative Risk Appetite Statements and associated Risk Appetite Metrics (often referred to as Key Risk Indicators).

Risk Appetite Statements should be:

  • Comprehensive and linked to the organisation’s strategic plan (where applicable).
  • Clear and jargon-free such that you can easily communicate them to stakeholders (internal and external).
  • Forward looking to reflect potential growth, change in services / offering, etc.
  • Linked to the risk categories you use in your organisation.
  • Owned by a senior individual in the organisation.

Risk Appetite Metrics (or KRIs) should:

  • Be linked to an overarching Risk Appetite Statement.
  • Have associated thresholds and limits (explained in the diagram below).
  • Have a clear and consistent way of how they will be calculated (e.g., timelines).
  • Be owned by a named individual within the organisation.

An Example:

An organisation might have a risk appetite statement that states “we will only offer products / services that satisfy the needs of our customers / members / service users. All of our product / service offerings must also be compliant with all relevant regulation and legislation.”

The associated metrics might look something like the following:

  • The number of formal complaints received in a 30-day period.
  • The number of formal complaints received per 100 members / customers / service users in a 30-day period.
  • The number of product / service compliance issues identified in a 30-day period.

Conclusion:

When considering risk appetite, it is important to link it back to the regulatory environment in which your organisation must operate, to your strategic plan, and to your organisation’s risk management capability. This is the ability to manage risk exposures within your desired limits (metrics) and can include available skills and knowledge in the organisation, the controls you have in place, risk culture in the organisation and much more.

When establishing or updating your risk appetite statements and associated metrics, you should consider the appropriate governance forum at which this should be done – e.g., consider getting your board of directors involved in the process.

Finally, you should review your risk appetite on at least an annual basis.

More information

Click here to request a demo to learn more about how CalQRisk can help you with the tracking and reporting of your risk appetite and metrics.

Recent News

CalQRisk wins CIR Risk Management Product of the Year

CalQRisk, an Irish-developed software application, has won Risk Management Product of the Year in the recent Risk Management ...
Read More
Database

How to Prepare for Cyber Attacks

The potential for cyber-attacks is an ever-increasing concern. Daily, there are stories about organisations, both large and small ...
Read More
Central bank of ireland building

Central Bank of Ireland releases Discussion Paper on the Review of the Consumer Protection Code (CPC)

The Central Bank of Ireland has released a Discussion Paper on the review of the Consumer Protection Code. ...
Read More

CalQRisk attends the MATs Summit 2022

CalQRisk is delighted to be exhibiting at the MATs Summit 2022 in Stratford-Upon-Avon on October 13th and 14th. ...
Read More

CalQRisk attends the Charities Leadership Summit 2022

CalQRisk will be in attendance at the Charities Leadership Summit on September 15th, 2022.   This year's summit ...
Read More
Brokers Ireland Logo

CalQRisk attends the Brokers Ireland Meet the Market Day 2022

CalQRisk will be in attendance at the Brokers Ireland Meet the Market Day at the RDS on September ...
Read More

CalQRisk is Attending the CUMA Autumn Conference

CalQRisk will be attending the CUMA Autumn Conference on Sustainability and Strategy. The conference takes place on September  ...
Read More
laptops on a table doing risk reports

What is Operational Resilience?

Many organisations aim to be operationally resilient, however, what this means and how to practically achieve it can ...
Read More

CalQRisk Shortlisted for CIR Risk Management Awards 2022

CalQRisk is delighted to be shortlisted for the Risk Management Product of the Year at the CIR Risk ...
Read More

Featured Risk and the Failure to Establish a Risk Conscious Culture

One of the first banking scandals of scale was the fraudulent Treasury securities bids by Salomon Brothers traders ...
Read More