Risk Appetite – what does ‘good’ look like?

Risk Appetite – what does ‘good’ look like?

Let’s begin with a definition of Risk Appetite. ISO 31000 (the international risk management standard) defines risk appetite as “the amount and type of risk that an organisation is prepared to pursue, retain or take”. Adding to this, we could say that risk appetite is the amount and type of risk that we’re willing to accept / take in order to achieve our objectives.

Risk Appetite is a fundamental component of any organisation’s risk management framework. The diagram below shows an example of components which may be in your risk management framework.

  • Risk Culture – Having an embedded and operationalised approach to risk management should assist with establishing and maintaining a strong risk management culture where risks are identified, managed and escalated accordingly.
  • Risk Assessments – Your risk assessment process will identify your key controls. These key controls should be monitored to ensure the organisation can stay within its stated appetite.
  • Policies – Similar to risk assessments, risk appetite is operationalised through the policies your organisation has in place. Your policies may already include limits or thresholds which could essentially be your risk appetite statements.
  • Strategic Plan – Your risk appetite is all about the levels and type of risk you can accept in order to achieve your objectives, and your objectives should be laid out in your strategic plan. When establishing or reviewing your strategic plan, it is best practice to also review and consider your stated risk appetite.
  • Reporting – Your risk appetite statements and metrics should form a key part of your reporting processes. Breaches of risk appetite should be escalated appropriately in relation to the size and scale of your organisation.
  • Compliance – This is often forgotten about when setting risk appetite. Ensure that your risk appetite statements and associated metrics align with your organisation’s compliance obligations, and that they don’t result in you accidentally stating that you are willing to accept a breach of an important rule or regulation.

What should my Risk Appetite look like?

Risk Appetite is commonly expressed as a series of qualitative Risk Appetite Statements and associated Risk Appetite Metrics (often referred to as Key Risk Indicators).

Risk Appetite Statements should be:

  • Comprehensive and linked to the organisation’s strategic plan (where applicable).
  • Clear and jargon-free such that you can easily communicate them to stakeholders (internal and external).
  • Forward looking to reflect potential growth, change in services / offering, etc.
  • Linked to the risk categories you use in your organisation.
  • Owned by a senior individual in the organisation.

Risk Appetite Metrics (or KRIs) should:

  • Be linked to an overarching Risk Appetite Statement.
  • Have associated thresholds and limits (explained in the diagram below).
  • Have a clear and consistent way of how they will be calculated (e.g., timelines).
  • Be owned by a named individual within the organisation.

An Example:

An organisation might have a risk appetite statement that states “we will only offer products / services that satisfy the needs of our customers / members / service users. All of our product / service offerings must also be compliant with all relevant regulation and legislation.”

The associated metrics might look something like the following:

  • The number of formal complaints received in a 30-day period.
  • The number of formal complaints received per 100 members / customers / service users in a 30-day period.
  • The number of product / service compliance issues identified in a 30-day period.

Conclusion:

When considering risk appetite, it is important to link it back to the regulatory environment in which your organisation must operate, to your strategic plan, and to your organisation’s risk management capability. This is the ability to manage risk exposures within your desired limits (metrics) and can include available skills and knowledge in the organisation, the controls you have in place, risk culture in the organisation and much more.

When establishing or updating your risk appetite statements and associated metrics, you should consider the appropriate governance forum at which this should be done – e.g., consider getting your board of directors involved in the process.

Finally, you should review your risk appetite on at least an annual basis.

More information

Click here to request a demo to learn more about how CalQRisk can help you with the tracking and reporting of your risk appetite and metrics.

Recent News

The Golden Thread – Governance, Risk & Compliance

A joined-up approach to governance, risk and compliance (GRC) is something all GRC practitioners aspire to – but, ...
Read More

Dark Patterns, Hidden in Plain Sight

If you’ve spent any time on the internet, chances are you will have experienced ‘Dark Patterns’ and may ...
Read More

Over 100 Credit Unions Now Using CalQRisk

CalQRisk now has over 100 credit unions actively using their Governance, Risk Management and Compliance solution across the ...
Read More
risk management words

Governance, Risk and Compliance – An Integrated Process

Three-letter acronyms. Love them or hate them, we can appreciate that they are convenient shortcuts. Many of us ...
Read More

Paralympics Ireland choose CalQRisk to streamline their Governance, Risk & Compliance efforts 

Paralympics Ireland has recently implemented the CalQRisk solution to streamline their Governance, Risk Management and Compliance efforts.  Paralympics ...
Read More

Changes to ISO 27001

ISO 27001 is an international standard that outlines the requirements for an information security management system (ISMS). It ...
Read More

DORA – What you need to know

The purpose of the EU’s new Digital Operational Resilience Act (DORA) is to ensure the safety and security ...
Read More

ILCU and CalQRisk form Alliance

The Irish League of Credit Unions (ILCU) has collaborated with CalQRisk to offer a best-in-class governance, risk management ...
Read More
Database

Top Cyber Risks in 2023

In 2023, there are several cyber risks of which organisations and individuals should be aware. These risks can ...
Read More
office meeting at sunrise

10 Things to Ask When Outsourcing / Choosing a Supplier

Many organisations choose to outsource critical functions or services to third parties/contractors. However, outsourcing the work does not ...
Read More