Risk Appetite – what does ‘good’ look like?

Risk Appetite – what does ‘good’ look like?

Let’s begin with a definition of Risk Appetite. ISO 31000 (the international risk management standard) defines risk appetite as “the amount and type of risk that an organisation is prepared to pursue, retain or take”. Adding to this, we could say that risk appetite is the amount and type of risk that we’re willing to accept / take in order to achieve our objectives.

Risk Appetite is a fundamental component of any organisation’s risk management framework. The diagram below shows an example of components which may be in your risk management framework.

  • Risk Culture – Having an embedded and operationalised approach to risk management should assist with establishing and maintaining a strong risk management culture where risks are identified, managed and escalated accordingly.
  • Risk Assessments – Your risk assessment process will identify your key controls. These key controls should be monitored to ensure the organisation can stay within its stated appetite.
  • Policies – Similar to risk assessments, risk appetite is operationalised through the policies your organisation has in place. Your policies may already include limits or thresholds which could essentially be your risk appetite statements.
  • Strategic Plan – Your risk appetite is all about the levels and type of risk you can accept in order to achieve your objectives, and your objectives should be laid out in your strategic plan. When establishing or reviewing your strategic plan, it is best practice to also review and consider your stated risk appetite.
  • Reporting – Your risk appetite statements and metrics should form a key part of your reporting processes. Breaches of risk appetite should be escalated appropriately in relation to the size and scale of your organisation.
  • Compliance – This is often forgotten about when setting risk appetite. Ensure that your risk appetite statements and associated metrics align with your organisation’s compliance obligations, and that they don’t result in you accidentally stating that you are willing to accept a breach of an important rule or regulation.

What should my Risk Appetite look like?

Risk Appetite is commonly expressed as a series of qualitative Risk Appetite Statements and associated Risk Appetite Metrics (often referred to as Key Risk Indicators).

Risk Appetite Statements should be:

  • Comprehensive and linked to the organisation’s strategic plan (where applicable).
  • Clear and jargon-free such that you can easily communicate them to stakeholders (internal and external).
  • Forward looking to reflect potential growth, change in services / offering, etc.
  • Linked to the risk categories you use in your organisation.
  • Owned by a senior individual in the organisation.

Risk Appetite Metrics (or KRIs) should:

  • Be linked to an overarching Risk Appetite Statement.
  • Have associated thresholds and limits (explained in the diagram below).
  • Have a clear and consistent way of how they will be calculated (e.g., timelines).
  • Be owned by a named individual within the organisation.

An Example:

An organisation might have a risk appetite statement that states “we will only offer products / services that satisfy the needs of our customers / members / service users. All of our product / service offerings must also be compliant with all relevant regulation and legislation.”

The associated metrics might look something like the following:

  • The number of formal complaints received in a 30-day period.
  • The number of formal complaints received per 100 members / customers / service users in a 30-day period.
  • The number of product / service compliance issues identified in a 30-day period.

Conclusion:

When considering risk appetite, it is important to link it back to the regulatory environment in which your organisation must operate, to your strategic plan, and to your organisation’s risk management capability. This is the ability to manage risk exposures within your desired limits (metrics) and can include available skills and knowledge in the organisation, the controls you have in place, risk culture in the organisation and much more.

When establishing or updating your risk appetite statements and associated metrics, you should consider the appropriate governance forum at which this should be done – e.g., consider getting your board of directors involved in the process.

Finally, you should review your risk appetite on at least an annual basis.

More information

Click here to request a demo to learn more about how CalQRisk can help you with the tracking and reporting of your risk appetite and metrics.

Recent News

Federation of Irish Sport announce three-year partnership CalQRisk

The Federation of Irish Sport is delighted to announce GRC software provider CalQRisk as its latest partner. The ...
Read More

10 Things You Need To Do If You Are Outsourcing an Activity

There is a growing trend towards organisations relying on outsourced service providers (OSPs) to deliver (often key) elements ...
Read More

Oaklee Housing implement CalQRisk

Oaklee Housing, one of Ireland’s most ambitious providers of customer-focused housing and support services have partnered with CalQRisk ...
Read More

The Five Pillars of Operational Resilience

The Five Pillars of Operational Resilience The Basel Committee (on Banking supervision) defines operational resilience as “the ability ...
Read More

The Charitable Purpose – the Touchstone for the Organisation

The Charitable Purpose – the Touchstone for the Organisation Many corporate mission statements are simply clever PR, designed ...
Read More

Webinar – Fundamentals of Anti-Money Laundering for Credit Unions

Webinar - Fundamentals of Anti-Money Laundering for Credit Unions We have teamed up with ID-Pal and Corrib Point to organise a CPD ...
Read More

10 Things you should know about Operational Resilience

10 Things you should know about Operational Resilience   Operational Resilience is the ability of an organisation to ...
Read More

Evidencing compliance with the Charities Governance Code – Webinar

Evidencing compliance with the Charities Governance Code - Webinar Good governance involves putting in place systems and processes ...
Read More

Risk Appetite – what does ‘good’ look like?

Risk Appetite - what does 'good' look like? Let’s begin with a definition of Risk Appetite. ISO 31000 ...
Read More

Charities Governance Code – Principle 4: Exercising Control… what’s that all about?

CalQRisk Analysis - Inside the Charities Governance Code Charities Governance Code – Principle 4: Exercising Control … what’s ...
Read More