When it comes to creating a practical and useful risk appetite statement – one that stakeholders will use day to day to guide decisions around risk and opportunity – where would you start?
This was one of many questions we asked our members as part of a global benchmarking study into risk appetite.
Our report, Risk appetite – common goals; diverse approaches, contains insights from more than 130 practising professionals around the world. We interviewed and surveyed leaders from the United Kingdom, Europe, North America, Africa, the Middle East, Asia and Australia to deliver a comprehensive view of risk appetite current practice, across multiple industries.
Our survey started with a simple question about risk appetite implementation.
We asked if organisations were or were not currently using risk appetite and, if they were, how they were implementing it.
Just under 20% of risk managers surveyed said their organisations do not currently use risk appetite. However, among this group, three quarters said they were planning to work on it within the coming year.
But the method and maturity of execution varied.
Here are just four.
1. Qualitative statements and quantitative metrics
50% of risk managers said their organisation uses a mix of qualitative statements and quantitative metrics to implement risk appetite. While the majority of this group have multiple statements aligning to different risk categories, nuances exist. Most companies prepare statements for each category, but a few write statements for individual top risks instead.
In our in-depth interviews, we found this choice tended to influence reporting outputs, as well as how appetite could be cascaded across the enterprise profile and used to evaluate risk on future projects.
2. Appetite via top risks
Where a fixed list of top risks is used, reporting is able to be very insightful at the individual risk level. These risk managers had great success driving tangible conversations around the risks that mattered most to the business.
For companies whose major risks remain consistent, the approach helps get everyone focusing on the same long-term goals and discussing real business impacts – not risk theory. A strong example of how this approach helps translate appetite into action can be found in the case study 12 appetite dashboards for 12 top risks, published in our report.
3. Appetite via category
On the other hand, appetite statements at the category level allowed risk managers greater flexibility to customise the reporting narrative from one period to the next. Typically, these risk managers told us they either integrated appetite into their broader risk reporting or used appetite as a tool in the background (as opposed to creating specific appetite dashboards). Often, the risk managers we interviewed who were using this approach told us they would select 1 or 2 featured or emerging risks (in areas like cyber, climate, artificial intelligence, for e.g.) to deep dive into for each reporting session.
This was particularly prevalent at organisations where board meetings occurred quarterly or more, and risk managers feared report fatigue.
In these cases, boards learned to expect reporting on routine risks only if a risk moved outside of appetite or reached a warning trigger. The case study, Top down, bottom up, published in our full report, outlines a comprehensive implementation of appetite via category at a large listed business.
4. Appetite to guide future decisions
Where quantitative metrics define thresholds at a category level, appetite is able to be used very effectively as a decision making tool for acquisitions, deals and innovations and other new ventures.
Several risk managers we spoke to emphasised the value appetite had played—or was starting to play—in assessing opportunities for the business.
Companies focusing on upside risk are beginning to recognise the potential of appetite as a framework through which to evaluate future prospects. In our observations, this stage usually comes later in the risk appetite journey.
First, organisations focus on measuring existing risks. Then, by demonstrating the power of the data and insights they are collecting, risk managers are increasingly invited to be part of the strategic conversation.
This occurred in the case study A single slide; a single statement, published in our full report, where an upside appetite statement was added to the approach a couple of years after initial implementation. In the case study Dual statements to protect dual priorities, our interviewed risk manager also notes their company now assesses all new potential ventures against six straightforward, enterprise-wide appetite metrics.
Eight tried-and-tested approaches
Our full risk appetite report, available exclusively to Risk Leadership Network members, contains eight featured case studies collected from our global risk community. Between them, they address all of the major priorities for appetite identified by risk managers for the coming year, and more.
They also include detailed steps to guide risk managers through the implementation process, and handy output summaries to help risk managers find an approach that suits their organisation’s maturity level and needs.
Want to know more?
If you’d like to request a copy of our abridged risk appetite report and find out more about Risk Leadership Network membership, talk to us about becoming a member today.
