How are risk leaders engaging with the board on risk appetite?

Communicating with the board and senior leaders about risk can represent a difficult task, especially if you work at a less mature company where concepts like risk appetite are not well understood. Even mature organisations face the obstacle of business leaders still perceiving risk management as a potential blocker to business objectives.

It is important to ensure that senior leaders are aware of risk appetite and its purpose within the business – is the organisation risk-averse, with a lower appetite for risk-taking behaviour across its principal risk categories, or does it want to encourage the taking of risks in the interest of pursuing opportunities? Do different business units and divisions of the company even have different appetites, and are senior leaders aware and comfortable with this?

Download our full guide to risk appetite and how to implement it - you might like to share it with senior leaders who aren't aware of the purpose of risk appetite in your business.

One organisation we spoke to sells its risk appetite framework to the board on two bases:

1. Stronger alignment was needed between business decisions and strategy; and
2. Risk management culture needed to go beyond box-ticking to show people where they can, and should, take risks.

In the case of some organisations, senior leaders may also want to reconsider what the principal/material risks to the business actually are, as this will serve as the bedrock of any risk appetite framework.

Members of the Risk Leadership Network are also thinking about how to set out their risk appetite framework in the form of a risk appetite statement.

To guide them on this journey, members are taking advantage of a benchmark we prepared to explain how the majority of companies:

• assign accountability for the development of risk appetite statements, and
• draft and review them before they are approved by the board.

Highlighted below are some of the key questions that risk leaders might ask throughout this process, and an overview of how different companies are taking on these challenges.

Who is responsible for developing a risk appetite statement?

Based on discussions held during recent member meetings, as well as a survey we conducted amongst our network of risk practitioners, accountability for drafting risk appetite statements varies quite a lot between businesses (although some approaches are more common than others).

While it is extremely rare for a risk team to develop an appetite statement in isolation – which wouldn’t represent an effective approach to engaging with the board and understanding their perspective – several risk teams do support an executive leadership team or the board itself to develop their own statements.

More companies are also starting to leverage the support and knowledge of subject-matter experts (SMEs) and risk owners around the business – who may well be closer to the risks themselves – to draft appetite statements.

How is a risk appetite statement created and approved?

We have also seen a variance between companies with regards to how they gather information to inform a risk appetite statement and their review process ahead of presenting it to the board.

While there are several ways to canvas opinions across the business, some of the more common approaches highlighted by members are to conduct interviews with key stakeholders, survey employees through a questionnaire and carry out a group workshop.

One risk leader observed, however, that a more personal approach to gathering information is often the most successful – people are more likely to open up and share their experience when taking part in a smaller, more focused forum.

In terms of the review process, a key challenge is to make sure it is endorsed by a relevant group of people within the business; this may be a board sub-committee, the risk team or even individual executive leaders themselves – understandably, the endorsement of the latter is probably the most important of all.

Featured resource: How to get risk appetite right for projects

How can risk appetite and corporate culture statements work together?

Risk appetite and corporate culture statements not only go hand in hand, but also underscore the importance of engaging with the board and different parts of the business – after all, if the risk appetite statement outlines risk outcomes the business will (and will not) accept, a corporate culture statement establishes the behaviours expected to ensure these tolerance limits are not exceeded.

For example, in a culture where everyone is responsible for risk, everyone should be able to speak up and elevate issues without fear – committing the board to this principle and embedding it throughout the organisation will ensure that if risk appetite is being exceeded, people are not afraid to progress any concerns to the highest level of the business.