How to boost risk appetite awareness across the business

Although the setting of risk appetite, as well as the drafting of risk appetite statements, is usually a joint effort between the risk team and the executive layer of the business, keeping the organisation within risk appetite requires the participation of employees at all levels.

Download now [Guide]: Risk appetite statement flowchart

It is one thing to engage the board on the value of risk appetite, but convincing the rest of the business of its practical value is a different challenge altogether.

However, for the business to find the correct balance between taking too much risk, and not enough, employees need to understand the importance of “good” risk-taking and how it can benefit the organisation.

The setting of risk appetite usually begins by consulting senior leaders and understanding what their operational and strategic goals are. This can then be framed by risk appetite statements, which set upper and lower limits for the amount of risk that needs to be taken for the business to achieve those goals.

For more on setting the right limits for risk appetite, and to find out how risk leaders are designing effective procedures to keep their risks within scope, make sure to read our full guide to risk appetite here.

According to a survey of organisations we conducted, it is most common for risk appetite statements to be prepared by risk owners and subject matter experts (SMEs), albeit with the support of the risk team, while they are typically endorsed by the executive leadership team.

While the group level of the business may know these statements well, they need to filter down into the actual business. The most meaningful aspect of risk appetite is how it can be leveraged to make better, more informed, decisions – so how can you communicate this to employees who may view risk appetite as yet another complicated process getting in the way of them doing their job?

Below, we have outlined three key ways in which organisations – and, more specifically, risk teams – are engaging their wider business to spread an awareness of risk appetite, as well as an understanding of how it can actually support employees’ efforts to achieve higher levels of performance.

Embed risk appetite into everyday processes and governance

Based on our research, only 5% of businesses do not use risk appetite statements at all, which demonstrates that risk appetite is, broadly speaking, a foundational component of any ERM framework. However, less than 10% of the businesses we spoke to about the topic stated that a significant portion of their staff – including employees at the exco level and further down the organisation – actually use risk appetite.

In order to help risk leaders navigate the journey of developing risk appetite statements, from their creation to their review and endorsement, we created an easy-to-navigate flow chart that presents the results of a benchmark we carried out with members. To download the flow chart, click here. 

It is clear, then, that many businesses have a long way to go when it comes to embedding risk appetite into people’s roles and responsibilities. If nearly a fifth of organisations have board-approved risk appetite statements that are not currently being used, as our research suggests, businesses may need to work on aligning their risk appetite framework with the governance structure of the organisation.

Rather than the risk team being responsible for herding different business units and reminding them to use risk appetite, risk owners need to be accountable and take the lead on this governance.

If first-line business leaders know that their adherence to risk appetite (when making decisions that could impact the business) will be assessed by the risk owner, they may be more likely to treat this as an important aspect of their everyday risk management activities, instead of an additional task that can be easily forgotten.

Clear communication between the risk team and the business

In order to help risk owners stay within risk appetite, and embed an awareness of risk appetite around the business, the risk function can make an active effort to communicate with people in the business using the channels that are available.

As well as providing training in risk workshops, the risk team can leverage other tools and systems the business has in place – such as an employee intranet – to provide further information and training materials about risk appetite. Furthermore, the risk team may wish to set up a private inbox or internal communication channel so that it is easier for employees to ask questions about risk appetite when they arise.

Another key aspect of communicating with the business about risk appetite is to avoid using overly complicated language, which could create confusion and foster a general apathy toward risk appetite amongst employees.

If the risk team can review the language used in risk appetite statements and, where possible, simplify this into a common language that everyone can understand, people around the business may be more comfortable engaging with risk appetite and adjust their behaviour accordingly.

Integrate risk appetite into reporting procedures

A small proportion of the businesses (roughly 15%) we have interviewed report specifically on risk appetite (i.e. in a separate report), but it is most common for appetite to be integrated into broader risk reporting.

On the other hand, our research suggests that at companies where risk appetite is treated as an operational tool in the background, rather than something the business actively reports against, about 50% never review risk performance against their appetite metrics or statements.

This data underlines the importance of either reporting on risk appetite specifically or making it a feature of existing reporting procedures when it comes to filtering down an awareness of risk appetite throughout the business.

If risk owners are required to report to the board or audit and risk committee (ARC) on whether their business units are operating within or outside appetite, they are much more likely to push their teams to be cognisant of risk appetite and factor this into their decisions.

Where does Risk Leadership Network's insight come from? These recommendations were drawn from lessons shared by risk leaders in our network, who have been discussing the topic of risk appetite across a series of recent meetings. Our risk appetite guide is available for free, but there's so much more collaboration taking place between risk leaders in our network every day. Find out more about how we enable collaboration here.