90% of risk managers plan to work on risk appetite in 2021, according to a new benchmark report released by Risk Leadership Network, the global corporate membership network for risk leaders and their teams. Operationalisation and linking to business objectives are top priorities, while just over a third are also looking at improving appetite reporting.
Our report, Risk appetite – common goals; diverse approaches, contains insights from more than 130 practising professionals around the world. We interviewed and surveyed leaders from the United Kingdom, Europe, North America, Africa, the Middle East, Asia and Australia to deliver a comprehensive view of risk appetite current practice, across multiple industries.
We asked risk leaders how they were implementing appetite, what kind of metrics and statements they were using, and what elements of appetite they were focusing on for the year ahead.
Current practice snapshot. From Risk appetite – common goals; diverse approaches, Dec 2020
Our research revealed a fascinating array of challenges, solutions and ideas. The resulting report is a true reflection of our network’s diverse knowledge and experience.
We believe it sets a new standard for advancing best practice – not by telling, but by working together as a global risk community to forge a new path.
Common goals
Commonality of goals stood out strongly in our qualitative interviews. When it comes to appetite, almost everyone wants to achieve the same outcomes – although people take diverse paths to get there.
We summarised a multitude of inputs into three key appetite goals:
- Articulating appetite so that the business understands its boundaries
- Implementing appetite so that it guides business decision-making
- Monitoring business performance against appetite in a timely manner.
Over six months of research, many risk managers expressed similar statements verbatim.
“Risk is not integrated with business outcomes.”
“Risk appetite statements are too abstract.”
“Risk is seen as the policy police. We want to be the strategic enablers.”
This last sentiment, in particular, captures where many risk leaders are seeking to position themselves and their discipline. Appetite is increasingly recognised as a tool that can help achieve this objective.
Appetite to guide future prospects
Some interviewees gave examples of how their organisations are already using appetite as a decision-making tool for acquisitions, deals and innovations, and other new ventures.
They emphasised the value appetite had played—or was starting to play—in assessing such opportunities. Business leaders in these organisations were becoming aware of the possibilities presented by upside risk. Senior stakeholders were learning to consider the potential of appetite as a framework through which to evaluate future prospects.
In our observations, this stage usually comes later in the risk appetite journey. First, organisations focus on measuring existing risks. Then, by demonstrating the power of the data and insights they are collecting, risk managers are increasingly invited to be part of the strategic conversation.
Diverse approaches
Up to a certain point, the risk appetite journey can be categorised as linear and, perhaps, an evolution of maturity. Risk managers told us the same stories many times over in terms of the early stages of their process.
However, approaches within this journey vary greatly. And when it comes to outputs, one size definitely does not need to fit all.
Our research suggests outputs can be categorised into three main groups, ranging from essential enterprise-wide metrics that focus appetite on a few key items through to comprehensive risk profiles that systematically address appetite for every category of risk within an organisation.
How is risk appetite implemented?Our survey started with a simple question about risk appetite implementation. We asked if organisations were or were not currently using risk appetite and, if they were, how they were implementing it. Just under 20% of risk managers surveyed said their organisations do not currently use risk appetite. However, among this group, three-quarters said they were planning to work on it within the coming year. But the method and maturity of execution varied. Qualitative statements and quantitative metrics50% of risk managers said their organisation uses a mix of qualitative statements and quantitative metrics to implement risk appetite. While the majority of this group has multiple statements aligning with different risk categories, nuances exist. Most companies prepare statements for each category, but a few write statements for individual top risks instead. In our in-depth interviews, we found this choice tended to influence reporting outputs, as well as how appetite could be cascaded across the enterprise profile and used to evaluate risk on future projects. Appetite via top risksWhere a fixed list of top risks is used, reporting is able to be very insightful at the individual risk level. These risk managers had great success driving tangible conversations around the risks that mattered most to the business. For companies whose major risks remain consistent, the approach helps get everyone focusing on the same long-term goals and discussing real business impacts – not risk theory. Appetite via categoryOn the other hand, appetite statements at the category level allowed risk managers greater flexibility to customise the reporting narrative from one period to the next. Typically, these risk managers told us they either integrated appetite into their broader risk reporting or used appetite as a tool in the background (as opposed to creating specific appetite dashboards). Often, the risk managers we interviewed who were using this approach told us they would select 1 or 2 featured or emerging risks (in areas like cyber, climate, and artificial intelligence, for e.g.) to deep dive into for each reporting session. This was particularly prevalent at organisations where board meetings occurred quarterly or more, and risk managers feared report fatigue. In these cases, boards learned to expect reporting on routine risks only if a risk moved outside of appetite or reached a warning trigger. One of the case studies in our full report outlines a comprehensive implementation of appetite via category at a large listed business. Appetite to guide future decisionsWhere quantitative metrics define thresholds at a category level, appetite is able to be used very effectively as a decision-making tool for acquisitions, deals and innovations, and other new ventures. Several risk managers we spoke to emphasised the value appetite had played—or was starting to play—in assessing opportunities for the business. Companies focusing on upside risk are beginning to recognise the potential of appetite as a framework through which to evaluate future prospects. In our observations, this stage usually comes later in the risk appetite journey. First, organisations focus on measuring existing risks. Then, by demonstrating the power of the data and insights they are collecting, risk managers are increasingly invited to be part of the strategic conversation. This occurred in one of the case studies in our full report, where an upside appetite statement was added to the approach a couple of years after initial implementation. In another case study within the report, one risk manager details how their company now assesses all new potential ventures against six straightforward, enterprise-wide appetite metrics. |
Eight tried-and-tested approaches
Our full risk appetite report, available exclusively to Risk Leadership Network members, contains eight featured case studies collected from our global risk community. Between them, they address all of the major priorities for appetite identified by risk managers for the coming year, and more.
They also include detailed steps to guide risk managers through the implementation process and handy output summaries to help risk managers find an approach that suits their organisation’s maturity level and needs.
Risk appetite priorities. From Risk appetite – common goals; diverse approaches, Dec 2020
Want to know more?
Download our full guide: What is risk appetite and how do you implement it?
The full report: Risk appetite - common goals; diverse approaches is available for members of the Risk Leadership Network, but we'd be happy to discuss some more of the findings and advice with you.
Share this
Risk Leadership Network’s risk management pulse: top 3 global priorities
How can risk appetite add value throughout the whole organisation?
