Risk appetites are unique to individual organisations because each and every entity has characteristics, strategies and attributes which differentiate it from others, even within the same industry. No two companies are alike; they have different resources, talent and cultures. But they can all benefit from well-developed, well thought-out risk appetite statements because such a statement will be the result of a process which helps the company better understand and manage its risk exposure. Management, having undergone the process of collecting the necessary information, will be better informed when making decisions and be able to more wisely allocate resources or deploy staff where necessary.
Companies wanting to develop an effective risk appetite statement should ask themselves, firstly, what they want to achieve with such a document. A risk appetite statement considers the levels of risk-taking that is deemed acceptable for the company, based on the information provided by management. A company’s risk appetite relates to its long-term strategy, i.e., what it wants to achieve and how its resources should be allocated so as to achieve its goals. The risk appetite indicates how much risk the firm is willing to consider, to attain its business objectives. The board is not the creator of a risk appetite statement; it is management which does this.
Management should therefore first understand the company’s strategy, goals, risk-taking experience, risk culture, and its stakeholders’ interests and perspectives. At the top of the agenda should be what risks the organisation is willing or unwilling to take, how much, and what kind of risk can be undertaken. This calls for an analysis of the firm’s risk profile and its risk capacity or tolerance. When these areas have been clarified, management can begin drafting the risk appetite statement. The statement should be easy to understand, to guide employee behaviour at all levels; and include training as a component, to ensure that the firm’s risk strategy is communicated across the company.
The risk appetite statement is not a static document, primarily because risk is dynamic, and the risks which the organisation faces continually change. Risk appetite may sometimes be confused with risk tolerance; companies should beware. While an organisation’s risk appetite is the level of risk it can accept in the pursuit of its objectives, risk tolerance is how much risk a company can withstand before intervention becomes necessary. The board is responsible for overseeing the development of the risk appetite; management reports to it. If the board finds that the risk tolerance level has been exceeded, it can determine whether the risk tolerance was set too low, and make the appropriate adjustments.
Being in business often means engaging in risky behaviour to begin with but sometimes organisations may not be taking enough risk. Greater risk means greater returns but this has to be balanced with other factors, such as robust oversight, good corporate governance and the appropriate deployment of resources. Carefully considering its risk appetite forces an organisation to focus on its frameworks, systems, policies and processes. It needs to inventorise its capabilities and sort out how best to manage its assets in a robust, responsible manner. Enshrining all of this in a risk appetite statement indicates its determination to be competitive, sustainable and create value in the long term.
