How to define and implement a Risk Appetite Statement Concept | Methodology | Technology

How to define and implement a Risk Appetite StatementConcept | Methodology | Technology

IOR Scottish Chapter 2nd Annual Conference

Glasgow Caledonian University October 26th, 2012

| © Manigent 2012

Setting the scene

"People know risk appetite is important, and they think they've got it. But the industry is still falling short on how to think about it [Risk Appetite]..."

"Our challenge as non-executives is there is no definition. We are dealing with words, not well-understood and agreed concepts. There's no 'hitchhikers' guide' to risk appetite and no agreement there should be one"

Tapestry Networks, Inc - Bank Governance Leadership Network, Insights from the non-executive dinners, June 16, 2010

| © Manigent 2012

Objectives

1. To provide a practical approach to define and deploying risk appetite as a strategic management tool

2. Explain the role of risk appetite within the overall strategy process

3. Outline the steps and process around building a robust Risk Appetite statement

Provide a ‘Hitchhikers guide’ to Risk Appetite!

| © Manigent 2012

The credit crunch and subsequent fall-out is rewriting the rules on strategy execution and risk management

http://business.timesonline.co.uk/tol/business/industry_sectors/banking_and_finance/article4761892.ece

| © Manigent 2012

Corporate governance weaknesses related to Risk Appetite contributed to the credit crunch

Supervisors see insufficient evidence of board involvement in setting and monitoring adherence to firms’ risk appetite.

Risk appetite statements are generally not sufficiently robust; such statements rarely reflect a suitably wide range of measures and lack actionable elements that clearly articulate firms’ intended responses to losses of capital and breaches in limits.

Board-level engagement in risk oversight should be materially increased, with particular attention to the monitoring of risk and discussion leading to decisions on the entity’s risk appetite and tolerance.

Remuneration structures for all such “high end” employees are appropriately aligned with the medium and longer-term risk appetite and strategy of the entity.

In essence, the obligation of the board in respect of risk should be to ensure that risks are promptly identified and assessed; that risks are effectively controlled; that strategy is informed by and aligned with the board’s risk appetite; and that a supportive risk culture is appropriately embedded so that all employees are alert to the wider impact on the whole organisation of their actions and decisions.

| © Manigent 2012

Post credit crunch, UK Corporate Governance Code was updated to be more specific about Risk Appetite

The UK Corporate Governance Code issued in May 2010 states that ‚the Board is responsible for determining the nature and extent of the significant risks it is willing to take in achieving its strategic objectives…and should maintain sound risk management and internal control systems.

| © Manigent 2012

Organisations are increasingly looking to ‘Risk Management’ as a source of competitive advantage

Neither too cautious nor too reckless, the best companies use

their risk management capabilities to adjust either their capacity or

their appetite to make more prudent— and ultimately

successful— investment decisions.

Source: Accenture 2011 Global Risk Management Study

64%Almost two-thirds of Risk Masters 64% indicate that their risk

management capabilities provide competitive advantage to “a great extent,” compared with only 42% of the peer set.

| © Manigent 2012

Evidence suggests many corporate governance weaknesses and Board level challenges still exist“the Board is responsible for determining the nature and extent of the significant risks it is willing to take in achieving its strategic goals.” UK Corporate Governance Code, 2010

21%

“only 21% align their risks with their business strategy”

– Grant Thornton Corporate Governance Review 2011

Where the Board need to spend more time…

70% Strategy

42% Execution

47% Performance Management

67% Risk Management21%

“Only 21% of directors surveyed claim a complete understanding of their companies’ current strategy”

– Mckinsey Global Survey – Corporate Governance, 2011

“results indicate a need to better educate Boards on industry dynamics and how their companies create value...”

Approx. 1500 participants

| © Manigent 2012

The definition of Risk Appetite is clear, but the application is less well understood

The COSO definition provides ‘What, Who, When and Why’ of risk appetite What: the amount and type of risk Who: an organisational entity When: over a defined time horizon Why: to achieve the objectives of the entity

Risk appetite is the amount and type of risk that is acceptable to be taken by an organisational entity over a defined time period, to achieve the objectives of that entity – COSO Enterprise Risk Management

Risk appetite sets the boundaries within which strategy is executed

– Manigent

| © Manigent 2012

Risk Appetite is a multidimensional construct, which changes depending on the organisational entity and its objectives

Extreme

High

Moderate

Low

Overnight90 days

Annual

Cred

it

Liqu

idity

Ope

ratio

nal

Mar

ket

Stra

tegi

c

Investment Banking exampleWe are willing to put £x million of capital @ risk to trade on our own account over the next 12 month period.

We hold no more than x% of our capital in overnight positions.

We will accept operational losses of £x million per month.

Water Industry exampleWe have no appetite for causing customer illness by supplying poor quality water.

We have no appetite for appearing in local press related to leaks or fines for more than 2 consecutive days.

| © Manigent 2012

Risk Appetite Setting process

1. Joint Board / Executive appetite familiarisation workshop(s)

3. Joint risk dimension workshop(s)

4. Board appetite setting workshop(s)

4. Executive appetite setting workshop(s)

2. 1-2-1 follow-up meetings

5. Joint Appetite setting workshop (s)

6. Joint Board / Executive Appetite sign-off

This process is designed to quickly establish the organisational boundaries – risk appetite.

Step 3 can be combined with either step 2 or 4.

Splitting the workshops in step 4 is designed to bring out different views / perspectives, but these can be combined.

| © Manigent 2012

Defining Risk Appetite in Seven Steps

To design a robust risk appetite statement follow these steps:1. Identify the Key Value Drivers for the Business2. Define Risk ‘Buckets’ based on Key Value Drivers3. Define a set of Strategic Objectives4. Define and Assess a set of Key Risks5. Align Risk-taking to Strategy6. Define the Risk Appetite statement7. Monitor the Alignment of Risk-taking to Appetite

| © Manigent 2012

1. Identify the Key Value Drivers for the Business

Business Goals

Business Drivers

Business Model

Internal Analysis External Analysis

Business Objectives

Strategy

Appetite

Appetite Alignment

Risk ManagementPerformance Management

Appetite

Identify strengths & weaknesses

Identify threats & opportunities

Is our business model fit for

purpose?

Is our business model fit for

purpose?

Are we operating within appetite?

Manage threats & opportunities

Are we on-track to deliver?

Manage strengths & weaknesses

Appetite

Setti

ngEx

ecuti

onFo

rmul

ation

Develop the strategic plan

Distil strategy into actionable objectives with defined appetites

Continuously align and monitor risk taking to business strategy

| © Manigent 2012

1. Identify the Key Value Drivers for the Business cont.

Performance Management

Risk Management

Strategy Management

Appetite

What are we trying to achieve?

Are we on track?

What is our Risk Appetite?

Are we operating within appetite?

Governance & Communications

Culture

| © Manigent 2012

1. Identify the Key Value Drivers for the Business cont.

Business drivers

Capital

Income

Reputation

Shareholder value

Share price

Economic value add

Profit

Strategy

Align Risk-taking to Strategy

Manage Risk

Manage Performance Appetite

Governance Communication

Culture

Appetite

| © Manigent 2012

2. Define Risk ‘Buckets’ based on Key Value Drivers

Business Drivers Low Moderate High Extreme Capacity Limit

Income X% Capital@Risk

X% Capital@Risk

X% Capital@Risk

X% Capital@Risk

Capital Up to X £M

X £M to Y £M

X £M to Y £M

X £M to Y £M

Above X £M

ReputationUp to X vol.

Bad coverage

Up to X vol. Bad

coverage

Up to X vol. Bad

coverage

Up to X vol. Bad

coverage

| © Manigent 2012

2. Define Risk ‘Buckets’ based on Key Value Drivers cont.



X% Capital@Risk

X% Capital@Risk

X% Capital@Risk

Capital Up to X £M

X £M to Y £M

X £M to Y £M

X £M to Y £M

Above X £M


Bad coverage

Up to X vol. Bad

coverage

Up to X vol. Bad

coverage

Up to X vol. Bad

coverage

| © Manigent 2012

3. Define a set of Strategic Objectives

| © Manigent 2012

4. Define and Assess a set of Key Risks

The risk of (what, where, when)….. caused by (how) ……resulting in..…(impact/consequences)

Examples The risk of financial deficit at end of year caused by

decreased in-patient activity and revenue, resulting in rationalisation of service offerings.

The risk of exceeding A&E waiting times, caused by increased demand and staff vacancies, resulting in not meeting community expectations and adverse patient outcomes

| © Manigent 2012

4. Define and Assess a set of Key Risks cont.

The risk of (what, where, when)….. caused by (how) ……resulting in..…(impact/consequences)

Examples The risk of financial deficit at end of year caused by

decreased in-patient activity and revenue, resulting in rationalisation of service offerings.

The risk of exceeding A&E waiting times, caused by increased demand and staff vacancies, resulting in not meeting community expectations and adverse patient outcomes

| © Manigent 2012

6. Define the Risk Appetite statement



X% Capital@Risk

X% Capital@Risk

X% Capital@Risk

Capital Up to X £M

X £M to Y £M

X £M to Y £M

X £M to Y £M

Above X £M


Bad coverage

Up to X vol. Bad

coverage

Up to X vol. Bad

coverage

Up to X vol. Bad

coverage

| © Manigent 2012

7. Monitor the Alignment of Risk-taking to Appetite

Capital @Risk

Reputation @Risk

Impact x Likelihood (over a time horizon)

Appetite sets the boundaries for the business within which they execute strategy and create value.

Therefore the Appetite Alignment Matrix provides a method of visually monitoring and managing our risk taking according to the strategy, identifying where too much or not enough risk is being taken.

How to define and implement a Risk Appetite Statement Concept | Methodology | Technology

Documents

Transcript of How to define and implement a Risk Appetite Statement Concept | Methodology | Technology