How to set and use risk appetite

In the third article of our new #ChangingRisk ThinkTank series, Gerard Payen looks at how building and using a risk appetite-based approach will enable organisations to raise their game, and to do it in a sustainable and consistent manner.

We are all familiar with the concept of individual risk appetite in our daily life. It is intuitive, often unconscious and not explicitly stated, nourished by our experiences, education and observations.

It is about our will to accept consequences - be they positive or negative - of our or others’ decisions, of all our exposures to a world full of risks and opportunities.

There is appetite for risk behind our savings investment strategy, behind our decisions to sign up for a new job or simply to cross a street outside pedestrian crossings.

The concept of risk appetite in the business world (which also encompasses opportunities) has been around for years in risk management circles. It is indeed clearly defined in international standards or references such as ISO 31000 or the integrated framework put forward by COSO, as the “amount of risk an organisation is willing to accept in pursuit of value”.

The concept is one of “collective” risk appetite, raising the individual risk appetite concept to a company level.

Some have questioned the relevance of this concept. It is sometimes depicted as a compliance artefact (regulatory bodies impose the use of risk appetite frameworks for some companies in the finance industry) or as one more corporate gimmick (a nicely framed “risk appetite statement” in your headquarters’ corridors).

I urge you to forget these caricatures and see firsthand how your company can reap benefits from a risk appetite approach, even in the absence of any other formal risk management tooling.

Reaching the summit

Imagine that the strategy of your company is akin to conquering a mountain, the summit of which is achieving your strategic objectives. Defining your appetite for risk is what will fundamentally determine which preferred route you will take with your team in order to reach the mountain summit in due course, whatever the prevailing conditions – chosen or not.

Are you willing to deal with rock overhangs? Or would you favour a trail through snow banks, potentially requiring different equipment and preparation, and/or requiring more time to complete?

Prior to arriving at the foot of the mountain, you will, as leader, thoroughly explain the objectives (the summit), ensure they are well understood by all team members, and check that both the summit and chosen route fit within all key parameters: eg expected climate conditions, skills, training, gear and known ability of each team member to deal with identified hurdles and handle unanticipated conditions, capability of climbing together, motivation and will.

Ask yourself: Are your strategy, performance ambition and risk appetite relevant, compatible with one another and coherent with the amount of risk your organisation can withstand or “afford”? With its risk capacity?

Getting outside your comfort zone

If your risk appetite is too low, or “comfortable”, you may not get much satisfaction out of reaching the summit. Further, a lower risk appetite will reduce “short-term” volatility – less or no high-stress moments during the climb, probably though with a negative impact on absolute performance which may then not meet your expectation.

You will likely feel your company could have done better.

It is worth noting here that the process of producing an excessively consensual risk appetite statement may lead in some cases to a blunted appetite. Reaching high performance demands that you stretch yourself and get out of your comfort zone.

On the other hand, an excessive risk appetite may cause so much discomfort or stress along the way that success would not be perceived as a reward, but simply relief or a stroke of good luck: hardly a sustainable way of moving forward.

Openly challenging risk capacity ahead of execution helps to identify relevant changes, eg, additional training or upgraded equipment that would open up new possibilities. Beware of biases introduced by pre-existing processes or habits, which may have been produced by foregone contexts, or fed by a partial view of the strategy and performance criteria.

This phase will of course be further informed by a review of past experiences and lessons learnt from successes and failures. “Back testing” your proposed risk appetite calibration on previous attempts to reach summits makes sense, as long as you view this as a source of insight for progress.

It will also involve discussions with all team members to collect their input, assess strengths and weaknesses and debate sensitive matters, likewise with people outside the team providing crucial context data (eg, weather forecast, expert mountain knowledge).

All this may encourage you to adjust your chosen path and route to the summit. You may even need to flex your strategy and opt for a different summit altogether.

Let culture shape the way

Your risk appetite is not an off-ground, top-down management diktat: it is deeply rooted in your company and business environments, substantiated by your ambition and experience, shared and appropriated as a culture.

Pre-defining the main stages of your journey to the summit also means addressing what type and level of deviation you are willing to accept against your original plan, without compromising your ambitions.

How early or late can you reach a given step, how many injured team members would you be able to deal with, how much waste can you leave behind? By going through this exercise, you are setting your risk tolerance versus your expected performance.

As part of the plan, someone in the team should be tasked with monitoring pace and performance, checking you are on schedule, that progress is made according to plan and raising alerts if and when needed.

At this point it is important to ensure your team is fully aligned, giving sense to the strategy and providing managerial impulse. Risk appetite and tolerance should be communicated throughout the company, including governance (“sponsor of the climb”) - which may actually be the initiator of the whole process - and be shared with select external stakeholders, if appropriate.

This should be done with clear and pragmatic wording, to support decision-making and ensure that your risk appetite framework remains an essential management tool.

Time to climb

Needless to say, the climb will see you face unforeseen or unforeseeable situations, with negative or positive outcomes: external conditions, team motivation, individual performance may evolve without much notice. Competent and adaptable management will be needed.

You must be able to rely on previously-informed risk appetite ingredients, clearly defined and “owned” by the whole company. This will prove a key advantage helping anticipate the unexpected and making sound and consistent decisions as and when issues arise. This is never more crucial than when you are faced with the combined pressures of urgency and stakes.

It is your risk appetite framework which will provide those “life-saving” bearing points that enable you to make the right decisions, at the right time, and have them understood, accepted and deployed.

Say your pathway suddenly begins to collapse, but you know the team is collectively willing to tackle snowy overhangs and can react quickly to your command and change course, avoiding injuries by taking a steeper - but accepted-as-practicable - alternative route.

Permanent feedback from execution, checking performance indicators and measurements are good practice for continuous improvement.

Frequently reviewing “how much” of your risk appetite you have been using so far in your adventure is also a must, for at least two reasons:

1. Gaps between anticipation and reality: initial settings may not be coherent with the amount of risk actually needed to meet the objectives (appetite), or they may be too severe considering the maximum available resources (tolerance).
2. Real-life tensions or conflicting considerations: you may have a collective appetite for crossing snow banks, until you realise that the one in front of you is melting and its depth cannot be reliably assessed, threatening life (well beyond your tolerance).

Risk appetite or tolerance will never be definitive. Instead you will constantly refine, adjust or make additions to your approach on a regular basis. And over time, this will strengthen both.

Again, in all cases, discussing and communicating these changes with the whole team is essential to the success of the approach.

By the same token, having reached the summit should mark the start of a comprehensive review of what was accomplished and the adjustments that had to be made along the way to your initial plan. Appraise the value delivered by your strategy and gain insight on what supported your performance. What could have been done differently to yield more value?

Don’t forget, you are preparing for your next challenge and developing your organisation’s sustainability at the same time.

Thus, a dynamically managed risk appetite approach will gradually power the link between strategy and execution, helping you define and navigate the preferred course of your company. One that will deliver optimal performance and provide tolerance-related performance monitoring.

It will foster permanent team alignment, relevant anticipation, consistent decision making and contribute to building a homogeneous risk-opportunity aware culture throughout the organisation.

Is this not a powerful way to initiate and “organically grow” meaningful risk management within your organisation?

Gerard Payen is an independent senior management advisor with a focus on company performance optimisation through risk management, is a board member of AMRAE and was previously chief risk officer at Renault Group.