Risk Appetite & Tolerance Executive Summary Risk Appetite and Tolerance Executive Summary Foreword 1 Risk appetite and performance 10 Introduction 4 Putting it into practice 12 About IRM 6 Five tests for risk About the Author 6 appetite frameworks 14 Risk appetite – Questions for the boardroom 15 principles and approach 7 Supported by: A guidance paper from the Institute of Risk Management September 2011 ©2011 The Institute of Risk Management All rights reserved. No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording or otherwise without the express permission of the copyright owner. Permission will generally be granted for use of the material from this document on condition that the source is clearly credited as being the Institute of Risk Management. Risk Appetite and Tolerance Foreword Executive Summary Risk appetite today is a core By providing practical advice on how consideration in any enterprise to approach the development and implementation of a risk appetite risk management approach. framework we believe we will be helping As well as meeting the requirements boards and senior management teams both imposed by corporate governance to manage their organisations better and standards, organisations in all sectors to discharge their corporate governance are increasingly being asked by key responsibilities more effectively. stakeholders, including investors, analysts We are particularly pleased that a and the public, to express clearly the extent large number of professional bodies are of their willingness to take risk in order to supporting this work – risk is everyone’s meet their strategic objectives. business and a common understanding The Institute of Risk Management, and approach helps us work together now in its 25th year, has a key role to play to address this challenging area. in establishing sound practices in this area Alex Hindson and building consensus in what has, for Chairman too long, been a nebulous subject. The Institute of Risk Management 1 This paper will be helpful to senior The Chartered Institute of Internal managers in public service organisations Auditors welcomes this contribution from who are trying to understand risk appetite the Institute of Risk Management to the in the context of their own strategic and debate on risk appetite and risk tolerance. operational decision making. In its recently In theory, the idea of deciding how much published Core Competencies in Public risk of different types the organisation Service Risk Management, Alarm identified wishes to take and accept sounds easy. the need to understand the organisation’s In practice, it is difficult and needs ongoing risk appetite and risk tolerance, as part of effort both from those responsible for the key function of identifying, analysing, governance in agreeing what is acceptable evaluating and responding to risk. The and from all levels of management in ‘questions for the boardroom’, set out in communicating how much risk they wish this paper, could easily be translated into to take and in monitoring how much ‘questions for the public organisation’s they are actually taking. Anything senior executive committee’ and as such that stimulates debate on the practical may be of value to many Alarm members challenges of risk management is to and their organisations. be welcomed. Dr Lynn T Drennan Jackie Cain Chief Executive Policy Director Alarm, the public risk Chartered Institute management association of Internal Auditors While the Financial Reporting Council has CIPFA is pleased to endorse this work kick-started the debate on risk appetite by IRM on risk appetite and tolerance and risk tolerance in the UK, it is a debate which provides welcome leadership on a that resonates around the world. As an challenging subject for both the public integrated global risk consulting business, and private sectors. We look forward I can testify to the fact that our clients are to taking the debate further with our debating risk appetite. That is why we membership in pursuit of our commitment are pleased to support the work of the to sound financial management and good Institute of Risk Management in moving governance. this debate forward. We look forward to Diana Melville actively engaging with IRM and others Governance Adviser in promoting this thought-provoking Chartered Institute of Public Finance document and turning risk appetite into and Accountancy a day-by-day reality for boards and risk management professionals around the world. Larry Rieger CEO, Crowe Horwath Global Risk Consulting 2 All successful organisations need to be This document is an important contribution clear about their willingness to accept risk to a key area of board activity and helpfully in pursuit of their goals. Armed with this addresses one of the issues highlighted in clarity, boards and management can make the Financial Reporting Council’s Guidance meaningful decisions about what actions on Board Effectiveness. ICSA is pleased to take at all levels of the organisation to support the work started here by the and the extent to which they must deal Institute of Risk Management, and looks with the associated risks. But defining forward to a well-informed debate and and implementing risk appetite is work some useful conclusions. in progress for many. CIMA therefore Seamus Gillen warmly welcomes this new guidance Director of Policy from the Institute of Risk Management Institute of Chartered Secretaries as a sound foundation for developing and Administrators (ICSA) best practice on this critical topic. Gillian Lees Head of Corporate Governance Chartered Institute of Management Accountants (CIMA) This paper sends out a clear statement that the principle of risk appetite emanating from the board is the only effective way to initiate an ERM implementation. Charterhouse Risk Management is delighted to be associated with the launch of this paper after contributing to the consultation process. Our own experience with clients confirms that this approach is not only critical, but that the whole process must be undertaken with a practical rather than theoretical vigour. This is an essential ingredient of our delivery capability. References to ‘appetite’ and ‘hunger’ only reinforce the living nature of the required approach. Neil Mockett CTO Charterhouse Risk Management 3 Introduction The UK Corporate Governance Code We have prepared this guidance under states that “the board is responsible the overall direction of a working group of the Institute of Risk Management. Our for determining the nature and work has produced this executive summary, extent of the significant risks it which is designed to provide an overview is willing to take in achieving its of the subject for general use, particularly strategic objectives.” by board members, and a more detailed version which is primarily designed to assist The intent of this document is to provide those whose task it is to advise boards on high level guidance to directors and senior these matters. The detailed version of our executives on how to address this part guidance is available for free download of the Code, which essentially requires from IRM’s website*. consideration of the subjects of ‘risk appetite’ and ‘risk tolerance’. Following the financial collapse, precipitated by banks which we all This summary will tell you: assumed were outstanding at managing • what you need to know risk, which was after all their raison • what you need to do, and d’être, first the Walker Report, and then • where can you turn for more the review of Corporate Governance by detailed guidance the FRC highlighted the need for boards to re-evaluate just how good they are It became apparent during the at managing risk. As a consequence Risk development of our paper that there is Appetite and Risk Tolerance are now considerable interest in this topic in on the agenda for all listed companies. the public sector as well as the private Importantly, our work has shown that sector, and also beyond the UK. So, while this interest extends outside the listed some specifics might differ, we feel that sector to organisations in all walks of life. the underlying principles hold true for But managing risk appetite represents a all sectors and all geographical locations. massive challenge: risk professionals have been divided as to how to determine risk appetite and there is precious little in terms of useful guidance. * Risk Appetite and Tolerance – Guidance Paper available from www.theirm.org/publications/risk_appetite.html 4 We do not regard this guidance Members of as the last word on the subject: the Working Group thinking will continue to develop and, if, Richard Anderson, as we hope, this booklet is superseded Deputy Chairman of IRM and before too many reporting seasons come Managing Director of Crowe and go, then we will know that the Horwath Global Risk Consulting concept of risk appetite is beginning Bill Aujla, to take root. CRO at Etisalat It is our view that risk appetite, correctly Gemma Clatworthy, defined, approached and implemented, Senior risk consultant at Nationwide should be a fundamental business concept Building Society that could make a substantial difference to how businesses and organisations are run. Roger Garrini, We fully expect that the initial scepticism Audit manager at Selex Galileo about risk appetite will be gradually Paul Hopkin, replaced as boards and executive directors Director of IRM and technical gain greater insight into its usefulness. director of AIRMIC We also anticipate that analysts will soon be asking chief executives, chairmen and Steven Shackleford, finance directors about risk appetite. Senior academic in audit and risk After all, this subject is at the heart of the management at Birmingham City organisation: risk-taking, whether private, University public or third sector, whether large or small, is what managing an organisation John Summers, is about. The approach of the new UK Chief advisor – risk at Rio Tinto Corporate Governance Code represents Carolyn Williams, an opportunity to place risk management, Head of thought leadership at IRM and in particular risk appetite, right at the centre of the debate on effective corporate governance and the role of the board in running organisations. Richard Anderson Deputy Chairman, Institute of Risk Management 5 About IRM About the Author The Institute of Risk Management (IRM) Richard Anderson, the principal author is the world’s leading enterprise risk of this booklet, is Deputy Chairman of management education Institute. We are IRM. Richard is also Managing Director independent, well-respected advocates of of Crowe Horwath Global Risk Consulting the risk profession, owned by practising risk in the UK. A Chartered Accountant, and professionals. We provide qualifications, formerly a partner at a big-4 practice, short courses and events at a range of Richard has also run his own GRC practice levels from introductory to board level for seven of the last ten years. Richard and support risk professionals by providing has been professionally involved with risk the skills and tools needed to deal with management since the mid-nineties the demands of a constantly changing, and has broad industry sector experience. sophisticated and challenging business He wrote a report for the OECD on environment. We operate internationally Corporate Risk Management in the banking with members and students in over 90 sector in the UK, the USA and France. countries, drawn from a variety of risk- He is a regular speaker at conferences related disciplines and a wide range of and contributes to many journals on risk industries in the private, third and management and governance issues. public sectors. “It is interesting, but not surprising, that whilst a significant proportion of financial organisations who have formally articulated a risk appetite statement have been compelled to do so by regulatory requirements, non- financial organisations have developed risk appetites in order to assist in the achievement of strategic goals.” Source: Jill Douglas, Head of Risk, Charterhouse Risk Management 6 Risk appetite – principles and approach It is often said that no company The following key principles have can make a profit without taking underpinned our work on risk appetite: a risk. The same is true for all 1 Risk appetite can be complex. Excessive organisations: no organisation, simplicity, while superficially attractive, whether in the private, public leads to dangerous waters: far better or third sector can achieve its to acknowledge the complexity and objectives without taking risk. deal with it, rather than ignoring it. The only question is how much risk do they need to take? 2 Risk appetite needs to be measurable. And yet taking risks without Otherwise there is a risk that any consciously managing those statements become empty and risks can lead to the downfall of vacuous. We are not promoting any organisations. This is the challenge individual measurement approach but that has been highlighted by the fundamentally it is important that latest UK Corporate Governance directors should understand how their Code issued by the Financial performance drivers are impacted Reporting Council in 2010. by risk. Shareholder value may be an appropriate starting point for some private organisations; stakeholder value or ‘Economic Value Added’ may be appropriate for others. We also anticipate more use of key risk and control metrics which should be readily available inside or from outside the organisation. Relevant and accurate data is vital for this process and we urge directors to ensure that there is the same level of data governance over these metrics as there would be over routine accounting data. 7 3 R isk appetite is not a single, fixed 5 Risk appetite must take into account concept. There will be a range of differing views at a strategic, tactical appetites for different risks which need and operational level. In other words, to align and these appetites may well while the UK Corporate Governance vary over time: the temporal aspect of Code envisages a strategic view of risk appetite is a key attribute to this risk appetite, in fact risk appetite whole development. needs to be addressed throughout the organisation for it to make any 4 R isk appetite should be developed practical sense. in the context of an organisation’s risk management capability, which 6 Risk appetite must be integrated with is a function of risk capacity and the control culture of the organisation. risk management maturity. Risk Our framework explores this by looking management remains an emerging at both the propensity to take risk and discipline and some organisations, the propensity to exercise control. The irrespective of size or complexity, do it framework promotes the idea that much better than others. This is in part the strategic level is proportionately due to their risk management culture more about risk taking than exercising (a subset of the overall culture), partly control, while at the operational level due to their systems and processes, the proportions are broadly reversed. and partly due to the nature of their Clearly the relative proportions will business. However, until an organisation depend on the organisation itself, the has a clear view of both its risk capacity nature of the risks it faces and the and its risk management maturity it regulatory environment within which cannot be clear as to what approach it operates. would work or how it should be implemented. 8