An Enterprise Risk Management (ERM) process can yield a valuable communication for your organization: the Risk Appetite Statement. This statement serves an important assurance role for stakeholders in your company, and is an indicator of critical, board or executive-level oversight of risk management. It serves as a tangible product of an effective effort to assess and control risk across the enterprise. It can be referenced as the basis for any communication or disclosure your company may need to make about its risk management policy and efforts.
What Does a Risk Appetite Statement Do for You?
A Risk Appetite Statement is both an internal guidance document and an external message of assurance that yours is a well-managed company. The Risk Appetite Statement can be a driver of value creation and enhance key areas and assets of an organization, including:
- Strategic planning and budgeting – Allows the board and senior management to distribute and understand risk across the company, and enables a company to set Risk Tolerance levels linked to objectives for different units, teams, initiatives and functions throughout the organization;
- Brand value – The Risk Appetite Statement translates the values and ethics of the company into guidelines for conducting business and measuring performance. It also reinforces an image of long-term business viability;
- Brand reputation – It reassures your company’s shareholders, regulators and other stakeholders that you are applying meaningful risk management by steering management away from decisions that are not aligned with the Risk Appetite of the company. A Risk Appetite Statement does not merely serve to eschew risk. It can encourage risk-taking when it is appropriate. The Risk Appetite Statement shows when your company is taking on too little risk and when it can take on more to generate additional value. Hence, management is not misled into blindly reducing all risk, but is instead empowered with a valuable, relevant guideline that helps them manage the risk/reward trade-off.
What Are the Hallmarks of an Effective Risk Appetite Statement?
A Top-Down Approach
A Risk Appetite Statement should link the organization’s concepts such as mission, vision, values and board-level strategy to its financial and operational objectives. It should also address the concerns of the full range of stakeholders such as shareholders (economic value added), the board (governance benchmarks), senior management (reputation, operations, financial reporting) and employees (environment, health and safety).
The top-down approach would identify early on if your strategic goals dictate that there are certain types of risks that your company is not willing to take at all. For example, airlines have no appetite for flight safety risks. Or, consider a highly regulated industry in which a company may have no appetite for regulatory non-compliance.
Expressed in Measurable Terms
If a Risk Appetite Statement is not explicitly expressed in measurable terms (i.e., a 15% chance of a loss of shareholder value), then it should at least evoke measurable terms. For example, a Risk Appetite Statement may address Human Capital Risk by stating it has a moderate appetite for this category, but notice that this moderate appetite can be readily related to retention rates, performance measures and succession planning coverage. It is this ability to relate the statement to both high-level strategy and operational objectives that is an indispensable facet of an effective Risk Appetite Statement.
Whether explicitly expressed in the Risk Appetite Statement or underlying it, the measures to be chosen are, of course, the ones that most directly address your risk concerns. Quantitative measures can include: earnings volatility, percentage loan loss, return on assets, the debt/equity ratio, safety targets, capital expenditure or customer concentration. Qualitative measures may apply to your company’s tolerance for activities outside of its core competencies, M&A activity or initiatives to attract new customers.
Key Takeaways
- The Risk Appetite Statement is a tangible product of board-led risk management;
- It communicates from the board to the company and its external stakeholders that strategy is linked to objectives;
- It conveys at once practical guidance to the company and assurance to the stakeholders;
- The guidance and assurance it provides addresses the balancing of risk and reward, the creation of long-term viability and the enhancement of the brand and reputation.
Contact us about drafting a Risk Appetite Statement and how we can help your organization better understand risk and align their functions with corporate strategy.
