In the application of Risk Appetite, the questions become:
- How is Risk Appetite central to business decisions;
- How is Risk Appetite central to business operations; and,
- How does Risk Appetite affect Enterprise Risk Management?
(In other words, how do we easily apply our diet restrictions to any type of restaurant or to any selection of meals that we may be faced with?)
Risk Appetite Definition vs. Risk Appetite Process
A Risk Appetite definition describes our restrictions and Risk Appetite process describes how we successfully apply these restrictions.
Risk Appetite Process
Risk Appetite’s effect is best served beyond its definition to allow us to measure our restrictions as a dynamic factor in our on-going assessment of risk and, in doing so, we consider the breadth and range of our Risk Appetite definition and apply it to all risk types. Going back to our diet analogy: What and how much should we have for our appetizer, salad, meal and desert? In real terms, we look at monetary value or limit to our risk and we also include all our risk areas such as stakeholder confidence, brand image, compliance risks, etc.
Just as we try, sometimes in vain, to apply our dietary needs to a specific dining event, we need to also make the process of Risk Appetite as easy and part of the everyday risk management process. In the Risk Appetite Process, we consider our Risk Appetite as simply a guide rather than a boundary. In this way we are not bound by a bread and water restriction but may alter and adjust our appetite based on the facts and circumstances of the risk or opportunity…as long as we don’t disregard the diet completely and stay within the philosophical boundaries of our risk plans.
Risk Appetite is the amount and type of risk an organization is willing to accept in pursuit of its business objectives and is defined, as such, at the strategic level. In this case, the Board should be effectively attuned to the business’ Risk Appetite.
A great example is in looking at a new opportunity. The opportunity is a risk where you see grand rewards that are contemplated in your mission or vision. By applying a decision process that includes consideration of your Risk Appetite philosophy (but not a limiting boundary of the former definition), you decide that pursuing the opportunity is within your business strategy and within tenants of your Risk Appetite definition. You decide to undertake the risk by pursuing the opportunity.
To use the appetite metaphor, we may have a perceived dietary limit for our next dinner out but find that the chef has prepared a remarkable and hard to find dish. Rather than limit ourselves to the set plan, we see the opportunity and reward and we adjust our appetite accordingly. This type of decision may be applied to each and every risk decision and in this way apply also Risk Appetite to our constantly changing risk environment.
When we utilize Risk Appetite as part of our risk decision process we find that the concept of Risk Appetite becomes much more than that of a definition that serves to bind our risk activity but is now a positive influencer that enables our management of risk in a way that truly supports the corporate strategic plan.
Where your business sees Risk Appetite as a limiter you are probably limiting your understanding of Risk Appetite to a hard and fast definition and you need to evaluate the where and how Risk Appetite impacts your risk based decisions. Once you consider Risk Appetite not only as a definition risk limits relative to its strategy but also as an enabler managing your enterprise risk you are much more armed for successfully reaching strategic objectives and pleasing your stakeholders.
Posted by Steve Money, Professional Services, Cura Software
Comments