Risk Appetite Framework

One of the key components of the risk management framework is risk appetite. If risk appetite is well understood, it will enhance decision-making, improve business performance and assist in effectively managing the enterprise’s risks.

1. Risk Capacity

An organization’s risk capacity is measured by its available capital and its risk capacity utilization. In other words, how much capital is available to meet a Black Swan[1] event before additional capital is required by the organization for it to survive.

This risk capacity is not a static amount, rather, it needs to be regularly assessed. This should occur at least annually as the organization’s capital requirements will vary through its financial performance and strategic initiatives, which may be capital intensive.

“To perform this assessment, a company needs to estimate its prospective risk capacity utilization (i.e. capital required) for executing its strategic plan. To perform this analysis, it needs to project its risk profile over a three to five years planning horizon (approximating going concern conditions), under growth assumptions embedded in its strategic plan.

A properly constructed risk profile should enable a company to consider the impact of extreme conditions, often scenarios that include multiple catastrophes or financial crises, as well as the contribution of earnings retention to risk capacity. This basic strategic planning exercise, completed in a risk-aware framework will demonstrate the risk capital (and, thus, capacity utilization) required to execute the strategic plan.”[2]

2. Risk Appetite

Risk appetite is simply the value that the organization is willing to place at “risk”. In other words, it is the risk tolerance of the organization. Once this level has been breached, then additional risk management controls need to be implemented to bring the risk back to within an acceptable level i.e. risk appetite for its risk category.

The organization needs to determine its risk appetite for each risk category, for example:

·    Operational Risk
·    Market Risk
·    Credit Risk
·    Information Technology Risks

·   Liquidity Risk

This may be in the form of a capital allocation based on the organization’s risk capacity. This allocation represents the organization’s risk profile for each risk category. The allocation needs to be communicated to the risk owner from the outset and where required, adjusted each year based on capital requirements and economic conditions. Responsibility for risk appetite determination is with the organization’s Board of Directors. This risk appetite must be within the organization’s overall risk capacity limits. 

Effectively communicating its risk appetite will allow informed decision-making and promote a culture of an effective risk management.

The organization’s risk appetite must also be aligned to its strategies. Although each strategy will have a different level of risk attached, management must ensure that its overall strategy is within its risk capacity and risk appetite and that each strategy has risk tolerances to effectively manage the risk overall.

3. Risk Tolerance

Risk tolerance is a narrower concept than risk appetite, and refers to set limits imposed around risk appetite for each risk category. For example, an investor who is risk averse, would have a low risk appetite. Conversely, an investor who is willing to place at risk all of its capital for greater potential returns would be considered to have a high risk tolerance.

By operating within risk tolerances, management can be assured that the organization will remain within its risk appetite and overall within its risk capacity.

The organization’s management will set its risk tolerances for each strategy relative to the strategy’s contribution to achieving its overall strategic objective. By having risk tolerances for each strategy provides management with a degree of flexibility in resource allocation to achieve its objectives managing the risks within the overall risk appetite.

The organization may have to adjust its risk tolerances, risk appetite and its overall risk capacity if risks or financial conditions change, for example, changing market conditions (credit crisis). Organizations that have an adaptive risk appetite and can manage their risks are more likely to survive in a dynamic business environment by building in risk resiliency.

4. Risk Budgets