This document provides guidance on developing and implementing a risk appetite framework. It discusses how establishing risk appetite is important for meeting corporate governance requirements and addressing stakeholder expectations. It also notes that while the concept of risk appetite is straightforward, effectively defining and applying it in practice presents challenges. The document aims to help organizations better manage risk and meet governance duties by offering practical advice to boards and executives on assessing their risk tolerance. It received input from various professional associations and risk consulting firms who endorse the guidance and see risk appetite as a key topic for ongoing discussion.

1. Risk Appetite
& Tolerance
Guidance Paper

2. Foreword
Risk appetite today is a core By providing practical advice on While the Financial Reporting Council
consideration in any enterprise how to approach the development has kick-started the debate on risk
risk management approach. and implementation of a risk appetite and risk tolerance in the UK,
appetite framework we believe we it is a debate that resonates around
As well as meeting the requirements the world. As an integrated global risk
will be helping boards and senior
imposed by corporate governance consulting business, I can testify to the
management teams both to manage
standards, organisations in all sectors fact that our clients are debating risk
their organisations better and to
are increasingly being asked by key appetite. That is why we are pleased
discharge their corporate governance
stakeholders, including investors, to support the work of the Institute
responsibilities more effectively.
analysts and the public, to express of Risk Management in moving this
clearly the extent of their willingness to We are particularly pleased that a debate forward. We look forward to
take risk in order to meet their strategic large number of professional bodies are actively engaging with IRM and others
objectives. supporting this work – risk is everyone’s in promoting this thought-provoking
business and a common understanding document and turning risk appetite into
The Institute of Risk Management,
and approach helps us work together a day-by-day reality for boards and risk
now in its 25th year, has a key role to
to address this challenging area. management professionals around the
play in establishing sound practices
in this area and building consensus in Alex Hindson world.
what has, for too long, been a nebulous Chairman Larry Rieger
subject. The Institute of Risk Management CEO, Crowe Horwath
Global Risk Consulting
2

3. The Chartered Institute of Internal All successful organisations need to This document is an important
Auditors welcomes this contribution be clear about their willingness to contribution to a key area of board
from the Institute of Risk Management accept risk in pursuit of their goals. activity and helpfully addresses one of
to the debate on risk appetite and Armed with this clarity, boards and the issues highlighted in the Financial
risk tolerance. In theory, the idea of management can make meaningful Reporting Council’s Guidance on
deciding how much risk of different decisions about what actions to take at Board Effectiveness. ICSA is pleased to
types the organisation wishes to take all levels of the organisation and the support the work started here by IRM,
and accept sounds easy. In practice, it is extent to which they must deal with and looks forward to a well-informed
difficult and needs ongoing effort both the associated risks. But defining and debate and some useful conclusions.
from those responsible for governance implementing risk appetite is work in
Seamus Gillen
in agreeing what is acceptable and progress for many. CIMA therefore
Director of Policy
from all levels of management in warmly welcomes this new guidance
Institute of Chartered Secretaries and
communicating how much risk they from the Institute of Risk Management
Administrators (ICSA)
wish to take and in monitoring as a sound foundation for developing
how much they are actually taking. best practice on this critical topic.
Anything that stimulates debate on the
Gillian Lees
practical challenges of risk management
Head of Corporate Governance
is to be welcomed.
Chartered Institute of
Jackie Cain Management Accountants (CIMA)
Policy Director
Chartered Institute of Internal Auditors
This paper will be helpful to senior CIPFA is pleased to endorse this work This paper sends out a clear statement
managers in public service organisations by IRM on risk appetite and tolerance that the principle of risk appetite
who are trying to understand risk which provides welcome leadership emanating from the board is the
appetite in the context of their own on a challenging subject for both the only effective way to initiate an
strategic and operational decision public and private sectors. We look ERM implementation. Charterhouse
making. In its recently published Core forward to taking the debate further Risk Management is delighted to be
Competencies in Public Service Risk with our membership in pursuit of associated with the launch of this paper
Management, Alarm identified the our commitment to sound financial after contributing to the consultation
need to understand the organisation’s management and good governance. process. Our own experience with
risk appetite and risk tolerance, as clients confirms that this approach is
Diana Melville
part of the key function of identifying, not only critical, but that the whole
Governance Adviser
analysing, evaluating and responding to process must be undertaken with
Chartered Institute of Public Finance
risk. The ‘questions for the boardroom’, a practical rather than theoretical
and Accountancy
set out in this paper, could easily be vigour. This is an essential ingredient
translated into ‘questions for the of our delivery capability. References to
public organisation’s senior executive ‘appetite’ and ‘hunger’ only reinforce
committee’ and as such may be of value the living nature of the required
to many Alarm members and their approach.
organisations.
Neil Mockett
Dr Lynn T Drennan CTO
Chief Executive Charterhouse Risk Management
Alarm, the public risk management
association
3

4. Introduction
This guidance paper has been prepared The full version of this document is Members of the
under the overall direction of a available for free download from the
working group of the Institute of Risk website of the IRM and from partner Working Group
Management. The group has held a series organisations. Printed versions of the Richard Anderson, deputy
of meetings supplemented by much executive summary are also available. chairman of IRM and managing
virtual debate to explore ideas and agree director of Crowe Horwath Global
The original intent of this paper was in
the direction of the paper. We have had Risk Consulting
the first instance to provide guidance to
healthy discussions, and given the nature
directors, risk professionals and others Bill Aujla, CRO at Etisalat
of the topic, there have been areas
tasked with advising boards on compliance
that have proved contentious. We have Gemma Clatworthy, senior risk
with the part of the UK Corporate
presented the outline of the thinking in consultant at Nationwide Building
Governance Code that states that “the
various meetings and we circulated an Society
board is responsible for determining
early draft of this paper to in excess of
the nature and extent of the significant Roger Garrini, audit manager at
fifty individuals. We have also exposed it
risks it is willing to take in achieving its Selex Galileo
for a much wider consultation from which
strategic objectives” (Financial Reporting
we received many responses (see list of
Council, 2010). However, feedback from Paul Hopkin, director of IRM
people and organisations responding in
the consultation process has shown that and technical director of AIRMIC
Appendix B).
there is considerable interest in this topic
Steven Shackleford, senior
From this development process, we are in the public sector as well as the private
academic in audit and risk
confident that we are dealing with a sector and beyond the UK. While some
management at Birmingham City
topic that is relevant to many people in specifics might differ, the underlying
University
many organisations of different types principles hold true for all sectors and all
in all sectors and that there is sufficient geographical locations. John Summers, chief advisor – risk
consensus on issues and approaches at Rio Tinto
We have found that the approach
emerging to be able to publish this
contained in here has far reaching Carolyn Williams, head of thought
guidance. We know that future editions
resonance with anyone who is interested leadership at IRM
of this guidance may well be subject to
in the subject of risk appetite and
major revisions. That will be a sign of
tolerance. This is not a subject with an
good and healthy progress. It is in that
untarnished history: most UK banks would
context that we present this paper to
have been expected to define their risk
assist in boards’ deliberations on the
appetite, but not a single bank would
subject of risk appetite and tolerance. The
have said that it wished to court (and
paper consists of an executive summary,
in some instances succumb to) oblivion
which is designed to provide an overview
in the form of the financial crisis. We
on the subject for general use, particularly
are now poised to move beyond that
by board members, and a more detailed
thinking. Whether it is a matter of
document which is primarily designed
setting, monitoring or overseeing risk
to assist those whose task it is to advise
appetite, this is a subject that has proved
boards on these matters.
to be somewhat elusive - it means many
different things to many different people.
For example, some see it as a series of
limits, some see it as empowerment,
some see it as something that has to be
expressed in terms of net risk and others
gross. For this reason the subject deserves
serious attention. One of the purposes
of this document is to begin to provide
a common vocabulary for people who
wish to discuss this subject both within
their organisations, and also in comparing
organisations.
4

5. In writing this paper, we are conscious It is our view that risk appetite, correctly At a personal level, I would like to
that we may appear to have come at this defined, approached and implemented thank the numerous people who have
originally from a UK, quoted company- should be a fundamental business contributed to this paper, ranging from
centric perspective and that this is counter concept that could make a substantial the working group, through various
to IRM’s broad sectoral appeal and difference to how businesses and IRM meetings which debated early
international ethos. In fact, while this organisations are run. We fully expect versions of the thinking to Carolyn
guidance was originally written with the that the initial scepticism about risk Williams, head of thought leadership at
UK Corporate Governance Code in mind, appetite will be gradually replaced as IRM, and of course, all of those people,
comments and revisions arising from boards and executive directors gain clients, fellow risk professionals, internal
the consultation process mean that it is greater insight into its usefulness. We auditors, and many, many others, who
applicable to all sectors in all geographies. also anticipate that analysts will soon be have discussed this subject with all of the
We continue to welcome feedback from asking chief executives, chairmen and members of the Working Group. I am,
readers in this regard. finance directors about risk appetite. of course, particularly pleased that other
After all, this subject is at the heart of the professional bodies of considerable repute
Our objective in writing this document has
organisation: risk-taking, whether private, agree sufficiently with our approach to
been to give:
public or third sector, whether large or put their names also to this document.
1. A theoretical underpinning to the small is what managing an organisation
Richard Anderson
subject of risk appetite; but is about. The approach of the new UK
2. More importantly, to provide some Corporate Governance Code represents Deputy Chairman
guidance for those who need to deal an opportunity to place risk management, The Institute of Risk Management
with the subject, either for their and in particular risk appetite, right at September 2011
corporate governance statements, or, the centre of the debate on effective
alternatively, simply because they think corporate governance and the role of the
the discussion would inform the way board in running organisations.
their organisation is run. We would like to know whether or not
This guidance is not definitive: we do not the approach in this paper has been
think that we have written the last word helpful to you as you work through the
on the subject. Thinking on the subject ramifications of risk appetite and risk
of risk appetite and risk tolerance will tolerance in your own organisation.
continue to develop and, if, as we hope, Please take the time to tell us so that we
this booklet is superseded before too can both keep abreast of developments
many reporting seasons come and go, and make sure that we are sharing best
then we will know that the concept is practice. At IRM we are passionate about
beginning to take root. leading the profession, and this is one way
that we can do so.
About IRM About the Author
The Institute of Risk Management (IRM) is Richard Anderson, the principal author of this
the world’s leading enterprise risk management booklet, is Deputy Chairman of IRM. Richard is also
education Institute. We are independent, well- Managing Director of Crowe Horwath Global Risk
respected advocates of the risk profession, owned by Consulting in the UK. A Chartered Accountant, and
practising risk professionals. We provide qualifications, formerly a partner at a big-4 practice, Richard has
short courses and events at a range of levels also run his own GRC practice for seven of the last
from introductory to board level and support risk ten years. Richard has been professionally involved
professionals by providing the skills and tools needed with risk management since the mid-nineties and has
to deal with the demands of a constantly changing, broad industry sector experience. He wrote a report
sophisticated and challenging business environment. for the OECD on Corporate Risk Management in the
We operate internationally with members and banking sector in the UK, the USA and France. He is
students in over 90 countries, drawn from a variety of a regular speaker at conferences and contributes to
risk-related disciplines and a wide range of industries many journals on risk management and governance
in the private, third and public sectors. issues.
5

6. Contents
Introduction 4 Balanced risk 26 Table of Figures
About IRM 5 Risk management clockspeed 26
Figure 1 - Performance over time 14
About the Author 5 Control issues 27
Figure 2 - Possible outcomes 14
Executive Summary 7 Measurement 27
Figure 3 - Risk Universe 14
Principles and approach 7 Strategic 29
Figure 4 - Risk Tolerance 14
Risk appetite and performance 8 Tactical and operational 29
Figure 5 - Risk Appetite 14
Putting it into practice 9 Data 29
Figure 6 - Risk Appetite in Context 16
Five tests for risk appetite Constructing a risk appetite -
Figure 7 - Risk Culture Diagnostic 22
frameworks 9 questions for the boardroom 29
Figure 8 - Risk Appetite - Main Issues 23
Questions for the boardroom 10
IV Implementing a risk appetite 30 Figure 9 - Shareholder Value Model (1) 28
I Background 11 Sketch 31 Figure 10 - Shareholder Value Model (2) 28
The UK Corporate Stakeholder engagement 31 Figure 11 - Shareholder Value Model (3) 28
Governance Code 11 Develop 32 Figure 12 - Stages of Development
Risk appetite and risk tolerance 14 Approve 32 of Risk Appetite 30
A word of caution 15 Implement 32 Figure 13 - Governing a Risk Appetite 33
Key terms and phrases 15 Report 32
Background - questions for Review 32
the boardroom 15
Implementing a risk appetite -
II Designing a risk appetite 16 questions for the boardroom 32
Risk capacity 17 V Governing a risk appetite 33
Risk management maturity 19 Governing risk appetite -
Multiple risk appetites 21 questions for the boardroom 34
Risk culture 21
VI The journey is not over 35
Key terms and phrases 21
The journey is not yet over - final
Designing a risk appetite - questions for the boardroom 35
questions for the boardroom 22
Bibliography 36
III Constructing a risk appetite 23
Appendix A: Determining the risks
Levels of risk appetite 23 the board is willing to take 37
Strategic 23 Responsibilities for risk taking 37
Risk taxonomies 24 Process for managing risk taking 38
Tactical 25 Appendix B: List of respondents
Project or operational 25 to consultation 39
Propensity to take risk 25
Propensity to exercise control 25
6

7. Executive Summary
Principles and approach “It is often said that no
company can make a
The following key principles have underpinned our work on risk appetite: profit without taking a
risk. The same is true
1. Risk appetite can be complex. Excessive risk management maturity. Risk
simplicity, while superficially attractive, management remains an emerging for all organisations: no
leads to dangerous waters: far better discipline and some organisations, organisation, whether in the
to acknowledge the complexity and irrespective of size or complexity, do private, public or third sector
deal with it, rather than ignoring it. it much better than others. This is in can achieve its objectives
2. Risk appetite needs to be measurable. part due to their risk management
culture (a subset of the overall without taking risk. The
Otherwise there is a risk that any
statements become empty and culture), partly due to their systems only question is how much
vacuous. We are not promoting any and processes, and partly due to the risk do they need to take?
individual measurement approach nature of their business. However, And yet taking risks without
but fundamentally it is important until an organisation has a clear view
of both its risk capacity and its risk
consciously managing those
that directors should understand
how their performance drivers are management maturity it cannot be risks can lead to the downfall
impacted by risk. Shareholder value clear as to what approach would work of organisations. This is the
may be an appropriate starting or how it should be implemented. challenge that has been
point for some private organisations, 5. Risk appetite must take into account highlighted by the latest
stakeholder value or ‘Economic differing views at a strategic, tactical
Value Added’ may be appropriate for and operational level. In other words,
UK Corporate Governance
others. We also anticipate more use while the UK Corporate Governance Code issued by the Financial
of key risk indicators and key control Code envisages a strategic view of Reporting Council in 2010.”
indicators which should be readily risk appetite, in fact risk appetite
available inside or from outside the needs to be addressed throughout
organisation. Relevant and accurate the organisation for it to make any
data is vital for this process and we practical sense.
urge directors to ensure that there 6. Risk appetite must be integrated with
is the same level of data governance the control culture of the organisation.
over these indicators as there would be Our framework explores this by
over routine accounting data. looking at both the propensity to take
3. Risk appetite is not a single, fixed risk and the propensity to exercise
concept. There will be a range of control. The framework promotes
appetites for different risks which need the idea that the strategic level is
to align and these appetites may well proportionately more about risk taking
vary over time: the temporal aspect of than exercising control, while at the
risk appetite is a key attribute to this operational level the proportions
whole development. are broadly reversed. Clearly the
4. Risk appetite should be developed relative proportions will depend on
in the context of an organisation’s the organisation itself, the nature of
risk management capability, which the risks it faces and the regulatory
is a function of risk capacity and environment within which it operates.
7

8. Risk and control The innovation is in looking at the
interaction of risk and control as
implementation of strategy. In the
detailed paper we have included a
We think that this dual focus on taking part of determining risk appetite. few suggestions as to how boards
risk and exercising control is both Proportionately more time is likely to might like to consider these dual
innovative and critical to a proper be spent on risk taking at a strategic responsibilities. Above all, we are
understanding of risk appetite and level than at an operational level, very much focused on the need to
risk tolerance. The innovation is not in where the focus is more likely to take risk as much as the traditional
looking at risk and control – all boards be on the exercise of control. One pre-occupation of many risk
do that. word of caution though, we are not management programmes, which
equating strategy with board level and is the avoidance of harm.
operations with lower levels of the
organisation. A board will properly
want to know that its operations are
under control as much as it wants
to oversee the development and
Risk appetite and The illustrations on these pages show
the relationship between risk appetite,
Risk tolerance can be expressed in terms
of absolutes, for example “we will not
Performance tolerance and performance. Diagram
1 shows the expected direction of
expose more than x% of our capital to
losses in a certain line of business” or
Our view is that both risk appetite and performance over the coming period. “we will not deal with certain types of
risk tolerance are inextricably linked to Diagram 2 illustrates the range of customer “.
performance over time. We believe that performance depending on whether
Risk appetite, by contrast is about
while risk appetite is about the pursuit of risks (or opportunities) materialise. The
what the organisation does want to do
risk, risk tolerance is about what you can remaining diagrams demonstrate the
and how it goes about it. It therefore
allow the organisation to deal with. difference between:
becomes the board’s responsibility to
Organisations have to take some risks • all the risks that the organisation define this all-important part of the
and they have to avoid others. The big might face (the “risk universe”- risk management system and to ensure
question that all organisations have diagram 3) that the exercise of risk management
to ask themselves is: just what does • those that, if push comes to shove, throughout the organisation is consistent
successful performance look like? This they might just be able to put up with with that appetite, which needs to remain
question might be easier to answer for (the “risk tolerance” - diagram 4) and within the outer boundaries of the risk
a listed company than for a government tolerance. Different boards, in different
• those risks that they actively wish to
department, but can usefully be asked by circumstances, will take different views on
engage with (the “risk appetite” -
boards in all sectors. the relative importance of appetite and
diagram 5).
tolerance.
We believe that the appetite will be
smaller than the tolerance in the vast
majority of cases, and that in turn will
be smaller than the risk universe, which
in any case will include “unknown
unknowns”.
Where you might
get to if some
“good” things happen
Performance
Performance
Performance
Current direction
of travel for performance
Risk
Universe
t0 Time t1 t0 Time t1
t0 Time t1
Where you might
Where you might get to if some
get to if some “bad” things happen
“bad” things happen
Diagram 1 Diagram 2 Diagram 3
Performance
Performance
Risk Risk
Tolerance Appetite
t0 Time t1 t0 Time t1
Where you might Where you might
get to if some get to if some
“bad” things happen “bad” things happen
Diagram 4 Diagram 5
8

9. Putting it into Consultation - in our paper we have
set out an illustrative process for the
Flexibility - all of this needs to be
carried out with the basic precept in
practice development of an approach to risk
appetite. This includes appropriate
mind that risk appetite can and will
change over time (as, for example, the
We have sought to develop an approach consultation with those external and economy shifts from boom to bust, or
to risk appetite that: internal stakeholders, with whom the as cash reserves fall). In other words,
board believes it appropriate to consult breaches of risk appetite may well
• is theoretically sound (but the theory on this matter. It also includes a review reflect a need to reconsider the risk
can quickly disappear into the process by the board, or an appropriate appetite part way through a reporting
background) committee of the board, and finally it cycle as well as a more regular review
• is practical and pragmatic: we do not includes a review process at the end of the on an annual cycle. Rapid changes in
want to create a bureaucracy, rather cycle so that appropriate lessons can be circumstances, for example as were
we are looking to help find solutions learned. witnessed during the financial crisis in
that can work for organisations of all 2008-9, might also indicate a need for
shapes and sizes Risk Committees - in his 2009 Review
an organisation to re-appraise its risk
of Corporate Governance in UK Banks
• will make a difference. appetite. In a fast changing economic
and Other Financial Industry Entities,
climate, it is especially important
Boardroom debate - we suspect that in Sir David Walker recommended that
for firms to have not only a clearly
the early days particularly, a successful financial services organisations should
defined strategy, but also a clearly
approach to reviewing risk appetite make use of board risk committees. The
articulated risk appetite framework
and risk tolerance in the boardroom Economic Affairs Committee of the House
so that they are able to react quickly
will necessarily lead to some tensions. of Lords recently suggested that large
to the challenges and opportunities
In other words we think that it should organisations in other sectors should also
presented during such times.
make a difference to the decisions that consider creating such committees. We
are made, otherwise it will diminish into think that the creation and monitoring
a mere tick-box activity – and nobody of approaches to risk appetite and
needs any more of those in the board risk tolerance should be high on the
room. It is essential that the approach agenda of these committees. In the
that we are setting out in the detailed detailed document, we have included
guidance can and should be tailored a brief section on the role of the board
to the needs and maturity of the or risk committee: we are suggesting
organisation: it is not a one-size-fits-all that governance needs to be exercised
approach. over the framework at four key points:
approval, measurement, monitoring and
learning.
Five tests for risk appetite frameworks
In summary, there are five tests that 3. Are both managers and executives
“The risk appetite statement is Directors should apply in reviewing their clear that risk appetite is not constant?
generally considered the hardest part organisation’s risk appetite statement: It changes as the environment and
of any Enterprise Risk Management business conditions change. Anything
1. Do the managers making decisions
implementation. However, without approved by the board must have
understand the degree to which they
clearly defined, measurable tolerances some flexibility built in.
(individually) are permitted to expose
the whole risk cycle and any risk the organisation to the consequences 4. Are risk decisions made with full
framework is arguably at a halt.” of an event or situation? Any risk consideration of reward? The risk
appetite statement needs to be appetite framework needs to help
Jill Douglas, Head of Risk,
practical, guiding managers to make managers and executives take an
Charterhouse Risk Management
risk-intelligent decisions. appropriate level of risk for the
business, given the potential for
1. Do the executives understand their
reward.
aggregated and interlinked level of
risk so they can determine whether it is We believe that by following the guidance
acceptable or not? set out in detail in our document, directors
will be able to be confident that they can
2. Do the board and executive leadership
pass all of those five tests.
understand the aggregated and
interlinked level of risk for the
organisation as a whole?
9

10. Questions for the boardroom
Below we set out some questions that we think boards may want to consider, as part
of an iterative process over time, as they develop their approaches to risk appetite and
which will enable them to remain at the forefront of the discussion. One clear outcome
from our consultation exercise was that, despite the expected variation in views on the
technical aspects of risk appetite, there was a common acceptance of these questions as
a useful starting point for board discussion.
Background Constructing a risk appetite Governing a risk appetite
1. What are the significant risks the 12. Does the organisation understand 20. Is the board satisfied with the
board is willing to take? What are the clearly why and how it engages with arrangements for data governance
significant risks the board is not willing risks? pertaining to risk management data
to take? 13. Is the organisation addressing all and information?
2. What are the strategic objectives of relevant risks or only those that can 21. Has the board played an active
the organisation? Are they clear? What be captured in risk management part in the approval, measurement,
is explicit and what is implicit in those processes? monitoring and learning from the risk
objectives? 14. Does the organisation have a appetite process?
3. Is the board clear about the nature framework for responding to risks? 22. Does the board have, or does it need,
and extent of the significant risks it is a risk committee to, inter alia, oversee
willing to take in achieving its strategic Implementing a risk appetite the development and monitoring of
objectives? the risk appetite framework?
15. Who are the key external stakeholders
4. Does the board need to establish and have sufficient soundings been
clearer governance over the risk taken of their views? Are those views The journey is not over - final
appetite and tolerance of the dealt with appropriately in the final thoughts
organisation? documentation? 23. What needs to change for next time
5. What steps has the board taken to 16. Has the organisation followed a round?
ensure oversight over the management robust approach to developing its risk 24. Does the organisation have sufficient
of the risks? appetite? and appropriate resources and
17. Did the risk appetite undergo systems?
Designing a risk appetite appropriate approval processes, 25. What difference did the process make
6. Has the board and management including at the board (or risk and how would we like it to have an
team reviewed the capabilities of the oversight committee)? impact next time round?
organisation to manage the risks that 18. Is the risk appetite tailored and
it faces? proportionate to the organisation?
7. What are the main features of the 19. What is the evidence that the
organisation’s risk culture in terms organisation has implemented the risk
of tone at the top? Governance? appetite effectively?
Competency? Decision making?
8. Does an understanding of risk
permeate the organisation and its
culture? Hungry for risk?
9. Is management incentivised for good The word “appetite” brings connotations of food, hunger and satisfying one’s
risk management? needs. We think that this metaphor is not always helpful in understanding the
10. How much does the organisation phrase “risk appetite”. When those two words appear together we think it is
spend on risk management each year? more appropriate to think in terms of ‘fight or flight’ responses to perceived risks.
How much does it need to spend? Most animals, including human beings, have a ‘fight or flight’ response to risk. In
11. How mature is risk management in the humans this can be over-ruled by our cognitive processes. Our interpretation of
organisation? Is the view consistent at risk appetite is that it represents a corporate version of exactly the same instincts
differing levels of the organisation? Is and cognitive processes. However, since these instincts are not ”hardwired“ in our
the answer to these questions based corporate “nervous and sensory” systems we use risk management as a surrogate.
on evidence or speculation?
10

11. I Background
“What is this all about?”
101 In recent years we have
witnessed some major risk 102
The rest of this section
explores the nature of the The UK Corporate
events ranging from the
global financial crisis to the more recent
words in the Code, and looks
at the existing guidance which
Governance Code
might help to understand the words. In its recent update to
sovereign debt crisis and a large number
of natural and meteorological events with
103 the UK Corporate Governance
• Sections II and III of this document look
major consequential damage and knock- Code, the FRC has expanded
at a proposed new framework of risk
on effects. But the financial crisis of 2008 the section of the Code on Accountability
appetite and risk tolerance
had many consequences, and raised many as set out in the box below:
questions, not least of which was the • Sections IV and V look at the
question as to why boards failed to see it practicalities of implementing and .
coming. At the request of the Prime overseeing risk appetite and risk Section C: Accountability
Minister of the day, Sir David Walker tolerance
The board should present a balanced
carried out a review of the corporate • Section VI addresses some of the issues
and understandable assessment
governance of Banks and Other Financial that might require further thought,
of the company’s position and
Institutions (“BOFI’s”) and this was and
prospects. The board is responsible for
followed swiftly by a review of the • Appendix A presents a summary of determining the nature and extent of
broader corporate governance landscape how, in practical terms, a board might the significant risks it is willing to take
in the UK by the Financial Reporting go about determining the risks it is in achieving its strategic objectives.
Council (the “FRC”). The FRC made the willing to take. The board should maintain sound risk
all-important link between this question
Throughout the paper we have indicated management and internal control
and the subject of risk appetite and risk
questions that could usefully be explored systems.
tolerance by inserting reference to these
in the boardroom to ensure that the
two topics in their draft changes to The board should establish formal
subjects of risk appetite and tolerance are
Section C of the UK Corporate Governance and transparent arrangements for
being appropriately addressed.
Code (the “Code”) (Financial Reporting considering how they should apply
Council, 2010). While those very words the corporate reporting and risk
failed to survive the cut, the concept did management and internal control
survive. Under the newly expanded principles...
Section C, a board is explicitly tasked with
being responsible for “determining the
nature and extent of the significant risks it
[the board] is willing to take in achieving
its strategic objectives”. This is risk
appetite and tolerance by any other name.
11

12. 104
This Section is further
105
This paper explores the risk How has “risk appetite”
expanded in the detailed management ramifications of
provisions of the Code: these high level statements, been used before?
and in particular those Risk appetite is a phrase that is
relating to the “nature and extent of the 107 widely used but frequently in
C.1 Financial and Business significant risks [the board] is willing to different contexts and for
take in achieving its strategic objectives”. different purposes. It is a
Reporting These are the words that replace the phrase that for some people conveys
C.1.2 The directors should include references to risk appetite and tolerance poorly its meaning, and in respect of
in the annual report an explanation in earlier drafts. It is worth noting that this which the meaning is different for
of the basis on which the company sentence immediately precedes the different groups of people. Based on the
generates or preserves value over requirement that “the board should work that was undertaken in writing this
the longer term (the business model) maintain sound risk management and paper it was clear that there is little
and the strategy for delivering the internal control systems”. So we might certainty as to what the phrase means, but
objectives of the company. infer that this is not empty rubric, but there seems to be almost unanimity that it
rather a matter of substance, especially could be, and indeed ought to be a useful
C.2 Risk Management and since Code Provision C.2.1 goes on to concept, if only it could be properly
Internal Control require the board “at least annually [to] expressed. Some people prefer other
conduct a review of the effectiveness of terms such as risk attitude or risk capacity.
Main Principle the company’s risk management and As far as we are concerned there is
internal control systems...” To some this nothing fundamentally wrong in using
The board is responsible for
sounds like a recipe for Sarbanes-Oxley any of these terms. Suffice it to say that in
determining the nature and extent
s404 style work. This is clearly not the writing this guidance we are taking a very
of the significant risks it is willing
intent of the FRC, nor would it be pragmatic view: risk appetite is the most
to take in achieving its strategic
welcomed in most UK boardrooms. common phrase that we have come across,
objectives. The board should
However, the fact of this review has to be it is the one that was used by the FRC in
maintain sound risk management
reported to shareholders. The the context of the draft Corporate
and internal control systems.
juxtaposition of the “significant risks” Governance Code and therefore we
Code Provision sentence with the requirement to would prefer to define this term in a way
maintain “sound risk management and that begins to make sense for as many
C.2.1 The board should, at least
internal control systems” might lead the people as possible.
annually, conduct a review of the
reader to surmise that the risk appetite
effectiveness of the company’s risk Given the lack of conformity
element is one of the reasons that
management and internal control
organisations require risk systems. Overall 108 about the meaning of the
systems and should report to phrase, it is worth looking at
this is a radical new departure for the FRC
shareholders that they have done the key standards on risk
and introduces a new concept for many
so. The review should cover all management, ISO31000 (ISO, 2009) and
directors and boards of non-financial
material controls, including financial, BS311001 (British Standards, 2008), to see
services organisations.
operational and compliance controls. what light they shed on the subject.
As an aside, it seems that the
106 terms “risk appetite” and “risk
Interestingly ISO31000, the international
standard, is silent on the subject of risk
tolerance” have deep appetite (focusing instead on ‘risk
associations with the financial attitude’ and ‘risk criteria’), although
services industry in some minds, and Guide 73 (ISO, 2002) defines risk appetite
attempts to move non-financial services as the “amount and type of risk that an
organisations in that direction might have organisation is willing to pursue or
been difficult. However these words can retain.” Some people argue that ISO31000
be seen, for all intents and purposes, as is silent on the subject of because it is
being indistinguishable from the previous neither a useful phrase not a meaningful
phrases. While many commentators see concept. They therefore focus more on risk
them as inseparable phrases, we focus criteria. On the other hand, we believe
predominantly on the concept of risk that there is a benefit from exploring
appetite in this paper as a way of what we think is turning out to be a
providing guidance to directors and those useful and meaningful concept.
tasked with advising directors on the
requirements of the Code in so far as they
relate to risk appetite and tolerance.
Definition of Risk Appetite
ISO 31000 / Guide 73 BS31100
Amount and type of risk that an Amount and type of risk that an
organisation is willing to pursue or retain organisation is prepared to seek, accept or
tolerate
1
At the time of writing, this document is undergoing
revision. Nevertheless the approach in the 2008
document has proved most useful for this discussion.
12

13. The original BS31100 We are concerned that this In conclusion, BS31100
109 contained more detail. It 111 focus treats risk in an unduly 113 provides some guidance on
defined risk appetite as the negative way, something how to use risk appetite, but it
“amount and type of risk that which we are challenging in does not (nor did it ever set out to)
an organisation is prepared to seek, accept this booklet in the sense that there should provide guidance on how to calculate or
or tolerate” – very similar to Guide 73. The be a maximum tolerance for risk taking as measure risk appetite, although the
standard went on to define risk tolerance well as risk avoidance. standard does suggest the use of
(bearing in mind that the definition of risk “quantitative statements”, without
While neither standard is very
appetite includes reference to tolerating
risk) as an “organisation’s readiness to
112 informative, it is instructive to further elaborating. It is interesting to
see how the “appetite” word note that the revised version of BS31100
bear the risk after risk treatments in order has substantially removed references to
or similar words were used in
to achieve its objectives”. The definition risk appetite to bring it in line with
the original BS31100:
then includes a rider which states: “NOTE: ISO31000. This leaves something of a
risk tolerance can be limited by legal or Paragraph 3.1 Governance includes vacuum on the subject, which this
regulatory requirements”. a bullet to the effect that the risk guidance seeks to fill.
management framework should have
Notwithstanding the regular “defined parameters around the level of
110 appearance of risk appetite and risk that is acceptable to the organisation,
risk tolerance in the same and thresholds which trigger escalation,
sentence (or definition in the review and approval by an authorised
case of BS31100) it is our belief that risk person/body.”
tolerance is a much simpler concept in that
Paragraph 3.3.2 Content of the risk
it tends to suggest a series of limits which,
management policy has the first explicit
depending on the organisation, may either
reference to risk appetite saying that
be:
this should be included in the policy
and should outline “the organisation’s
• In the nature of absolute lines drawn
risk appetite, thresholds and escalation
in the sand, beyond which the
procedures”
organisation does not wish to proceed;
or Paragraph 3.8 Risk appetite and
• More in the nature of tripwires, that risk profile provides a much more
alert the organisation to an impending comprehensive commentary on risk
breach of tolerable risks. appetite, which is set out below:
1. “Considering and setting a risk
appetite enables an organisation to
increase its rewards by optimizing
risk taking and accepting calculated
risks within an appropriate level of
authority
2. “The organisation’s risk appetite
should be established and/or approved
by the board (or equivalent) and
effectively communicated throughout
the organisation
13

14. Risk “appetite” and
risk “tolerance”
The difference can be
114
Before we started on this
project, it was our belief that
115 illustrated in the diagrams on
118
On the other hand, our
“appetite” for risk is likely to
we, and more importantly the bottom of this page.
be shown by a narrower band
directors and risk of performance outcomes
Figure 1 shows performance
professionals, could easily distinguish
between risk appetite and risk tolerance 116 from the current time (t0) to
shown by the triangle AMN.
and that the former was the more sometime in the future (t1).
Risk tolerance can therefore
complicated concept. In practice we have The line AB shows the current
expected direction of travel in terms of
119 be expressed in terms of
found that in many instances these terms absolutes: for example “we
are used inter-changeably. We think that is performance. Figure 2 shows that in
will not expose more that x%
conceptually wrong: there is a clear practice this is subject to risks which,
of our capital to losses in a certain line of
difference between the two. It is also should they materialise, could result in
business”, or “we will not deal with a
worth noting that in the eyes of some performance along the line AC, or to
certain type of customer”. Risk tolerance
commentators, risk tolerance is the more opportunities (positive risks) which could
statements become “lines in the sand”
important concept. While risk appetite is result in performance along the line AD.
beyond which the organisation will not
about the pursuit of risk, risk tolerance is The potential risk universe or the total risk
move without prior board approval.
about what you can allow the exposure is shown by the difference
organisation to deal with. Without a between C and D. (see Figure 3)
Risk appetite on the other
doubt there will be occasions where an
What is clear is that following
120 hand is about what the
organisation can deal with more risk than
it is thought prudent to pursue. 117 line AC is not desirable. Less
organisation does want to do
and how it goes about it. It
clear is that it might also be
therefore becomes the board’s
undesirable to follow line AD
responsibility to define this all important
because pursuing it might throw up
part of the risk management system and
substantial additional risks. Consequently,
to ensure that the exercise of risk
there are some risk outcomes for which
management and all that entails is
there is no tolerance, and moreover no
consistent with that appetite, which needs
tolerance for taking those risks. Moreover,
to remain within the outer boundaries of
since we are using the generally accepted
the risk tolerance.
concept of risk as being potentially
positive as well as negative, that suggests
While we have focused
that there is a range shown by the triangle
AXY (See Figure 4), outside of which the
121 primarily on risk appetite,
organisation will not tolerate exposure. some entities (such as
This is the risk tolerance. Government departments)
may be more focused on risk tolerance.
This in itself becomes a more complicated
Where you might
issue where the risk of insolvency (the
get to if some
“good” things happen
ultimate determination of failure for
D corporates) is absent. Defining success and
Performance
Performance
Current direction
of travel for performance failure is therefore very important. This is
an area where we believe further work is
A A
required. What is clear is that different
B B
boards in different circumstances will take
different views as to which of these two
t0 t1 t0 t1
Time Time
concepts is more important for them at
any given time.
Where you might
get to if some
“bad” things happen C
Figure 1 - Performance over time Figure 2 - Possible outcomes
D M
Performance
Performance
Performance
X
Risk
Risk
A Risk A Appetite
A Tolerance
B Universe
Y
N
t0 Time t1
t0 Time t1 t0 Time t1
Where you might
get to if some Where you might
Figure 3 - Risk Universehappen
“bad” things C Figure 4 - Risk Tolerance
get to if some
“bad” things happen
Figure 5 - Risk Appetite
14

15. A word of caution Key Terms and Phrases
The word “appetite” brings connotations of food, In this section we have used three key terms which
122 hunger and satisfying one’s needs. We think that this 124 we will continue to use throughout the document. In
metaphor is not always helpful in understanding the the absence of helpful definitions elsewhere, we are
phrase “risk appetite”. When those two words appear together defining them as set out here:
we think it is more appropriate to think in terms of “fight or
flight” responses to perceived risks. Phrase Meaning
Most animals, including human beings have a “fight or flight” Risk appetite The amount of risk that an organisation is
response to risk. In humans this can be over-ruled by our willing to seek or accept in the pursuit of its
cognitive processes. Our interpretation of risk appetite is that it long term objectives.
represents a corporate version of exactly the same instincts and
cognitive processes. Except of course, as a legal fiction(as opposed Risk tolerance The boundaries of risk taking outside of which
to biological reality) organisations do not have their own brains, the organisation is not prepared to venture in
nervous systems, sensory organs and instincts. They ‘borrow’ these the pursuit of its long term objectives.
from members of their boards and from their employees. Risk universe The full range of risks which could impact,
either positively or negatively, on the ability
These systems have to be created in terms of interactions of
of the organisation to achieve its long term
people, data systems and management information which enable
objectives.
people in the organisation to act as if they were parts of the same
physical organism.
It is our expectation that for most organisations, the
125 risk appetite will be smaller than the boundaries
Conclusion depicted by its risk tolerance.
123
There are four early conclusions that The rest of this document
we have drawn from the work we
We have set out a route through this topic of risk
have undertaken in preparing this 126 appetite in the rest of this document as follows
guidance: under the following main headings:
Section II: Designing a risk appetite
• he first is that we would benefit from a renewed
T
focus on defining the terms that we are using. We Section III: Constructing a risk appetite
have therefore developed glossaries of key terms and
phrases which appear throughout this guidance. Section IV: Implementing a risk appetite
• he second is that setting a risk appetite is only a
T Section V: Governing a risk appetite
worthwhile exercise if you, as an organisation, are Section VI: The journey is not over
able to manage the risk to the level at which it is set.
In Section VI we explore some of the issues that we will need to
• he third is that there is very little by way of formal
T explore as we develop this concept as a boardroom topic over the
guidance on the definition of risk appetite. We coming years.
have reviewed plenty of documents both from
professional organisations and from consulting firms.
However, our belief is that this subject remains under
developed and the remainder of this booklet aims to
play a part in redressing that shortcoming. Background - Questions for
• he fourth is that risk appetite can and indeed must
T
change, for example as the economy shifts from
the Boardroom
boom to bust and back again, or as cash reserves • What are the significant risks the board is willing to
fall. Risk appetite, and indeed risk tolerance, both take? What are the significant risks the board is not
have a temporal element, which is reflected in the willing to take?
way in which we have discussed the monitoring and • What are the strategic objectives of the organisation?
governance of risk appetite later in this booklet. Are they clear? What is explicit and what is implicit in
those objectives?
• Is the board clear about the nature and extent of the
significant risks it is willing to take in achieving its
strategic objectives?
• Does the board need to establish clearer governance
over the risk appetite and tolerance of the
organisation?
• What steps has the board taken to ensure oversight
over the management of the risks?
15

16. II Designing a risk appetite
“The Building Blocks”
In developing a possible • Risk appetite has a temporal management approach is not of itself
201 framework for risk appetite, dimension: in other words the appetite a problem; it simply is a statement of
the IRM working group was and tolerance will change over time fact for a given organisation. There are
conscious of five key factors: as circumstances change. Risk appetite some very large companies that are
is not something that can be written relatively unsophisticated in their risk
• We heard about organisations that in tablets of stone and then ignored management and smaller ones that are
appeared to have defined very for the rest of the year. Equally, the very advanced. Recognising where your
misleading risk appetites: for example risk appetite for tomorrow may be organisation sits on this spectrum is an
an organisation that concluded that very different to the risk appetite for a important first step in developing and
it was “hungry” for IT risk and which period ten or twenty years hence. articulating risk appetite.
therefore apparently relaxed many
of the normal process controls that • Finally, we are conscious that different
organisations are at different stages in With all of this at the back of
surround system development. As a
consequence they failed in at least two their development of risk management, 202 our minds, the risk appetite
let alone risk appetite. For some it will working group of IRM has
major implementations because basic
be a comparatively simple additional developed an approach to
and fundamental control processes
step, for others it will be harder. For unpack the various elements of risk
were not followed. The system failures
this reason we have adopted the appetite. The framework is depicted in the
were so far reaching that most of the
phrase that appears repeatedly in diagram below:
board either felt compelled to resign
or were removed from post. The lesson BS31100: organisations should develop
that we drew from this and other a tailored and proportionate response.
examples was that risk appetite has at We have defined this in terms of
least two components: risk and control risk capability, which is a function
and that to consider either in isolation of risk capacity and organisational
could result in sub-optimal decisions. maturity. We do not mean this in any
sense pejoratively: an immature risk
• We were conscious that risk appetite
needs to be a measurable concept.
There are many examples of risk Capacity: Financial
management being a rather empty
and vacuous process which can at best
be described as being “data-lite”, if Maturity: Business Context
Capacity: People and Knowledge
not “data-free” zones. We therefore
believe that risk appetite needs Level Propensity Propensity Measurement
to take risk to exercise
to have some form of meaningful
Maturity: Risk Processes
Capacity: Infrastructure
Maturity: Risk Systems
control
“yardstick” to support its proper
implementation. Strategic Risk Taking Stakeholder
• There is a broad consensus that there Value
is no single risk appetite, but rather
a range of appetites for different
types of risk and this range of Tactical Risk
Metrics
appetites needs to align under, and be
consistent with, an overall risk appetite
framework. It therefore seemed Project/ Control
appropriate to look at the subject of Operational Exercising Metrics
risk appetite at different levels. Control
Maturity: Risk Management Culture
Capacity: Reputational
Figure 6 - Risk Appetite in Context
16

17. 203
This framework has several
key features:
3. The approach outlined envisages risk
appetite being set at strategic, tactical Risk Capacity
and operating levels. In other words, There is little advantage in
1. It is our view that risk appetite should
while the UK Corporate Governance Code 204 having a substantial appetite,
envisages a strategic view of risk appetite, or indeed tolerance for risk,
be established in the context of what
in fact risk appetite needs to be addressed unless the capacity to manage
we are calling the risk capability of the
throughout the organisation for it to it also exists. In traditional terms, risk
organisation. Risk capability is a function
make any practical sense. This “allocation” capacity is a concept which has been
of risk capacity: the ability to carry risks,
of risk appetite across different aspects closely associated with the insurance
and the risk management maturity to
of the organisation represents one of the industry: at what level of deductible does
manage them.
biggest challenges, and remains an area a policy need to kick-in in order to protect
a. Risk capacity might be defined in terms where we believe that further work is the balance sheet or (in more limited
of items such as, for example, assets required. circumstances) the income statement of
and liabilities, reputation, liquidity or the organisation? What is the maximum
4. We are of the view that understanding
political capital. extent of insurance cover that is required?
risk appetite cannot be done in isolation
of understanding the control culture of And so on. In this document, we are
b. On the other hand, while an
the organisation. This framework explores extending this concept beyond the direct
organisation might have the capacity
this by looking at both the propensity to financial consequences. We see capacity as
it equally needs to have the risk
take risk and the propensity to exercise being an enabler of risk taking as well as a
management or organisational
control. The framework promotes the idea cushion for risk loss-events. We also see it
maturity to manage risks, which we
that the strategic level is proportionately as having non-financial dimensions, which
are calling the risk management
more about risk taking than exercising might include items such as:
maturity of the organisation. In other
words there is little advantage for a control, while at the operational level the a. Reputation: an organisation needs
relatively immature business seeking proportions are broadly reversed. Clearly to have the wherewithal from a
to set a sophisticated risk appetite the relative proportions will depend reputational perspective both to
if it does not have the competence on the organisation itself, the nature achieve its objectives and withstand
and capability to manage to the of the risks it faces and the regulatory pressures as they arise.
risk appetite that they are setting. environment within which it operates.
b. Political: in some cases an organisation
Therefore, it is important that this may require political space in order to
5. The approach envisaged by this risk
is not seen as a “one-size-fits-all” achieve its objectives. Equally, it may
appetite framework suggests that it is
framework of risk appetite, but rather require political tolerance in the event
important for organisations to identify
it should be tailored and proportionate of adverse effects from risk events
measures of risk appetite. Otherwise
to the size, nature and maturity of the materialising.
there is a risk that any statements become
business.
empty and vacuous. c. Infrastructure: an organisation must
2. We are suggesting that maturity of the have sufficient infrastructure to take
business can be seen in four dimensions: certain risks. This might be in terms of
physical assets, IT systems or network
a. Business context
partners.
b. Risk management culture d. People: an organisation will need
c. Risk management processes to assess whether or not they have
sufficient, appropriately trained and
d. Risk management systems skilled individuals to undertake some
risks.
e. Knowledge: in many cases the
management of risk requires specific
knowledge either within, or available
to, an organisation.
An Example
In the nineties, GEC came under
new management, who undertook
a wholesale re-shaping of the
portfolio of businesses. With a
change of name to Marconi, they
moved increasingly away from their
traditional manufacturing and defence
businesses towards telecoms and
internet businesses. It might well
be argued, given the subsequent
failure of the group, that they lacked
the risk capacity to move into new
strategic areas about which some
of the management team had little
knowledge.
17

18. It might be argued that understanding risk capacity
205 reflects the level of maturity of an organisation’s skills
in strategic and business planning. In a fast changing
economic climate, it is especially important for firms to
have a clear, defined strategy and risk appetite framework so that
they can react quickly to the challenges and opportunities
presented in such times.
Three Illustrative Examples of Risk Capacity
Financial Services Organisation FMCG Organisation Public Sector Organisation
Illustrative situation Developing new product for rapid Building new factory to serve new Implementing new policy
launch market initiative
Financial Does the firm have sufficient Can the firm afford the What is the impact on public
capital to support the product? development and how will it sector costs? Are there
remit funds back to the ultimate any taxation or borrowing
holding company? implications?
Reputation Will the product be acceptable to Are there any ethical, What is the track record of the
the relevant customer base? Does environmental or social issues department in rolling out such
the firm have a history of product in building the factory in this policy initiatives?
innovation in this sector to this location and which could have
group of consumers? an adverse impact on indigenous
populations?
Political How does this product innovation What is the impact on What are the voter ramifications
stack up against government employment, taxation and so of success and failure?
policy? Is there likely to be any on in the “home” territory
political antagonism towards the and the “host” territory? Does
product? the company have a record of
bringing such projects to fruition?
Infrastructure Does the firm have the necessary Does the group have the How quickly (or slowly) does the
capability in terms of marketing, wherewithal to get manufactured policy implementation need to be
sales, complaints handling, product from the plant to rolled out from inception, through
processing etc? end customers? Is any new trial to full implementation?
infrastructure required, eg roads,
railways, port facilities?
People and Knowledge How many new people will How can knowledge be Does this require major
be required? How will they be transferred to the new work recruitment? What are the
trained? What skills do they need? force? What management skills implications for public sector
are required? spending?
18

19. Risk Management
Maturity
Risk management maturity is We think that there are four • Risk management processes: This
206 an increasingly familiar 207 dimensions of risk refers to the extent to which there are
concept. Many organisations management maturity that a processes for identifying, assessing,
have developed risk board should consider in responding to and reporting on
management maturity models which cover determining its preparedness to embark risks and risk responses within the
a variety of attributes. Some address the on a risk appetite exercise. These are: organisation. There are some common
maturity of risk management and control factors that should be present in all
• he business context: This includes
T
processes, some consider the culture of risk management processes, namely
understanding the state of
risk management, and some consider the risk identification, risk assessment and
development of the business, its size,
preparedness of the organisation to face risk monitoring and reporting. The
industry sector, geographical spread
up to (or be susceptible to) disaster. issues that need to be understood
and the complexity of the business
include the extent to which these are
model. There is little advantage to
common across the organisation, the
an organisation in defining a risk
extent to which there is a common
appetite that is not based firmly in the
language across the business and
context of the business. A wide variety
above all whether gathering and
of business factors will influence the
reporting all of the risk management
risk appetite and some examples of
information makes any difference
these are set out in the table below.
to the way in which the business is
In essence a good understanding of
run. As we said earlier, setting a risk
the business model is an essential first
appetite is only a worthwhile exercise
step in determining how much risk the
if you, as an organisation, are able to
business is currently engaging with
manage the risk to the level at which
and how much more it might wish to
it is set. This implies the need for
engage with in the future.
effective risk management processes.
• Risk management culture: This
• isk management systems: This
R
addresses the extent to which the
means the extent to which there are
board (and its relevant committees),
appropriate IT and other systems
management, staff and relevant
to support the risk management
regulators understand and embrace
processes. Most organisations have
the risk management systems and
comprehensive and effective systems
processes of the organisation. The
for collecting rearward looking key
ability to determine, manage and
performance indicators (KPIs): namely
monitor a risk appetite will depend
accounting systems. IT systems,
to a large extent on the maturity
people, responsibilities and so on
of the risk management culture
are all well-defined in a more or
within the organisation. Where the
less smoothly operating system. Few
attitude to risk management is one
organisations have similar approaches
of indifference, or a sense that risk
to managing forward looking issues:
management is little more than a
in other words the systems (in the
bureaucratic paper chase, then the
broadest sense of the word) are
likelihood of developing an effective
rarely subject to the same extent of
risk appetite is remote. Equally, it
rigour or complexity. Increasingly we
is essential that the tone for risk
anticipate that organisations will need
management is set from the top: if
to collect, process and disseminate
the chairman and chief executive are
risk information across the business in
indifferent, then that will most likely
order to be truly effective.
be reflected in attitudes further down
through the organisation.
19

20. It is our view that risk management data and
208 its subsequent processing to generate actionable
management information must be subject to the
same rigour in terms of data governance as is applied
to the data and information that is used in accounting
and reporting systems.
Area of focus Factors to consider
Business context • Nature of business
• Size of business
• Geographical spread of operations
• Degree of virtualisation
• Complexity of value chain
• Interdependencies with other partners
• Political climate
• Regulatory environment
• Competitive environment
• Risk clockspeed (see page xx)
Risk management culture • Tone from the top
• Attitudes to governance in the organisation
• Attitudes to the management of risk
• Attitudes to control
• Attitudes to regulation
• Attitudes to innovation
• Competencies and capabilities
Risk management processes • Identification processes
• Assessment processes
• Monitoring and reporting processes
• Common language
• Extent of common processes
• Delegations of authority
• Integration with strategy and business planning
• Integration with regular periodic reporting
• Escalation procedures
Risk management systems • Extent of organisational structure to facilitate the management of risk
• Risk management strategy and policy defined
• IT support systems
• Enterprise data warehouse for risk data
• Risk reporting
Needless to say, these “factors to consider” are not comprehensive and any organisation would need to tailor a review of maturity to
their own circumstances. As with everything in this guidance it is important that the review of risk management maturity is tailored
and proportionate to the organisation itself rather than being dictated by external guidance and checklists.
20

21. Multiple risk Risk culture 212
To meet the criteria of
embedding risk management
appetites 211
We think that it is worth
reflecting on risk culture,
it is important for
remuneration to be directly
We believe that it is almost linked to good control of risks. It is
209 impossible to encapsulate risk
which most risk professionals
recognise as an important area recognised that not all risk appetites
appetite for a business as a of debate. A good risk culture will and thresholds will be quantitative,
whole in a phrase such as “risk averse” or facilitate the better management of risk but where they are they can be directly
“risk welcoming”. Such phrases fail to and indeed will underpin an organisation’s linked to bonus payments. In this way
recognise that in all but the very simplest ability to work within its risk appetite (see when thresholds are breached the
businesses there is inevitably more than ‘Risk Culture’ box for more discussion). business unit and associated team
one risk appetite. There might be one risk Symptoms of a poorly functioning risk members will be able to see the impact
appetite for selling a particular product, culture include: of decisions taken. Conversely, good risk
and a different appetite for taking risk management can be evidenced and
while selling another product. There • Leadership sends inconsistent or appropriately rewarded.
might be one appetite for regulatory risk unclear messages on acceptable
in one country and another appetite in a levels of risk
different regulatory regime. It seems • Risk is perceived to be managed Key terms and
inevitable that risk appetite has to be intuitively and not discussed in
capable of being expressed differently for making decisions phrases
different classes of risk and at different • Provided business results are delivered, In this section we have
levels of the organisational structure. few questions get asked regarding 213 introduced five key phrases,
However, we believe that there needs to what might go wrong, which we are defining as set
be a cross-check between risks and a out in the following table:
• and there is little or no sanction
holistic view at the top of the
for those taking inappropriate levels
organisation.
of risk.
The framework that we have
210 depicted in Figure 6 above
incorporates the ability to Phrase Meaning
represent multiple risk
appetites in two ways: Risk capability A function of the risk capacity and risk management
maturity which, when taken together, enable an
• In the first instance it recognises that organisation to manage risk in the pursuit of its long term
there will be different appetites for objectives.
risk at different levels. The diagram
Risk capacity The resources, including financial, intangible and human,
explicitly shows risk appetite at a
which an organisation is able to deploy in managing risk.
strategic, tactical and operational
level. The next section of this paper Risk management The level of skills, knowledge and attitudes displayed by
discusses this in more detail. However, maturity people in the organisation, combined with the level of
in essence the importance of this sophistication of risk management processes and systems in
is that it binds together the two managing risk within the organisation.
elements of the propensity to take risk Propensity to take risk The extent to which people in the organisation are
and the propensity to exercise control. predisposed to undertaking activities the impact, timing
The essence of the framework is that and likelihood of which are unknown, and which is
proportionately more time, effort and influenced by financial, cultural, performance and ethical
resources are devoted to taking risk at considerations.
a strategic level, and proportionately
more time, effort and resources are Propensity to exercise The extent to which people in the organisation are
devoted to exercising control at an control predisposed to take steps to change the likelihood,
operational level of the organisation. timing or impact of risks, influenced by financial, cultural,
performance and ethical considerations.
• An important aspect of the framework
is that it requires a mechanism for
measurement. This will facilitate
comparison of different risk types, and
allow for some form of aggregation
across the organisation.
21

22. Risk Culture Designing a Risk Appetite -
There are many approaches to measuring or diagnosing risk
culture and many models of risk culture. One illustrative
Questions for the Boardroom
model (Hindson, 2010) suggests eight key indicators, • Has the board and management team reviewed the
grouped into four themes: capabilities of the organisation to manage the risks
that it faces?
Risk Culture Diagnostic • What capacity does the organisation have in terms of
its ability to manage risks? Are there any particular
Tone at the Top Governance issues of which the board should be aware?
Risk Leadership Risk governance • How mature is risk management in the organisation?
Responding to bad news Risk tranparency Is the view consistent at differing levels of the
Competency Decision Making organisation? Is the answer to these questions based
Risk resources Risk decisions on evidence or speculation?
Risk competence Rewarding appropriate risk • What specific factors should the risk appetite take
taking into account in terms of the business context? Risk
Processes? Risk Systems? Risk management maturity?
Figure 7 - Risk Culture Diagnostic
• At which levels would it be appropriate for the board
to consider risk appetite?
Typical issues under each of these headings would be:
• What are the main features of the organisations risk
culture in terms of tone at the top? Governance?
I Tone at the Top Competency? Decision making?
• Risk Leadership: Do senior management set clear • How much does the organisation spend on risk
expectations for risk management? Do leaders provide management each year? How much does it need to
a role model in risk management thinking and actively spend?
discuss tolerance to risk issues? How are messages • Does an understanding of risk permeate the
consistently delivered over time? organisation and its culture?
• Responding to Bad News: Do senior management • Does each individual understand their role and
actively encourages management information related responsibility for managing risk?
to risks to travel quickly across the organisation? Is • At a managerial level, do you know what level of risk
there openness and honesty in communicating on risk you should take? Do you know who the risk owners
issues? are? Do they have systems in place for measuring and
monitoring risk?
II Governance • Is management incentivised for good risk
management?
• Risk Governance: Accountability for the management
of key business risks is absolutely clearly defined. Risk
accountabilities are captured within role descriptions
and performance targets.
• Risk Transparency: Risk information is communicated
in a timely manner to those across the organisation.
Lessons, both positive and negative are shared from risk
events.
III Competency
• Risk Resources: The risk function has a defined remit
and scope of operations and has the support of leaders.
It is able to challenge how risks are being managed
when appropriate.
• Risk Competence: A risk champion structure is in
place to support managers in better managing risks.
Structured training programmes are in place.
IV Decision Making
• Risk Decisions: Leaders seek out risk information in
supporting decisions. The business’s willingness to take
on risks is understood and communicated.
• Rewarding appropriate risk taking: Leaders are
supportive of those actively seeking to understand
and manage risks. This is recognised through the
performance management process.
22

23. III Constructing a risk appetite
“Managing the right levers”
301 In Section II of this paper we explored the main issues in designing the risk
appetite framework: in this section, we look at each of the main elements in
Levels of risk
the middle of the framework in more detail. appetite
At the heart of the risk appetite framework, once an organisation Strategic
302 understands their capability to manage risk, we have the main issues that an
This framework envisages at
organisation has to deal with in setting and monitoring its risk appetite. 303 least three levels of risk
These are set out in the diagram below:
appetite as set out in the
following paragraphs.
Level Propensity Propensity Measurement
At a strategic level, risk
to take risk to exercise 304 appetite is predominantly
control about the risks or types of risks
that an organisation has a comparative
advantage in managing (or indeed
Strategic Risk Taking Stakeholder knowing that they can neither manage
Delegation
Value nor mitigate). These provide it with its
competitive advantage (private sector) or
its ability to achieve its objectives (public
or third sector). Risk appetite at the
Tactical Risk strategic level will also be about deciding
Metrics from which risks or types of risk the
organisation needs to protect itself.
Escalation
Project/ Exercising
Control Strategic Risk
Operational Metrics Some examples of strategic risks:
Control
• Risks in connection with decisions
Figure 8 - Risk appetite - Main Issues about outsourcing or maintaining
processes and competencies in-house.
• Risks concerning new product
developments, such as new
innovations, R&D, new product
lines.
• Risks concerning new sources
of finance, such as the optimal
debt:equity ratio, banking
covenants, headroom and liquidity.
• Risks concerning acquisitions or
disposals including the likelihood of
achieving organisational objectives
or destroying shareholder value.
23

24. In considering the risks (or Figure 8 above shows more It is for the board and senior
305 types of risk) that an 306 emphasis on risk taking than 307 management to determine the
organisation wishes to engage exercising control at strategic relative strategic importance
with or to avoid, it should take level. This should not be of the organisation’s
into account also the performance culture confused with implying that strategic propensity to take risk and its propensity
of the organisation, because this will equates to board level. The board may to exercise control and to influence that
determine the amount of these risks that well take an appropriate interest in relative focus throughout the
individuals will take, and also the control, in part because of its governance organisation. However, in broad terms an
corporate ethics and behaviours that an responsibilities, in part because of the organisation that under-emphasises risk
organisation displays, because these will organisation’s regulatory environment, at the expense of over-emphasising
be important in determining the extent of and in part because control has to start at control at a strategic level may run the
risk taking and risk avoidance. the top of the organisation. Therefore the risk of suffering from an inability to take
diagram should be viewed as the relative risk throughout the hierarchy. Whereas
strategic importance, not the overall an organisation that over-emphasises risk
importance of risk versus control. taking at the expense of under-
emphasising control at a strategic level
may run the risk of taking un-controlled
risk which can result in dangerous
exposure to unwanted risk. The skill is in
determining the right balance for the
organisation.
Risk Taxonomies
There are many possible taxonomies of risk that the organisation might use
in determining its approach to any particular risk. Three illustrative examples
are shown in the table.
Different risk taxonomies can be useful for different purposes
Taxonomy John Adams Organisational Source
Classification • Directly Discernible • Head office • Strategic
• Visible through Science • Department A (eg marketing) • Operational
• Virtual • Department B (eg Finance) • Compliance
• Geography X • Process
• Geography y • ReputationaI
• Change
Use Useful for determining the type of Useful in determining the Useful in helping to identify
response required to manage or responsibility for managing a given sources of risk.
monitor a risk risk
Under the first column we have shown the • Visible through science risks are those This can be a useful approach to
taxonomy suggested by Professor John that benefit from a significant amount consider when determining the type
Adams (Adams, 2001). This will be familiar of data which informs managers how of response required to monitor or
to many people who have sat the exams they should be controlled. Typically manage a particular risk.
for IRM’s International Diploma. In broad there are professional disciplines that
terms, Professor Adams defines three ensure that these risks are managed Under the second column we
types of risk as follows: effectively, and the availability are representing a traditional
of the appropriate skill base may organisational hierarchy of risk, a
• Directly discernible risks are those view that can be particularly useful
well determine the appetite of the
that we are culturally attuned to in determining responsibilities for
organisation to engage with these
managing on a day to day basis. These managing risk. In the third column we
risks.
are often basic risks, which might represent a taxonomy based on the
have quite literally life and death • Virtual risks are those for which there
source of the risk.
consequences, but which we cannot is comparatively little prior personal or
imagine not existing. We manage institutional knowledge and where the It is important that a taxonomy is
them automatically. range of outcomes is almost impossible adopted that is understood throughout
to determine. As a consequence there the organisation and that can be used
is frequently little agreement as to in detailed implementation of the
how the risk should be managed. risk appetite at lower levels of the
organisation.
24

25. Tactical 311
Most time, effort and Others use words like “risk
resources will be deployed to 313 hungry” or “risk cautious”.
Many organisations struggle
308 to implement their strategy,
minimise risk, rather than on
taking new risks. However,
However, some would argue
that the propensity to take a
regardless of how finely even at this level it is important for risk is dependent on the reason for
developed and well-honed it is. There is a individuals to understand how they are engaging with that particular risk or
well-recognised phenomenon of a gap able to respond to new and emerging risks group of risks.
between definition and implementation that they encounter and to have a risk
of the strategy. We are describing this as appetite framework to help them to come Risk appetite cannot be
the tactical element of risk appetite: the
cusp between strategic vision and
to an appropriate decision. As one 314 defined in totality for an
organisation describes it, they want front organisation using a single
implementation. This may well be where line supervisors to be able to respond to a one word label. Risk-averse
existing control mechanisms need to be new or emerging risk as though a member companies have little or no future, while
reviewed and refined in order to enable of the executive management team were risk-reckless organisations can expect a
the new strategy to be implemented standing at their shoulder. By defining risk rapid exit from business. This is not to
effectively. appetite, staff will understand how they deny that in practice, at the simplest level,
should react, and when they should the propensity to take any given risk can
Our framework suggests that escalate an issue for consideration further be defined by single word labels.
309 this is where there needs to be up the line. Although this then needs to be weighed
a balance between risk taking against the way in which control is
and exercising control. A exercised in the relevant area. At its most
well-articulated risk appetite will assist in Operational Examples sophisticated it will take into account the
defining the relative proportions of time, reasons that organisations engage with
Different sales departments could
effort and resources that might need to be any given risk and the nature of the risk
have a different focus depending on
spent respectively on taking the risk and itself.
how their specific unit relates to the
exercising control. By way of example, the
defined strategy. Specific sales units
company that decides that it has a large
appetite for a given type of risk will
might be directed to take increased Propensity to
risk to exploit the market in order
determine at this level how to refine the
way in which control mechanisms operate.
to support a new product initiative. exercise control
Sales units might have defined
A high appetite for, say, IT risk, which Having defined an
strategically results in major new systems
margin requirements 315 organisation’s propensity to
developments will not mean that all The IT department might need to take risk, it is then important
control mechanisms should be thrown out. focus on cost savings and increased to establish its propensity to exercise
However, the level of detailed efficiencies to support a strategic control. It is our view that setting a risk
implementation of the controls, the levels product launch. appetite without identifying the level of
of review and hierarchies of delegated control is self-defeating:
The legal or policy department
authorities may well be more relaxed than
might need to focus on controls to • Traditionally risk “averse”
in an organisation that continues to have
reduce the number of errors. organisations that decide they are
a sceptical or hostile appetite for IT risk.
“hungry” for a particular type of risk
The finance team might be required
and that forget the need for retaining
to manage the debtor balances and
Project or operational to ensure sufficient unencumbered
appropriate levels of control are likely
to fail, sometimes dramatically;
At a detailed level of funds in the event of a worst case
310 delivering products or services, scenario. • Traditionally “innovative”
organisations that decide that they
following processes or running
are “averse” to a particular type of
projects, it is likely that the emphasis will
be on minimising adverse risk by Propensity to risk and that forget to exercise or
increase levels of control, are equally
exercising appropriate controls.
take risk likely to fail.
At its most basic, the
312 propensity to take risk is little
more than understanding
whether a risk or type of risk is one that
the organisation wishes to engage with or
not. Some organisations express this in
simple terms such as:
• Avoid (terminate risk)
• Averse
• Conservative
• Receptive (take risk if expected reward
warrants, within limits), or
• Unlimited (take risk if expected reward
warrants, unconstrained by limits).
25

26. Balanced Risk Another perspective on the
propensity to take risk might be
Risk management
Richard Anderson (Richard Anderson taken from Professor John Adams’ clockspeed
& Associates, 2009) argues that there taxonomy of risks as shown in There has been considerable
are four main reasons for engaging the section on Risk Taxonomies. interest in the newly defined
with a risk: However, different organisations concept of Risk Management
will have different appetites for the Clockspeed. Essentially the author
• aking more managed risk
T three types of risk defined by Adams. of this concept, Keith Smith (Smith,
• voiding pitfalls
A There is a sense in which the 2010), argues that slow clockspeed
classification of the risk into risks, those that are managed over
• ecause of the performance
B
any of these three categories is a lengthy period of maturation,
culture, and
effectively based on the experience are those that are managed most
• ecause of the corporate ethics
B of the organisation. Many things effectively through traditional
and behaviours. which are taken as read in say the control mechanisms. On the other
nuclear industry, and which to hand fast clockspeed risks (those
In essence organisations engage with
staff would be a matter of routine where there are unplanned or
risks for one or more of these four
(directly discernible risks) might unexpected events that require a
reasons, each of which represents a
be completely alien in another rapid response, or a response that
different managerial challenge. It
organisation where there is no prior is faster than internal processes are
could be argued that many of the
knowledge or expertise in the firm designed to manage) may require
large international banks focused
or amongst its staff (virtual risks). a different approach. In essence he
unduly on taking more managed risks,
argues that fast clockspeed risks
largely because of their performance For some organisations, their need to be managed by cultural
cultures, rather than considering the appetite will be to stick to what they mechanisms as well as by process.
pitfalls and their corporate ethics know best, expose themselves only The first stage of management will
and behaviours. The issue, from a risk to those risks visible through science be to understand the heuristics
appetite perspective, was that they where they have existing expertise (rules of thumb) that managers
failed to understand the importance on tap, and to the maximum extent typically use to manage the fast
of balancing across these four reasons possible, avoid virtual risks. Other clockspeed risks. These need to
for engaging with risk and therefore organisations will want to exploit be assessed for efficacy, and then
exposed their businesses (and in the the potential of virtual risks by either changed or reinforced by
case of the banks, the entire economy) bringing the risk under managerial rigorous training programmes
to an undue risk of failure. control. so that the response to the risk
Therefore, defining and measuring is embedded into the culture of
risk appetite would by default, for the organisation. Typically fast
more sophisticated organisations, clockspeed risks, those that take
imply developing an understanding of a relatively short time from first
why the organisation is engaging with identification through to impact,
a given risk or class of risks. will by definition be subject to
less data and will probably be less
susceptible to pre-analysis.
It is quite plausible to think that
many organisations focus on
Making risk appetite work In conclusion, the propensity slow clockspeed risks in their risk
316 depends on identifying the 317 to exercise control is an management programmes and may
right level of control to match important counter-weight to give insufficient attention to fast
the risk aspirations. At a the propensity to take risk. clockspeed risks.
simple level, controls will have to match Taking risk cannot be considered without
the risk appetite, so “risk hungry” might also contemplating control mechanisms.
require “empowering controls”, whereas There is a range of possible approaches
“risk averse” might require “harsh from the simple single-word definitions,
controls”. Empowering controls might be through traditional accounting or other
about high levels of delegation, minimal similar models, through to the COSO
supervisory review and reporting by approach as outlined in their report on
exception, whereas harsh controls might Internal Control (COSO, 1992). However,
include regular detailed sign-off, re- two new approaches that are worthy of
performance, pre- and post-authorisation consideration are that of analysing risk
and detailed regular reporting. Clearly management clockspeed, and Dimensional
there is a myriad of different approaches Control.
in between.
26

27. Control Issues Measurement
We think that there is a need
Irrespective of risk clockspeed,
there are many traditional ways of
• Strategy: does the organisation
focus primarily on the likelihood
318 to develop a realistic
addressing control. COSO’s report on of the risk or on the impact by measurement approach that
Internal Control (COSO, 1992) provides improving the resilience of the will enable boards and managers alike to
a comprehensive approach, identifying organisation? understand the ramifications of their risk
five control components covering the appetite and whether breaches are
• People: does the organisation material to the strategic direction of the
control environment, risk assessment,
expect nominated individuals to company. We consider that there will be
control activities, information and
be responsible for a given risk, different approaches to measurement
communication, and monitoring. It
or is it about everyone in a team, when it is considered at each of the three
also identifies preventive, detective
department or organisation levels referred to above: strategic, tactical
and monitoring controls. At a more
managing the risk? and operational. At this stage we are not
basic level, the traditional accounting
models of control identify control • Detail: is the organisation focussed recommending any individual approach to
objectives such as completeness, on a very specific risk, or is there a measurement, although we have included
accuracy and timeliness. It is not the generic range of risks? some illustrative ideas.
purpose of this booklet to identify all
of the possible sources of information • Tasks: does the organisation collect
on approaches to control, but much information that underpins the
work has been done to update this, for way in which it addresses the
example the approach to Dimensional control of a risk? Does it plan
Control initially developed by Rob how to exercise control and what
Baldwin of the LSE looks at five actions does it take?
dimensions of control, each of which • rivers: is control driven by the
D
has several elements: managers of the organisation, by
regulators or the various cultures
that exist inside the organisation?
These five dimensions and the
elements of control are shown in
the diagram below. Harsher control
mechanisms will take a different
route through this model than more
enabling control mechanisms. This
model provides one way for an
organisation to consider how it can
change its propensity to exercise
control by changing its control journey
through the Dimensional Control
model.
THE FIVE DIMENSIONS OF CONTROL
Strategy People Detail Tasks Drivers
Information Managers
Likelihood Individuals Specific
Planning Regulators
Impact Organisation General
Action Cultures
THE ELEMENTS OF CONTROL
27

28. An example of a valuation model: shareholder value
The underlying shareholder value model we have adopted is shown
below. The model is based on the hypothesis that shareholder value
is calculated as the cashflow from operations, discounted by the
weighted average cost of capital, less the value of debt.
Shareholder Value
Debt
Cashflow from Operations
Discounted Rate
Operational Investment
Advantage Period
Issues Issues Cost of Debt
Competitve
Operating
Working
Cash Tax
Growth
Margin
Capital
CAPEX
Sales
Rate
Figure 9 - Shareholder Value Model (1)
Our proposition is that risks, which are normally associated in
most ERM programmes to objectives, need also to be linked to the
underlying shareholder value drivers, although in practice, most
risks will impact on several drivers, as follows:
Shareholder Value Shareholder Value
Risks
Risks
Debt
Debt
Cashflow from Operations Risks Cashflow from Operations Risks
Discounted Rate
Discounted Rate
Risks
Operational Investment Risks Operational Investment
Advantage Period
Advantage Period
Issues Issues Issues Issues
Cost of Debt
Cost of Debt
Competitve
Competitve
Risks
Operating
Operating
Working
Working
Cash Tax
Cash Tax
Growth
Growth
Margin
Margin
Capital
Capital
CAPEX
CAPEX
Sales
Sales
Rate
Rate
Risks
Figure 10 - Shareholder Value Model (2) Figure 11 - Shareholder Value Model (3)
We think that testing risks against models such as these will enable
organisations to have a much better understanding of which risks
are important at a much earlier stage.
28

29. Strategic 322 We recommend that
organisations should develop
At a strategic level we are
319 suggesting that a variety of
a series of risk metrics and
control metrics to measure tactical and Constructing a
high level models might be
used including:
operational risks and controls. The
concept of risk and control metrics is risk appetite -
• Shareholder value for private sector
organisations. See the box above for
widely referred to in risk management
literature, normally as KRI’s and KCI’s,
questions for the
more information on one possible
approach. (Black, Wright and
although implementation is at best
patchy. There are many practical
boardroom
Bachman, 2000) approaches to identifying key indicators. • What are the business,
However, in implementing them, regulatory or other factors
• Stakeholder value might be a more
management should ensure that they are that will influence the
appropriate measure for not-for-profit
readily understood and are drawn from relative importance of the
organisations
appropriate information systems and organisation’s propensity to
• Economic Value Added (“EVA”) reliable data-sources which are subject to take risk and its propensity to
has been commonly used in many proper governance procedures. For exercise control at strategic,
organisations. organisations that already use KPI’s as tactical and operational levels?
part of their balanced scorecard • Does the organisation employ
The important issue here is not management reporting information, both
320 so much the precise model risk and control indicators should be
helpful risk taxonomies that
facilitate the identification and
that is selected, but rather relatively easy to implement. responsibility for managing risk
that it is appropriate for the as well as providing insight on
nature of the organisation. One of the key
attributes of using models such as these is Data how to manage risks?
• Does the organisation
that there is a focus on translating
The approach to risk appetite understand clearly why and
strategy to the underlying value drivers
and, of paramount importance, a need to
323 has to become a data-driven how it engages with risks?
identify key assumptions and therefore exercise. Much of what • Is the organisation addressing
key risks. currently passes for risk management is all relevant risks or only those
often a data-free or at best data-lite zone. that can be captured in risk
Organisations that manage risk in this management processes?
Such models may be more
321 sophisticated than is necessary
way will not be able to manage according
to a pre-determined risk appetite.
• Does the organisation have a
for less mature organisations framework for responding to
Accordingly we recommend that
and it is clearly not risks?
organisations should identify the relevant
appropriate to implement a shareholder • What approach has the
sources of data that will be required and
value approach in the context of the organisation taken to
ensure that there are appropriate levels
public sector or some third sector measuring and quantifying
of governance over those data sources to
organisations. We acknowledge that risks?
ensure that they are sufficiently robust to
additional work is still required to identify
form the basis of a decision-influencing
other models that would be equally valid
and report generating management tool
in the public sector but we do not think
that this represents a significant
shortcoming in the proposed framework. All forms of measurement
324 need to be tailored and
appropriate to the
Tactical and operational environment within which
they are being used. It is not our intention
to recommend undue levels of complexity.
However, as part of the regular reporting
of risk appetite to senior management
and boards, we believe that organisations
need to develop the same level of rigour
in reporting this information as they do in
reporting periodic management accounts,
including appropriate governance over
the data and information systems
employed.
29

30. IV Implementing a risk appetite
“Execution is everything”
In this section of the booklet we are turning to the The table below provides an overview of the seven-
401 development of a risk appetite. We set out in Figure 402 stage approach:
12 below the seven stages of development for a risk
appetite in an organisation:
Stage Main components
Sketch Enough to engage with
Sketch stakeholders
Stakeholder engagement Engage with a full range of
stakeholders
Develop Using the risk appetite framework
Stakeholder set out in this paper
Review engagement Approve Approval from both the board and
the risk oversight committee as
appropriate
Implement Ensure the metrics are right,
communicate with those who
Report Develop need to work with the appetite
and embed it into the fabric of the
organisation
Report Both internally and externally
Review What worked well? What failed?
Implement Approve What needs to be done differently
next time?
Figure 12 - Stages of Development of Risk Appetite
30

31. Sketch Stakeholder
403 Risk appetite should be
evolved from and support the
engagement
For some the “business of A fuller extract from Friedman’s
strategic planning and
business objectives of the organisation. It 406 business is business” own writings illustrates a rather
needs to become a central component of (attributed to Milton wider perspective to the relevance
the business planning cycle. The risk Friedman) and they will see no need to of wider stakeholders on business
appetite framework helps to articulate the consult stakeholders apart from than is sometimes attributed to him:
risks to the business that could potentially shareholders. For others who see a “A corporate executive… has direct
impact on the achievement of strategic broader construct of the impact of responsibility to his employers… to
goals (positively or negatively). It will business and government (and the third conduct the business in accordance
reflect the extent to which the sector) on society, there may well need to with their desires, which generally
organisation is prepared to tolerate risks be a broader range of consultation. For will be to make as much money
described by limits, indicators and process example, it might make sense to engage as possible while conforming to
controls. with others in the value chain, with (some) their basic rules of society, both
customers, and with others on whom your those embodied in law and those
organisation depends. For some embodied in ethical custom.”
Sketching a risk appetite
404 framework is likely to require
organisations, it will also make sense to
engage with broader societal groups. For
(Friedman, 1970)
a reasonable degree of
example, drilling oil wells offshore is likely
knowledge. For example, it
now to raise deep concerns and being
would not be unreasonable to expect that
clear with residents and businesses about
an organisation:
resilience in the event of oil spills would
• Should have defined and clearly make considerable sense. For other
articulated its core strategy organisations, it may well be that they
• Would know its principal risks and the wish to engage buy-side analysts engaged
approach taken in managing them, in the debate about risk appetite.
and
• Would be able to describe with The purpose of engaging with
reasonable certainty the main features 407 stakeholders, however
of its risk management capability, both described and however
in terms of capacity and maturity. broadly or narrowly defined, is
to ensure that both the risk taking and the
control activities are broadly aligned with
Ensuring that this detail is in
405 place will enable a
others, or that potential divergences are
identified early.
constructive statement of risk
appetite to be developed
using the main facets of the framework
described in Sections II and III of this
paper.
31

32. Develop Report
The development of the risk We envisage that reporting Implementing
408 412
appetite approach should now
be well-informed by the
against risk appetite
statements will broadly take a risk appetite -
background work, the
preliminary sketch and the dialogue with
two forms:
questions for
• Internal: this will require reporting on
relevant stakeholders. The amount of
detail that is required will vary from
a frequency similar to regular internal the boardroom
management reporting,; and
organisation to organisation. Of course, • Has the organisation followed a
the detail needs to be tailored and • External: this will require annual robust approach to developing
proportionate to the organisation. reporting to relevant stakeholders, a risk appetite?
including (where they exist)
• Who are the key external
shareholders, and perhaps others
stakeholders and have
Approve included in the stakeholder
sufficient soundings been taken
engagement stage above.
If we are right in thinking that of their views? Are those views
409 the development of risk dealt with appropriately in the
appetite thinking in Review final documentation?
organisations has the • Is the risk appetite tailored
At the end of each reporting
potential to change the way that 413 cycle, and before the risk and proportionate to the
organisations are run, then it goes organisation?
appetite statement is re-
without doubt that boards, and in the
sketched, there should be a review, • Did the risk appetite undergo
event that they exist, risk oversight
perhaps undertaken by the board or the appropriate approval processes,
committees should review and approve
risk oversight committee into what including at the board (or risk
the risk appetite document.
worked well, what failed, and what needs oversight committee)?
to be done differently next time. Learning • What is the evidence that the
Implement the lessons, especially in the early days of organisation has implemented
implementing a risk appetite statement the risk appetite effectively?
Implementation is going to
410 take some time. It is unlikely
will be critically important.
that an organisation will be
able to get the risk appetite framework
right first time. In particular the cultural
aspects, the data gathering and the
ramifications of divergences from the
statement will need to be worked
through.
There is little point in defining
411 an appetite without clearly
articulating consequences.
Further, it is important the
organisation is seen to take action in
conjunction with the appetite. For
example, some Boards and senior
management state they have a zero
tolerance risk appetite regarding any
compliance or regulatory breaches. All
well and good, but the organisation’s staff
policy handbook must clearly follow the
same lines and one would expect that
once proved, disciplinary proceedings for
the staff responsible would be automatic.
For the risk appetite statement to be
taken seriously throughout the firm it
cannot be defined in isolation to the rest
of the organisation.
32

33. V Governing a risk appetite
“Making sure it fits”
The final strand of thinking
501 that we want to touch on in
this paper is the governance
Approve
over a risk appetite statement. If a risk
appetite is to be of any use to an
organisation, it is essential that it is subject
to good governance. We believe that
there are four critical elements to the
governance that need to be clearly
articulated as set out in Figure 13 below:
With this in mind, we believe
Learn Board Measure
502 that it is of the utmost
importance that the board (or
risk oversight committee if it
exists) should retain governance over the
framework at four key points:
• Approval: as discussed in the
development of the risk appetite
statement
Monitor
• Measurement: there needs to be
regular and consistent measurement
against the framework and Figure 13 - Governing a Risk Appetite
demonstration that the framework is
used in real life
• Monitoring: the board will need to
deal with breaches of the appetite,
or tensions that arise from its Area for governance Main components
implementation. If there are no
breaches and no tensions then the 1. Approve Oversight of setting process
likelihood is that it has not been
2. Measure Measure and assess risk appetite to identify impact
properly developed, and
on business performance
• Learning: as discussed in the
development section, the board needs 3. Monitor Identify breaches of, or tensions arising from risk
to ensure that the organisation learns appetite on a regular basis
from the implementation of the risk 4. Learn What was good? What needs doing better? What
appetite framework so that it becomes needs changing
more embedded into the organisation.
33

34. All of this needs to be carried
503 out with the basic precept in
mind that risk appetite can
and will change over time as,
for example, the economy shifts from Board and Senior
boom to bust, or as cash reserves fall. In Management
other words, breaches of risk appetite may
well reflect a need to reconsider risk
appetite part way through a reporting Vision
cycle as well as a more regular review on
an annual cycle. Rapid changes in
Prop
ensity to take control
circumstances, for example as were
ensity to exercise risk
witnessed during the financial crisis in Risk Assurance Strategy Risk Appetite
2008/9, would certainly indicate a need for
an organisation to re-appraise its risk
appetite.
Operating
Controls
Our expectation is that the risk Model
Prop
504 appetite document will be at DATA
the heart of the organisation.
It will be informed by the
vision of the company, and in turn will
inform the way in which the operation Process Policy
will be managed as shown in Figure 14.
This view of the criticality of
505 data supporting information
flows in the organisation also
underpins the importance of
developing actionable management Figure14 - Risk Appetite In the Organisation
information. Traditionally the data and
information used in most organisations is This is a new area of
506 endeavour for many
oriented to accounting and reporting. It is
our view that data governance from a risk organisations and their Governing a
management perspective is becoming a
key issue underpinning the development
boards. The House of Lords
Economic Affairs Committee addressed a risk appetite -
of relevant and effective risk appetite
frameworks. Measurement will only work
recommendation made by Sir David
Walker in his review of governance of questions for the
where the underlying data sets are
reliable, accurate, complete and timely
banks and other financial institutions. It is
neither the purpose nor the remit of this
boardroom
with minimal off-line manipulation. paper to comment on this, except to the • Has the board played an
Exactly like those used for accounting extent that if a board institutes such a active part in the approval,
and reporting systems. committee, we believe that risk appetite measurement, monitoring and
and risk tolerance should be high on their learning from the risk appetite
agenda process?
• To what extent did the board
“We strongly support the development identify tensions arising from
of separate risk committees in banks the implementation of the risk
and major financial institutions. Other appetite?
large companies should institute them • How much resource has it taken
where appropriate. Such committees to develop and implement
will increasingly require specialist skills risk appetite? Was this level
and external advice. This advice should of resource appropriate? Does
not be provided by the firm which is the it need to be amended going
company’s auditor.” forward?
Source: House of Lords, Economic Affairs • Does the board have, or does it
Committee. Second Report: “Auditors: need, a risk committee to, inter
Market concentration and their role”. alia, oversee the development
and monitoring of the risk
appetite framework?
• Is the board satisfied with
the arrangements for data
governance pertaining to
risk management data and
information?
34

35. VI The journey is not over
It is our strong belief that the But equally there are some Above all, we want to hear
601 opportunity provided by the 602 substantial benefits. Risk 604 from you. Please tell us what
FRC for the development of appetite, as a cornerstone in a you think is good or bad
risk appetite could potentially have risk management programme, about this paper, what needs
enormous ramifications for the way in can help in: to change, where you need further
which organisations are run and for the information or guidance and above all
• Safeguarding the organisation
development of assurance programmes. how we can act as a support to boards and
• Creating a framework for better those that advise them in this important
We have sought to fill a gap in the current decision making area of corporate governance.
guidance for directors and others in the • Identifying issues at an early stage
development of risk appetite statements
and we have included, as an Appendix • Providing a framework for reducing
to this report, a summary of how, in surprises The journey is
practical terms, a board might go about • Developing a framework for structured
determining the risks it is willing to take. thinking not yet over -
However there are a number of issues that
we think are worth keeping in mind. In
• Facilitating better achievement of
long term objectives while respecting
final questions
particular, risk appetite: stakeholder views, and
for the boardroom
• Is as much about “enabling” risk • Bringing sense to the risk process.
taking as “constraining” adverse risks • What needs to change for next
time round?
• Is a management tool as well as a Within IRM it is our intention
governance requirement 603 to work with companies, • Does the organisation have
boards, risk professionals, sufficient and appropriate
• Requires active “stakeholder” resources and systems?
engagement regulators and others to
develop the thinking around risk appetite. • What difference did the process
• Needs to be built into “business as make and how would we like it to
For us the immediate next steps include:
usual” processes have an impact next time round?
• Should be approved by the board (or • Developing a consensus as to what risk
non-executive board risk committee) appetite means: this paper is just a first
step in the discussion
• Has to be actively monitored by
management • Working with interested parties to
develop appropriate mechanisms
• Has to be reviewed regularly by the
for measurement, including
board, and
understanding:
• Needs measurement tools and
• the data sources that will be needed;
techniques.
• the impact on operational
frameworks; and
• the new data architecture and data
governance frameworks that will
be required
• The communications campaign that
will include addressing the needs of
boards and individual board members.
35

36. Bibliography
Adams, J. (2001). Risk. Routledge. Financial Reporting Council. (2010, June). House of Lords Economic Affairs
UK Corporate Governance Code. Committee. (2011). Second Report -
Baldwin, R. Harnessing the Power of Risk
Auditors: Market concentration and their
Management. Corporate Risk Group Financial Reporting Council (2011, March).
role.
Guidance on Board Effectiveness
Black, Wright and Bachman. (2000). In
ISO. (2002). Guide 73 Risk Management
Search of Shareholder Value: Managing Financial Reporting Council (2011,
Vocabulary.
the Drivers of Performance. Financial September). Boards and Risk
Times/Prentice Hall. ISO. (2009). ISO 31000 Risk Management
Financial Reporting Council (2011,
Principles and Guidelines.
British Standards. (2008). BS31000 Risk September). Effective Company
Management Principles and Guidelines. Stewardship Richard Anderson & Associates. (2009).
Risk Management and Corporate
COSO. (1992). Internal Control - National Audit Office (June 2011)
Governance. OECD.
Integrated Framework. The Committee of Managing Risks in Government
Sponsoring Organizations of the Treadway Smith, K. (2010). An introduction to risk
Hindson, A. (2010, December). Developing
Commission (COSO). clockspeed. Institute of Risk Management
a Risk Culture. Risk Management
Professional Development Forum.
Professional .
Walker, D. (2009). A review of corporate
governance in UK Banks and other
Financial Industry Entities.
All rights reserved. No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by
any means, electronic, mechanical, photocopying, recording or otherwise without the express permission of the copyright owner.
Permission will generally be granted for free use of the material within this document on condition that the source is clearly credited
as being the Institute of Risk Management.
©The Institute of Risk Management 2011
36

37. Appendix A: Determining the risks
the board is willing to take
Responsibilities for risk taking
1. The board of directors is responsible 4. Management of the company at all
for the company’s risk appetite, risk levels is responsible for operating
tolerance and attitude to risk taking. within the constraints established
It should do this by reference to a risk by the risk appetite and risk
appetite framework the establishment tolerance framework. Management
of which the board should oversee. is responsible for ensuring that
The risk appetite framework of the employees follow the policy with
organisation should be established regard to risk taking and operate
in the context of the capacity of the within the limits of authority
organisation to manage the risks and established by the risk appetite
its ability to exercise the appropriate framework and the requirements
management disciplines. of any Delegation of Authority
2. The risk appetite framework may be arrangements. Management is also
defined by a series of risk criteria for responsible for ensuring that the
the different types of risks faced by the company operates a system of risk
company. Establishing the risk appetite escalation when any risk exposure
and / or risk criteria will enable the approaches the maximum level that
board to determine the nature and the company is willing to tolerate.
extent of the significant risks it is 5. Management is responsible for
willing to take in achieving its strategic ensuring that appropriate disciplines
objectives. The board is responsible are in place over risk management
for monitoring compliance with the data and risk management
requirements of the risk appetite information. The board (or a
framework. committee thereof) should satisfy itself
3. The risk appetite framework should that appropriate data architecture
inform the development of strategy and data governance disciplines are in
for the organisation. It should help place.
with the development of plans for
the implementation of strategy. It
should also be used as a planning tool
to develop tactics and plan change.
Although the board should retain
responsibility for strategic risk taking,
a committee of the board may have
delegated authority for overseeing
the production of the risk appetite
framework for board approval.
37

38. Process for managing risk taking
6. When establishing the risk appetite 8. In evaluating their risks, an 11. When developing the processes for
framework, there is a need to pay organisation will compare the results developing a risk appetite framework
regard to the size, nature and of the risk analysis with a set of risk and monitoring risk taking, the
complexity of the company and both criteria. These criteria will be derived company should be aware that risk
the business sector and geographical from and form part of the risk appetite appetite can apply on three different
locations within which it operates. framework of the company, so that the levels, depending on the size, nature
When determining the nature and risks the board is willing to take can and complexity of the company
extent of the risks that it is willing to be established. Application of the risk and both the business sector and
take, the board’s deliberations should appetite framework should enable the geographical locations within which it
include consideration of the following company to develop and sustain: operates:
factors:
• Strategic objectives capable of • Risk appetite may be seen as a
• The strategic objectives of the delivering the required outcomes strategic driver for companies
organisation, including an • Effective processes and the • Risk appetite or risk criteria establish
understanding of the parameters of development of an organisational a series of planning guidance to be
success and failure, and the underlying culture to deliver stakeholder used when determining tactics for
performance (or value) drivers expectations, and the implementation of strategy,
• Nature and extent of the risks facing • Efficient operations and activities. including decisions on the projects
the company and programmes of work that will be
9. An organisation can develop criteria
• The capability of the organisation undertaken; and
for the different categories of risks
to manage the risks it faces, both in it faces and this will align with the • Risk appetite also determines the
terms of capacity (financial, intangible, willingness of the company to take operating limits and constraints (often
infrastructure and human aspects) those types of risks. It is important expressed as the limits of authority
and organisational maturity (skills, that critical controls applied in the for operational management) that
knowledge, attitudes of people and management of risks are understood apply to routine operations and may
the level of sophistication of risk and identified. The risk appetite be established under Delegations of
management processes and systems) framework will form the foundation Authority.
• Extent and categories of risk it regards for developing risk based assurance
as acceptable for the company to bear mechanisms, including internal audit.
• Likelihood of the risks concerned 10. When determining the nature and
materialising extent of the risks that it is willing to
• The organisation’s ability to reduce the take, the company should pay regard
incidence and impact on the business to the:
of risks that do materialise, and
• Current overall exposure of the
• Costs of operating particular controls organisation to risk
relative to the benefit thereby
• Capacity of the organisation to take
obtained in managing the related
risk
risks.
• Limits of authorisation that are in
7. A risk appetite framework should be
place for management, and
seen within the context of the overall
management of the business as well • The maximum risk exposure that the
as the risk management process. The board is willing to tolerate in relation
risk appetite framework will inform to any specific risk or category of risk.
more detailed risk assessments, when
an organisation will identify the
significant risks it faces, analyse those
risks and undertake an evaluation of
the likely impact of each significant
risk. The analysis of each risk will
involve a consideration of how likely
the risk is to materialise and the
impact that would result.
38

39. Appendix B: List of respondents
to consultation
We are grateful to the following who took the time to respond to the formal
consultation request on the draft document. Some made formal representations; others
responded through e-mail correspondence or other more informal channels. In most
cases, unless the name of the organisation is in the first column, responses were in a
private capacity and do not necessarily reflect the views of the organisation for whom
the individuals listed work. Given the very diverse nature of the responses, we have not
necessarily been able to reflect everyone’s comments, but they have all been reviewed
and considered in formulating the final document.
Individual or Organisation Responding Affiliation
Adrianus Darmawan Financial Service Risk Management, Ernst & Young, Indonesia
Alarm The public risk management association
Alpaslan Menevse Sekerbank, Turkey
Alyson Pepperill Client Projects Director, Oval Insurance Broking
Andrea Simmons Simmons Professional Services
Andrew Black BVA Ltd
Andy Garlick Private
Annemie Pelletier Private
Association of Corporate Treasurers N/A
Brian Martin FSCS
Brian Roylett RMIA
Bruce Widdowson Private
Chris Greaves Zurich Risk Engineering
Chris Hodge FRC
Chris MacDonald Bradley Engineering Council
Chris Pierce Visiting Professor of Corporate Governance, City University
Claude Patrick Arcelor Mittal
Craig Percival Corporate Risk Manager, United Utilities
Dan Clayton Chan Healthcare Auditors, Missouri, US
Dan Roberts RAAS Consulting
Darren Tomlins New Zealand Customs Service
David Clayton DWP
David Hillson & Ruth Murray Webster Risk Doctor & Lucidus Consulting
Dennis Cox Risk Reward Ltd
DNV N/A
Duncan Stephenson Head of Group Risk, Yorkshire Building Society
39

40. Individual or Organisation Responding Affiliation
Gillian Lees Chartered Institute of Management Accountants
Graham Dalzell Engineering Council
IoSH N/A
Jackie Cain Chartered Institute of Internal Auditors
Jake Storey VP Finance, Gearbulk
Jean Paul Louisot CARM Institute, France
Jeff Smith Head of Risk Management & Internal Audit, James Brearley & Sons
Jill Douglas Head of Risk, Charterhouse Risk Management
Jo Howey Policy Advisor on Risk Management and Internal Audit, Financial
Management and Reporting Group, HM Treasury
John Thirlwell Private
Keith Smith Private
Malcolm Kemp UK Actuarial Profession Enterprise Risk Management Practice
Executive Committee
Marina Basova Finance Manager, Basic Element Company, Moscow
Michael Parkinson KPMG, Australia
Nicola Crawford Private
Norman Marks Honorary Fellow of the IRM, Vice President, Evangelist, SAP
Paul Taylor Director of Risk Assurance, The Morgan Crucible Company
Pauline Bird BDO LLP
Pesh Framjee Crowe Clark Whitehill
Peter Bonisch Paradigm Risk
Reno Fanucci Head of Risk, P4
Richard Archer Wellcome Trust
Richard Baker Caerus Consulting, on behalf of the UK Policy Governance
Association
Robert Chanon Charterhouse Risk Management
Sally Coates Senior Auditor & Senior Risk Management Advisor, Gloucester
County Council
Seamus Gillen Institute of Chartered Secretaries and Administrators
Sheila Boyce Metropolitan Housing Partnership
Stephen Ward School of Management, University of Southampton
Steven Shackleford Birmingham City University
Thomas Reardon Private. Falls Church, Virginia, USA
Tom Maher Private
Trevor Llanwarne UK Government Actuary
Trevor Williams Magique Galileo
UK Actuarial Profession Enterprise Risk Management
Practice Committee
Vaughan Cole Private
William Wong Private
40

41. 41

42. Crowe Horwath Global Risk Consulting
Contact: Richard Anderson
E richard.anderson@crowehorwathgrc.net
Charterhouse Risk Management Ltd
Contact: Andy Jenkinson
E andy.jenkinson@charterhouse-group.com
The Institute of Risk Management
6 Lloyd’s Avenue
London EC3N 3AX
T +44(0)20 7709 9808
E enquiries@theirm.org
W www.theirm.org