The 2008/2009 credit crunch and subsequent catastrophic economic fallout in the US and Eurozone has demonstrated the impact that failure to integrate risk management at the heart of strategy execution can have on shareholder value. As organisations wake to the reality of their post-credit crunch operating environment, many will have to re-think how they formulate, set and execute strategy. At the heart of this is risk appetite.
Compared to existing risk standards such as COSO and BS31100, Manigent, a Strategy Execution and Risk Management consultancy, uses a slightly broader definition of risk appetite: the amount and type of risk that an organisation is willing to accept, and must take, to achieve their strategic objectives and therefore create value for shareholders and other stakeholders. Core to this definition is the phase ‘must take’ – it implicitly recognises that to execute strategy and create value, organisations must take risk. It explicitly recognises that risk is not just about managing potential threats but also about exploiting opportunities.
Defining Risk Appetite
.png?__SQUARESPACE_CACHEVERSION=1326990036494)
Risk appetite is a board level tool which should be used by the board to set boundaries within which the executive team and the organisation must execute strategy and take risk.
Within the UK, the role of the board in respect to risk appetite has become enshrined on the statute books with the revisions to the UK Corporate Governance Code, May 2010 which sets out the following: The board is responsible for determining the nature and extent of the significant risks it is willing to take in achieving its strategic objectives, i.e the board is responsible for determining risk appetite.
As a board level tool, the definition of risk appetite must be closely coupled with the definition of strategy; it should, therefore, start at the strategy formulation stage, be refined in the strategy setting stage and guide strategic execution and alignment throughout the strategy execution stage. This is achieved by using key business drivers as the ‘lens’ by which the organisation views and thinks about risk.
Business drivers are those vital few factors that disproportionally influence the success or otherwise of a business or industry. For example, ‘economic capital’ might be a key business driver of the investment banking industry along with ‘reputation’. While there may be other business drivers identified, the board may decide to use only these two business drivers as the ‘lens’ through which they will view risk, as such they become the foundation of the risk appetite statement.
Once the board (typically in conjunction with the executive) has agreed the key business drivers they will use in the definition of risk appetite, they should develop a shared understanding of levels of risk, as documented in the table below. This establishes a common language and standard frame of reference that the board (and executive) can use to discuss risk at the corporate level of the business (and in future these levels can be cascaded through the business).
In addition to enabling organisations to monitor the alignment of risk-taking to strategy, defining risk appetite using key business drivers also enables the cascade of risk appetite levels through the organisation, meaning that the board can use risk appetite to ‘set the tone from the top’, providing the organisation with the boundaries within which to operate and the subsidiary business units, divisions etc. can use align their individual risk appetite statement to the corporate statement.
With a common language and standard frame of reference, the board is in a position to consider and decide what level of risk they are willing to take to achieve the strategic objectives they have defined. Often this process is an iterative one, which will see both the organisational strategic ambition and risk appetite adjusted to create alignment. This iterative process is critical to enable the board to really develop a deep and realistic view of what the organisation can sustainably achieve (the strategy) and the level of risk taking required to deliver that strategy (risk appetite).
Once the organisation has determined its strategy and associated level of risk appetite it should conduct a risk assessment to understand the current level of risk-taking within the organisation. The results of the risk assessment exercise should be translated into the same ‘buckets’ of risk used within the risk appetite statement. This enables an organisation to consider the alignment of risk-taking (based on the results from the risk assessment exercise) to strategy (as expressed in via risk appetite).
A powerful tool for monitoring the alignment between risk taking and the strategy is the Appetite Alignment Matrix. This matrix was designed by Manigent to provide a simple, visual way of understanding alignment between the current level of risk taking based on enterprise-wide risk assessments and the strategy as expressed by taking an aggregated view of the risk appetite levels assigned to each strategic objective.
The appetite alignment matrix is articulated around three zones. The main diagonal is the optimal zone, where the firm can determine risk appetite and the risk exposure induced by the business strategy are aligned. Above, three risks are in the optimal zone. For one, the company has both a medium appetite and a medium exposure. It may be, for instance, the risk of currency exchange for a business operating both in the UK and in the Eurozone that partially hedges its currency exposure. Risk and exposure are aligned for a second risk in which the company has both a high appetite and a high risk exposure, and thirdly, where the company has both an extreme appetite and an extreme exposure. An example of the latter could be the risk exposure to markets fluctuation for a broker – dealer. In other words, extreme risk exposure is acceptable as long as it is fully acknowledged and managed by the business.
The two other zones of the alignment matrix are suboptimal, either inefficient or dangerous. In the upper white zone of the matrix, risk appetite is larger than the actual risk exposure. In that case, the business is not taking the full risk he is allowed to take, either by being over controlled or under exposed. Examples of such situations could be a credit institutions not lending to its full capacity (underexposure) or a credit card company blocking too many transactions due to over cautious fraud system alerts (over control). In both cases, money is lost, not in operational risk event but in opportunity costs due to inefficiencies. Four risks are located in this zone in our example matrix.
The lower white zone of Appetite Alignment Matrix should be a concern for risk managers and business executives alike. This is the zone where risk exposure exceeds risk appetite: the business is taking more risk than it is willing or capable of taking. Six risks falls in this zone in the above matrix, two for which the exposure is extreme while the business risk appetite is only moderate. This is most likely to be caused by negligence of assessing risk in the organisation, either by ignorance or by lack of risk culture that leads executives to pay poor or no attention to the risks that they strategy initiate. Examples are diverse, from entering a new market to launching a new product.
Strategy, we know, is of upmost importance when running a business. We argue here that risk is about just as important. It is by properly aligning strategy and risk when reflecting on its risk appetite that a business can gain definitive competitive advantage.
]]>