Risk appetite setting is a powerful tool to encourage the taking of risk.
Historically risk appetite setting has been completed as a process that occurs to control/limit risk taking. This is not a negative assessment, just an honest assessment of the process.
So, what is an alternative approach?
Deloitte outline in “Risk appetite frameworks – How to spot the genuine article” that
Everyone these days seems to agree that risk appetite frameworks are good things – even if no-one can quite agree what a good one looks like.
From my perspective there are 4 simple steps to setting risk appetite:
- “Sweet Spot”
- Operating range
Firstly, define your “sweet spot” for the business strategy and operations you are delivering. This “sweet spot” is to define the point you are aspiring to move to, whether that be a growth/increasing position or a contracting/decreasing position.
As an example, our previous posting on Agile Risk Management outlines the importance of undertaking shorter sprints of activity, which requires us to critically assess our approach to the right sweet spot for risks in each sprint.
Once you have established your “sweet spot” you then outline your “operating range”. The “operating range” is the range of risk you are willing to take to execute to your strategy and operational outcomes. This range will generally have an upper and lower bound, providing for the appropriate movements in risk taking that occur due to internal and external factors. A good operating range allows factors that are part of normal business operations, or part of expected strategic decisions, to occur without exceeding your normal expectations.
The third step is setting a “tolerance” level which although you do not want to move within this territory, you are willing to accept a brief entry into the tolerance area(s). However, when in the tolerance areas actions will be taken to move the appetite back within the operating range.
The final step is setting the level(s)/point(s) where you are exceeding your appetite. In these circumstances, you will take immediate action to move back within tolerance and then ultimately into the operating range. In these circumstances there must be consequence management on those responsible for exceeding appetite (i.e. some form of “cost” of exceeding appetite, including training, coaching, and/or potential financial penalty) as this is not where your organisation wishes to ever operate.
These 4 simple steps provide a template for understanding, documenting and monitoring your appetite settings.
In conclusion, the setting of risk appetite is extremely powerful in ensuring any organisation operates effectively and takes the risk it needs to take to be successful.