Risk appetite statements offer benefits for decision making
Understanding an organisation’s risk capacity is critical to maximising returns and avoiding catastrophic failure, warns BDO.
A risk appetite statement for an organisation can provide important guardrails for decision-making and allow for calculated acceptance of risks, according to accounting firm BDO.
BDO risk advisory partners Harsh Vardhan and Martin Corbett said a risk appetite statement is a formal document that articulates the level and type of risk an organisation is willing to take in pursuit of its strategic objectives, given its financial capacity.
In a recent article, the accounting firm said that a risk appetite statement is often a poorly understood document that is inadequately integrated into many organisations, particularly in the non-financial services sector.
“This is partly due to the development of risk appetite as a document to meet requirements without a clear understanding by management. It must be developed with clarity on how it will be implemented, embedded and practically utilised within the organisation,” said BDO.
The board of an organisation must consider the level of risk it is comfortable with as part of determining the strategic director of the organisation, the accounting firm said.
“This willingness to take risks is influenced by organisation’s financial capacity, including factors such as performance, profitability, and solvency etc. For example, while pursing growth through mergers and acquisitions may carry higher risks, it can offer greater rewards,” the article said.
“Increased risk may lead to higher returns, but it could result in catastrophic failure. Finding the right balance between risk and reward is crucial, and the board needs to determine the risk appetite in conjunction with development of the strategy.”
The first step to developing the risk appetite statement is understanding the organisation’s risk capacity.
“Risk capacity refers to the amount of risk the organisation can handle without jeopardising its financial viability,” said BDO.
“Once the capacity is considered, the organisation defines its objectives and establishes its willingness to take risks toward achieving those objectives. The risk appetite is then determined at both business objectives and key risks level.”
A well-constructed risk appetite statement should outline the risk appetite for each objective and key risks should be articulated in qualitative terms, the accounting firm said.
“It should include an appetite scale or continuum on which each risk can be assessed. It’s also important to determine whether this continuum has three, four, or more levels,” it said.
“The risk appetite statement should incorporate quantitative measures to ensure the appetite can be monitored within predefined tolerance levels, that preventative or corrective actions can be taken and so that the underlying reasons for approaching or exceeding tolerance limits can be understood, such as control failures.”
It is also important to define how risks approaching or breaching tolerance levels will be escalated by management, the actions that will be taken to rectify or bring the risk back within the appetite, and the period during which higher level of risk would need to be accepted.
While it’s the board’s responsibility to establish the risk appetite for an organisation, often it will be senior management that needs to lead the development process based on their understanding of risk capacity and appetite.
“This is typically achieved through iterative consultations and workshops facilitated by an independent risk subject matter expert, leading to management’s view of the organisation’s risk appetite,” the article said.
“The board should be kept informed of management’s process and the planned approach for board engagement, including review, challenging assumptions, and ultimately setting the appetite for the organisation. The board’s approval of the risk appetite statement completes the formal process of developing a risk appetite statement.”
Some of the questions that organisations should consider when assessing the effectiveness of their risk appetite statement is whether its embedded and integrated into key business processes and whether the business and corporate strategy for the organisation is informed by the risk appetite, said BDO.
About the author
