how to define and implement a risk appetite statement concept | methodology | technology
DESCRIPTION
How to define and implement a Risk Appetite Statement Concept | Methodology | Technology. IOR Scottish Chapter 2 nd Annual Conference Glasgow Caledonian University October 26 th , 2012. Setting the scene. - PowerPoint PPT PresentationTRANSCRIPT
How to define and implement a Risk Appetite StatementConcept | Methodology | Technology
IOR Scottish Chapter 2nd Annual Conference
Glasgow Caledonian University October 26th, 2012
Page 2 | © Manigent 2012
Setting the scene
"People know risk appetite is important, and they think they've got it. But the industry is still falling short on how to think about it [Risk Appetite]..."
"Our challenge as non-executives is there is no definition. We are dealing with words, not well-understood and agreed concepts. There's no 'hitchhikers' guide' to risk appetite and no agreement there should be one"
Tapestry Networks, Inc - Bank Governance Leadership Network, Insights from the non-executive dinners, June 16, 2010
Page 3 | © Manigent 2012
Objectives
1. To provide a practical approach to define and deploying risk appetite as a strategic management tool
2. Explain the role of risk appetite within the overall strategy process
3. Outline the steps and process around building a robust Risk Appetite statement
Provide a ‘Hitchhikers guide’ to Risk Appetite!
Page 4 | © Manigent 2012
The credit crunch and subsequent fall-out is rewriting the rules on strategy execution and risk management
Page 5 | © Manigent 2012
Corporate governance weaknesses related to Risk Appetite contributed to the credit crunch
Supervisors see insufficient evidence of board involvement in setting and monitoring adherence to firms’ risk appetite.
Risk appetite statements are generally not sufficiently robust; such statements rarely reflect a suitably wide range of measures and lack actionable elements that clearly articulate firms’ intended responses to losses of capital and breaches in limits.
Board-level engagement in risk oversight should be materially increased, with particular attention to the monitoring of risk and discussion leading to decisions on the entity’s risk appetite and tolerance.
Remuneration structures for all such “high end” employees are appropriately aligned with the medium and longer-term risk appetite and strategy of the entity.
In essence, the obligation of the board in respect of risk should be to ensure that risks are promptly identified and assessed; that risks are effectively controlled; that strategy is informed by and aligned with the board’s risk appetite; and that a supportive risk culture is appropriately embedded so that all employees are alert to the wider impact on the whole organisation of their actions and decisions.
Page 6 | © Manigent 2012
Post credit crunch, UK Corporate Governance Code was updated to be more specific about Risk Appetite
The UK Corporate Governance Code issued in May 2010 states that ‚the Board is responsible for determining the nature and extent of the significant risks it is willing to take in achieving its strategic objectives…and should maintain sound risk management and internal control systems.
Page 7 | © Manigent 2012
Organisations are increasingly looking to ‘Risk Management’ as a source of competitive advantage
Neither too cautious nor too reckless, the best companies use
their risk management capabilities to adjust either their capacity or
their appetite to make more prudent— and ultimately
successful— investment decisions.
Source: Accenture 2011 Global Risk Management Study
64%Almost two-thirds of Risk Masters 64% indicate that their risk
management capabilities provide competitive advantage to “a great extent,” compared with only 42% of the peer set.
Page 8 | © Manigent 2012
Evidence suggests many corporate governance weaknesses and Board level challenges still exist“the Board is responsible for determining the nature and extent of the significant risks it is willing to take in achieving its strategic goals.” UK Corporate Governance Code, 2010
21%
“only 21% align their risks with their business strategy”
– Grant Thornton Corporate Governance Review 2011
Where the Board need to spend more time…
70% Strategy
42% Execution
47% Performance Management
67% Risk Management21%
“Only 21% of directors surveyed claim a complete understanding of their companies’ current strategy”
– Mckinsey Global Survey – Corporate Governance, 2011
“results indicate a need to better educate Boards on industry dynamics and how their companies create value...”
Approx. 1500 participants
Page 9 | © Manigent 2012
The definition of Risk Appetite is clear, but the application is less well understood
The COSO definition provides ‘What, Who, When and Why’ of risk appetite What: the amount and type of risk Who: an organisational entity When: over a defined time horizon Why: to achieve the objectives of the entity
Risk appetite is the amount and type of risk that is acceptable to be taken by an organisational entity over a defined time period, to achieve the objectives of that entity – COSO Enterprise Risk Management
Risk appetite sets the boundaries within which strategy is executed
– Manigent
Page 10 | © Manigent 2012
Risk Appetite is a multidimensional construct, which changes depending on the organisational entity and its objectives
Extreme
High
Moderate
Low
Overnight90 days
Annual
Cred
it
Liqu
idity
Ope
ratio
nal
Mar
ket
Stra
tegi
c
Investment Banking exampleWe are willing to put £x million of capital @ risk to trade on our own account over the next 12 month period.
We hold no more than x% of our capital in overnight positions.
We will accept operational losses of £x million per month.
Water Industry exampleWe have no appetite for causing customer illness by supplying poor quality water.
We have no appetite for appearing in local press related to leaks or fines for more than 2 consecutive days.
Page 11 | © Manigent 2012
Risk Appetite Setting process
1. Joint Board / Executive appetite familiarisation workshop(s)
3. Joint risk dimension workshop(s)
4. Board appetite setting workshop(s)
4. Executive appetite setting workshop(s)
2. 1-2-1 follow-up meetings
5. Joint Appetite setting workshop (s)
6. Joint Board / Executive Appetite sign-off
This process is designed to quickly establish the organisational boundaries – risk appetite.
Step 3 can be combined with either step 2 or 4.
Splitting the workshops in step 4 is designed to bring out different views / perspectives, but these can be combined.
Page 12 | © Manigent 2012
Defining Risk Appetite in Seven Steps
To design a robust risk appetite statement follow these steps:1. Identify the Key Value Drivers for the Business2. Define Risk ‘Buckets’ based on Key Value Drivers3. Define a set of Strategic Objectives4. Define and Assess a set of Key Risks5. Align Risk-taking to Strategy6. Define the Risk Appetite statement7. Monitor the Alignment of Risk-taking to Appetite
Page 13 | © Manigent 2012
1. Identify the Key Value Drivers for the Business
Business Goals
Business Drivers
Business Model
Internal Analysis External Analysis
Business Objectives
Strategy
Appetite
Appetite Alignment
Risk ManagementPerformance Management
Appetite
Identify strengths & weaknesses
Identify threats & opportunities
Is our business model fit for
purpose?
Is our business model fit for
purpose?
Are we operating within appetite?
Manage threats & opportunities
Are we on-track to deliver?
Manage strengths & weaknesses
Appetite
Setti
ngEx
ecuti
onFo
rmul
ation
Develop the strategic plan
Distil strategy into actionable objectives with defined appetites
Continuously align and monitor risk taking to business strategy
Page 14 | © Manigent 2012
1. Identify the Key Value Drivers for the Business cont.
Performance Management
Risk Management
Strategy Management
Appetite
What are we trying to achieve?
Are we on track?
What is our Risk Appetite?
Are we operating within appetite?
Governance & Communications
Culture
Page 15 | © Manigent 2012
1. Identify the Key Value Drivers for the Business cont.
Business drivers
Capital
Income
Reputation
Shareholder value
Share price
Economic value add
Profit
Strategy
Align Risk-taking to Strategy
Manage Risk
Manage Performance Appetite
Governance Communication
Culture
Appetite
Page 16 | © Manigent 2012
2. Define Risk ‘Buckets’ based on Key Value Drivers
Business Drivers Low Moderate High Extreme Capacity Limit
Income X% Capital@Risk
X% Capital@Risk
X% Capital@Risk
X% Capital@Risk
Capital Up to X £M
X £M to Y £M
X £M to Y £M
X £M to Y £M
Above X £M
ReputationUp to X vol.
Bad coverage
Up to X vol. Bad
coverage
Up to X vol. Bad
coverage
Up to X vol. Bad
coverage
Page 17 | © Manigent 2012
2. Define Risk ‘Buckets’ based on Key Value Drivers cont.
Business Drivers Low Moderate High Extreme Capacity Limit
Income X% Capital@Risk
X% Capital@Risk
X% Capital@Risk
X% Capital@Risk
Capital Up to X £M
X £M to Y £M
X £M to Y £M
X £M to Y £M
Above X £M
ReputationUp to X vol.
Bad coverage
Up to X vol. Bad
coverage
Up to X vol. Bad
coverage
Up to X vol. Bad
coverage
Page 18 | © Manigent 2012
3. Define a set of Strategic Objectives
Page 19 | © Manigent 2012
4. Define and Assess a set of Key Risks
The risk of (what, where, when)….. caused by (how) ……resulting in..…(impact/consequences)
Examples The risk of financial deficit at end of year caused by
decreased in-patient activity and revenue, resulting in rationalisation of service offerings.
The risk of exceeding A&E waiting times, caused by increased demand and staff vacancies, resulting in not meeting community expectations and adverse patient outcomes
Page 20 | © Manigent 2012
4. Define and Assess a set of Key Risks cont.
The risk of (what, where, when)….. caused by (how) ……resulting in..…(impact/consequences)
Examples The risk of financial deficit at end of year caused by
decreased in-patient activity and revenue, resulting in rationalisation of service offerings.
The risk of exceeding A&E waiting times, caused by increased demand and staff vacancies, resulting in not meeting community expectations and adverse patient outcomes
Page 21 | © Manigent 2012
4. Define and Assess a set of Key Risks cont.
Page 22 | © Manigent 2012
5. Align Risk-taking to Strategy
Page 23 | © Manigent 2012
6. Define the Risk Appetite statement
Business Drivers Low Moderate High Extreme Capacity Limit
Income X% Capital@Risk
X% Capital@Risk
X% Capital@Risk
X% Capital@Risk
Capital Up to X £M
X £M to Y £M
X £M to Y £M
X £M to Y £M
Above X £M
ReputationUp to X vol.
Bad coverage
Up to X vol. Bad
coverage
Up to X vol. Bad
coverage
Up to X vol. Bad
coverage
Page 24 | © Manigent 2012
6. Define the Risk Appetite statement cont.
Page 25 | © Manigent 2012
7. Monitor the Alignment of Risk-taking to Appetite
Capital @Risk
Reputation @Risk
Impact x Likelihood (over a time horizon)
Appetite sets the boundaries for the business within which they execute strategy and create value.
Therefore the Appetite Alignment Matrix provides a method of visually monitoring and managing our risk taking according to the strategy, identifying where too much or not enough risk is being taken.
Page 26 | © Manigent 2012
7. Monitor the Alignment of Risk-taking to Appetite
Strategy Map Risk Map
Appetite Alignment Matrix
Page 27 | © Manigent 2012
Q & A