integrating risk appetite with strategy feb 14 2011

Integrating Risk Appetite with Strategy Introducing a integrated risk appetite framework

Prepared for

Manigent webinar14 February 2011

Objectives and background

Objectives Provide an outline of the Risk Appetite framework within

Risk-based Performance. Provide clarification about the role Risk Appetite has to

play in the overall strategy process. Create a discussion around risk appetite.

Background Risk Appetite is central to the Risk-based Performance

approach. Risk Appetite is a hot topic with our clients right now.

Culture and mindset

Risk-based Performance Management integrates traditional performance and risk management to enable sustainable strategy execution

Performance Management

Risk Management

Strategy Management

Appetite

What are we trying to achieve?

Are we on track?

What are our Threats and Opportunities?

What is our Risk Appetite?

Are we operating within appetite?

The Risk-based Performance Management model is designed to be a continuous process: the journey is the destination

Operationalise change

Model future uncertainty

Clarify Strategy

Monitor & analyse results

Sustainable Strategy

Define ControlsDefine Initiatives and actions

Monitor and analyse indictors, KPIs, KRIs and KCIs. Capture and analyse risk events and losses

What-if analysisScenario analysisWar games

Define ObjectivesDefine Appetite

Define RisksDefine Drivers

Communicate what could hit us ‘out of the blue’

Communicate intent & accountabilities

Communicate how we will provide assurance whilst

driving change

Communicate where we are doing well & doing poorly

Risk Appetite, and more specifically appetite alignment, is central to the Risk-based performance approach

Risk Appetite is central to sustainable strategy execution

Failures around risk appetite were highlighted in governmental and regulatory post-credit crunch reviews

Supervisors see insufficient evidence of board involvement in setting and monitoring adherence to firms’ risk appetite.

Risk appetite statements are generally not sufficiently robust; such statements rarely reflect a suitably wide range of measures and lack actionable elements that clearly articulate firms’ intended responses to losses of capital and breaches in limits.

Board-level engagement in risk oversight should be materially increased, with particular attention to the monitoring of risk and discussion leading to decisions on the entity’s risk appetite and tolerance.

Remuneration structures for all such “high end” employees are appropriately aligned with the medium and longer-term risk appetite and strategy of the entity.

In essence, the obligation of the board in respect of risk should be to ensure that risks are promptly identified and assessed; that risks are effectively controlled; that strategy is informed by and aligned with the board’s risk appetite; and that a supportive risk culture is appropriately embedded so that all employees are alert to the wider impact on the whole organisation of their actions and decisions.

What is Risk Appetite?

The definition of Risk Appetite is clear, but the application is less well understood

The COSO definition provides ‘What, Who, When and Why’ of risk appetite What: the amount and type of risk Who: an organisational entity When: over a defined time horizon Why: to achieve the objectives of the entity

Risk appetite is the amount and type of risk that is acceptable to be taken by an organisational entity over a defined time period, to achieve the objectives of that entity – COSO Enterprise Risk Management

Risk appetite sets the boundaries within which strategy is executed – Manigent

Risk Appetite is a multidimensional construct, which changes depending on the organisational entity and what they are trying to achieve

Extreme

High

Moderate

Low

Overnight90 days

Annual

Cred

it

Liqu

idity

Ope

ratio

nal

Mar

ket

Stra

tegi

c

Investment Banking exampleWe are willing to put £x million of capital @ risk to trade on our own account over the next 12 month period.

We hold no more than x% of our capital in overnight positions.

We will accept operational losses of £x million per month.

Water Industry exampleWe have no appetite for causing customer illness by supplying poor quality water.

We have no appetite for appearing in local press related to leaks or fines for more than 2 consecutive days.

Cascading Risk Appetite through the organisation, is a powerful way of shaping culture and aligning risk-taking

Organisational entity

Income Capital


Income Capital


Technology Reputation

The nature of the organisational unit will influence the risk dimensions

used to consider appetite.

Integrating Risk Appetite with Strategy

Risk Appetite should be integrated into your

organisations standard strategy framework

Business Goals

Business Drivers

Business Model

Internal Analysis External Analysis

Business Objectives

Strategy Management

Appetite Alignment

Initiative Management

Compliance

Risk ManagementPerformance Management

Appetite

Identify strengths & weaknesses

Identify threats & opportunities

Is our business model fit for

purpose?


purpose?


Manage threats & opportunities

Are we on-track to deliver?

Manage strengths & weaknesses

Appetite

Setti

ngEx

ecuti

onFo

rmul

ation

SettingFrom high-level strategies to specific business objectivesDefine specific business objectives and appetite for specific entity’sAllocation of scarce resources by entity, risk category, product lines

ExecutionAre we on-track to achieve our business objectives Are we operating within appetite (are we taking too much, or not enough risk?)Do we have the right level of controls in place to meet internal and external compliance drivers?Are we aligning our change agenda to our strategic agenda?

Formulation Development of high-level strategies and allocation of scarce resources, including capitalGiven our business context, what is our appetite for risk? Given our appetite, have we got the right business model?Are we comfortable with the assumptions we have made?

Risk Appetite has multiple touch points within the overall strategy process

Business Goals

Business Drivers

Business Model


Business Objectives

Strategy Management

Appetite Alignment


Compliance


Appetite




purpose?


purpose?





Appetite

Setti

ngEx

ecuti

onFo

rmul

ation

Translate the strategy into specific objectives – creating a hypothesis of our strategy Cascade the strategy via business objectives through the organisation Define appetite for each objective, setting boundaries by organisational unit,

strategic theme, risk category or even product line Building into your strategy a hypothesis about the risks required to deliver the

strategy Linking objectives and appetite shapes culture and enables the cascade of the high

level strategy and appetite down to the operational level where it is actually executed.

Monitoring alignment between exposure and appetite enables understanding of Is the business operating within the boundaries set by, or cascaded from

the Board i.e. appetite? Is the business taking too much or too little risk to achieve its

objectives? Monitoring appetite alignment complements existing, commonly used, one-

dimensional tools, strategy and risk maps

• Engage with your shareholders• Determine how your organisation is going to view risk – the dimensions of appetite• Business drivers inform the choice of dimensions of appetite• Drivers and Appetite influence choice / discussions around the business model• Select the ‘best’ strategy and set the risk appetite – this is where the board fulfil

one of their key responsibilities – setting the boundaries within which strategy is executed

Risk appetite should influence the your business model and help identify the

‘right’ business model

Business Goals

Business Drivers

Business Model


Business Objectives

Strategy Management

Appetite Alignment


Compliance


Appetite




purpose?


purpose?





Appetite

Setti

ngEx

ecuti

onFo

rmul

ation

Business ModelThe rationale of how an organisation creates, delivers, and captures value - economic, social, or other forms of value. Different business models have different inherit risk/reward characterises.

Business Models are being challenged in many industries by; Increasing and changing regulation Corporate and personal de-leveraging Tight credit conditions On going globalisation Rapidly changing technology

Business Model

Capture value

Create value

Deliver value

Business drivers play a critical role in the strategy

process, and in this risk appetite framework

Business Goals

Business Drivers

Business Model


Business Objectives

Strategy Management

Appetite Alignment


Compliance


Appetite




purpose?


purpose?





Appetite

Setti

ngEx

ecuti

onFo

rmul

ation

Business DriversThe critical factors that determine the success or failure of an organization's strategy and its ability to deliver shareholder value.

Objectives

Risk Appetite

Scenarios

Key Risks

Business drivers Shareholder value

Risk Exposure

Risk Dimensions

Capital

Income

Reputational

Regulatory uncertainty

Share price

Economic Value Add

Return on risk adjusted capital

Return on risk adjusted assetsRisk Events

Technology innovation

Business Driver Relationships Drivers help determine the ‘right’ Business Objectives, their KPIs

and targets. Select the ‘vital few’ drivers to use as risk dimensions to define risk

appetite Assess risk using the same dimensions Link risk events back to drivers to provide powerful strategic

analytics Use business drivers as a base for scenarios to test and validate the

objectives and risk appetite Major changes in business drivers may lead to changes in not only

objectives and risk appetite, but at the most extreme, to the whole business model.

This Risk Appetite framework is based on a ‘vital few’ drivers which shape thinking around risk appetite and how risk is assessed, and creates a ‘hard’ link to strategy

Objectives(What are we trying to achieve?)

Risk Appetite(How much risk do we want/

need to take?)

Scenarios(What could go wrong/right?)

Key Risks(What are our uncertainties related to achievement of the

objectives?)


Risk Exposure(How much risk we taking?)

Risk Dimensions(How do we think about risk)

Capital

Income

Reputational


Share price

Economic Value Add


Return on risk adjusted assets

Risk Events(What has gone wrong/right?)


What determines success?

How to define success?

When considering risk appetite, the Board and Executive should also develop a clear understanding of the organisational Risk Capacity

Risk Capacity is the absolute maximum amount of risk an organisation can withstand without causing its failure.

Low Moderate High Extreme

Risk Appetite Risk Capacity

Take emergence action to reduce risk, and get

back into appetite

Put the resolution plan into action to wind up

the business

Risk Appetite and Risk Capacity

Using this approach enables the Board to be very clear about the operating boundaries for the business

This approach creates shared, clear and actionable understanding of the organisational appetite, within the Board, the executive and across the enterprise.

Using clearly defined risk dimensions and levels of risk, creates a common language for the organisation, at all level, to embed risk in a strategic or operational decision-making.

Risk Dimension Time horizon Low Moderate High Extreme Capacity

Limit

Capital Overnight X% Capital@Risk

X% Capital@Risk

X% Capital@Risk

X% Capital@Risk

Above X £M

Capital Annual Up to X £M

X £M to Y £M

X £M to Y £M

X £M to Y £M

Above X £M

Reputation AnnualUp to X vol. Bad coverage

Up to X vol. Bad coverage



The Risk Assessment process is driven by the risk dimensions used to define risk appetite enabling exposure to be aligned to appetite

Capital @Risk

Reputation @Risk

Impact x Likelihood (over a time horizon)

Appetite sets the boundaries for the business within which they execute strategy and create value.

Therefore the Appetite Alignment Matrix provides a method of visually monitoring and managing our risk taking according to the strategy, identifying where too much or not enough risk is being taken.

How this approach fits together to enable Boards and Executive teams to answer some ‘big’ questions.

Business Model

Capture value

Create value

Deliver value

Objectives

Risk Appetite

Scenarios

Key Risks


Risk Exposure

Risk Dimensions

Capital

Income

Reputational


Share price

Economic Value Add


Return on risk adjusted assetsRisk Events


What is our business?

What is our Strategy?

What is our risk exposure?

How do we think about, and what is, our appetite ?

Are we operating within Appetite?

Setting Risk Appetite

Risk Appetite Setting process

This process is designed to quickly establish the organisational boundaries – risk appetite.

Step 3 can be combined with either step 2 or 4.

Splitting the workshops in step 4 is designed to bring out different views / perspectives, but these can be combined.

1. Joint Board / Executive appetite familiarisation workshop(s)

3. Joint risk dimension workshop(s)

4. Board appetite setting workshop(s)

4. Executive appetite setting workshop(s)

2. 1-2-1 follow-up meetings

5. Joint Appetite setting workshop (s)

6. Joint Board / Executive Appetite sign-off

1. Risk Appetite familiarisation

Key deliverables One 2 hour workshop session Workshop documentation/notes/report

What does ‘good’ look like? Full and active participation by the

Board and Executive Engaging debate demonstrating

understanding of the business value Answer the question – How does this

help us make money? Create value?








Purpose To ensure the board and executive have a

shared understanding of risk appetite. Develop a shared understanding of the

problem and proposed approach.

Key inputs Risk Appetite training pack


Key deliverables Meet with all members of the board

and executive Capture and consolidate

feedback/thoughts

What does ‘good’ look like? All members of the board and executive

can answer the question; How does risk appetite help us

make money? Create value?








Purpose To enable individual members of the board or

executive to ask questions, seek clarification, debate the topic, challenge the approach etc.

Build buy-in and support

Key inputs Meeting guide


Key deliverables One 2 hour workshop (additional

workshops maybe required). Alternative approach: Could be combined with steps 1 or 4

Documented and agreed risk dimensions, including selection rationale

What does ‘good’ look like? All members of the board and executive

confidently discuss the business drivers and risk dimensions








Purpose Develop a common understanding of the

business drivers Determine which if these drivers should be

used as risk dimensions

Key inputs Strategy documents Value driver models Board briefing/options paper Potentially, working examples

4. Appetite setting workshop(s)

Key deliverables Two 2 hour workshop (additional

workshops maybe required) Documented and agreed risk appetite

including selection rationale per team

What does ‘good’ look like? Any member of each team can

confidently present their view of risk appetite and the rationale for setting their limits








Purpose Each team develop their own perspectives

and thinking around appetite Create challenge and debate within, and

between the two teams

Key inputs Strategy document Scenario models Risk Events / Loss data


Key deliverables Clearly defined risk appetite statement

with agreement on measureable limits

What does ‘good’ look like? Any member of each team can

confidently present the organisational risk appetite and its supporting rationale








Purpose Develop a common view of risk appetite

between the Board and Executive

Key inputs Documents from the step 4 Working models / examples based on output

from step 4 Briefing/Options paper


Key deliverables ‘Sign-off’ risk appetite statement

What does ‘good’ look like? ‘Signed-off’ risk appetite statement







6. Appetite sign-off (Board)

Purpose Board to formally ‘sign-off’ on the risk

appetite

Key inputs Examples of appetite process output, as set

in step 5 – dashboards, appetite alignment matrix

About Manigent

"Manigent didn't come to us with all the answers, they came with the right questions and helped us find the right answers“ - Investment banking executive

Our missionTo provide consultancy solutions that enable our clients to enhance strategy execution within known risk appetite boundaries.

Using our services, clients improve the achievement of strategic objectives, reduce regulatory capital, reduce operational losses and gain assurance that they are operating within appetite.

Key sectorsFinancial Services & public sector.Key expertiseRisk-based Performance, Basel 2, Basel 3, SOX, Solvency 2, Regulatory reform, Section 166, Balanced Scorecard , Risk Management and Management Information (MI)

www.manigent.com | [email protected] | +44(0)20 7921 0022

Engaging Manigent

“Using Risk-based performance has delivered a more focused, structured Risk framework, enabling us to focus on the vital few – the number of Key Risk dropped from 120+ to just 10! - Investment banking client

"Coupled with the implementation of a new risk management framework, significant business benefits are emerging“ – Source: Annual accounts of a Financial Services client

“we have seen a reduction in our Value at Risk (VaR) of 27% in the first three months of using Risk-based performance & StratexPoint” – Financial Services client

“we were able to reduce our operational losses by over to 50% in the first year of using Risk-based performance” – Investment banking client

What we deliverRisk-Based Performance Management

Framework development & deployment Maturity Model Assessment & Audit Coaching & mentoring

Balanced Scorecard Framework development Maturity Model Assessment & Audit Coaching & mentoring

Enterprise & Operational Risk Framework development & deployment Maturity Model Assessment & Audit Coaching & mentoring

Risk Appetite Framework development & deployment Coaching & mentoring

Management information (MI) Framework development & deployment Coaching & mentoring

How we deliver Experienced delivery consultantsAgile based deliveryPragmatic use of SharePoint technology to cut delivery time and embed the solution (StratexPoint via Stratex Systems alliance)

www.manigent.com | [email protected] | +44(0)20 7921 0022

A final thought....

“the reason that a car has brakes is to allow it to go faster, and the same

[applies to]… business and risk management.”

Contact details

Andrew SmartCEOManigentEmail: [email protected]: www.riskbasedperformance.comWeb: www.manigent.comLinkedIn: http://uk.linkedin.com/in/ajsmart

mailto:[email protected]

http://www.riskbasedperformance.com/

http://www.manigent.com/

http://uk.linkedin.com/in/ajsmart