integrating risk appetite with strategy

Integrating Risk Appetite with Strategy Introducing a integrated risk appetite framework

Prepared for

Manigent webinar14 February 2011

Culture and mindset

Risk-based Performance Management integrates traditional

performance and risk management to enable sustainable strategy

execution

Performance Management

Risk Management

Strategy Management

Appetite

What are we trying to achieve?

Are we on track?

What are our Threats and Opportunities?

What is our Risk Appetite?

Are we operating within appetite?

The Risk-based Performance Management model is designed to

be a continuous process: the journey is the destination

Operationalise change

Model future uncertainty

Clarify Strategy

Monitor & analyse results

Sustainable Strategy

Define ControlsDefine Initiatives and actions

Monitor and analyse indictors, KPIs, KRIs and KCIs. Capture and analyse risk events and losses

What-if analysisScenario analysisWar games

Define ObjectivesDefine Appetite

Define RisksDefine Drivers

Communicate what could hit us ‘out of the blue’

Communicate intent & accountabilities

Communicate how we will provide assurance whilst

driving change

Communicate where we are doing well & doing poorly

Risk Appetite, and more specifically appetite alignment,

is central to the Risk-based performance approach

Risk Appetite is central to sustainable strategy execution

Failures around risk appetite were highlighted in governmental

and regulatory post-credit crunch reviews

Supervisors see insufficient evidence of board involvement in setting and monitoring adherence to firms’ risk appetite.

Risk appetite statements are generally not sufficiently robust; such statements rarely reflect a suitably wide range of measures and lack actionable elements that clearly articulate firms’ intended responses to losses of capital and breaches in limits.

Board-level engagement in risk oversight should be materially increased, with particular attention to the monitoring of risk and discussion leading to decisions on the entity’s risk appetite and tolerance.

Remuneration structures for all such “high end” employees are appropriately aligned with the medium and longer-term risk appetite and strategy of the entity.

In essence, the obligation of the board in respect of risk should be to ensure that risks are promptly identified and assessed; that risks are effectively controlled; that strategy is informed by and aligned with the board’s risk appetite; and that a supportive risk culture is appropriately embedded so that all employees are alert to the wider impact on the whole organisation of their actions and decisions.

What is Risk Appetite?

The definition of Risk Appetite is clear, but the

application is less well understood

The COSO definition provides ‘What, Who, When and

Why’ of risk appetite

What: the amount and type of risk

Who: an organisational entity

When: over a defined time horizon

Why: to achieve the objectives of the entity

Risk appetite is the amount and type of risk that is acceptable to be taken by an

organisational entity over a defined time period, to achieve the objectives of that entity – COSO Enterprise Risk Management

Risk appetite sets the boundaries within which strategy is executed – Manigent

Risk Appetite is a multidimensional construct, which changes

depending on the organisational entity and what they are

trying to achieve

Extreme

High

Moderate

Low

Overnight

90 days

Annual

Cre

dit

Liq

uid

ity

Op

erat

ion

al

Mar

ket

Stra

tegi

c

Investment Banking exampleWe are willing to put £x million of capital @ risk to trade on our own account over the next 12 month period.

We hold no more than x% of our capital in overnight positions.

We will accept operational losses of £x million per month.

Water Industry exampleWe have no appetite for causing customer illness by supplying poor quality water.

We have no appetite for appearing in local press related to leaks or fines for more than 2 consecutive days.

Cascading Risk Appetite through the organisation, is a

powerful way of shaping culture and aligning risk-taking

Organisational entity

Income Capital


Income Capital


Technology Reputation

The nature of the organisational unit will influence the risk dimensions

used to consider appetite.

Integrating Risk Appetite with

Strategy

Risk Appetite should be integrated

into your organisations standard

strategy frameworkBusiness Goals

Business Drivers

Business Model

Internal Analysis External Analysis

Business Objectives

Strategy Management

Appetite Alignment

Initiative Management

Compliance

Risk ManagementPerformance Management

Appetite

Identify strengths & weaknesses

Identify threats & opportunities

Is our business model fit for

purpose?


purpose?


Manage threats & opportunities

Are we on-track to deliver?

Manage strengths & weaknesses

Appetite

Sett

ing

Exec

uti

on

Form

ula

tio

n

SettingFrom high-level strategies to specific business objectivesDefine specific business objectives and appetite for specific entity’sAllocation of scarce resources by entity, risk category, product lines

ExecutionAre we on-track to achieve our business objectives Are we operating within appetite (are we taking too much, or not enough risk?)Do we have the right level of controls in place to meet internal and external compliance drivers?Are we aligning our change agenda to our strategic agenda?

FormulationDevelopment of high-level strategies and allocation of scarce resources, including capitalGiven our business context, what is our appetite for risk? Given our appetite, have we got the right business model?Are we comfortable with the assumptions we have made?

Risk Appetite has multiple touch

points within the overall strategy

processBusiness Goals

Business Drivers

Business Model


Business Objectives

Strategy Management

Appetite Alignment


Compliance


Appetite




purpose?


purpose?





Appetite

Sett

ing

Exec

uti

on

Form

ula

tio

n

Translate the strategy into specific objectives – creating a hypothesis of our strategy Cascade the strategy via business objectives through the organisation Define appetite for each objective, setting boundaries by organisational unit,

strategic theme, risk category or even product line Building into your strategy a hypothesis about the risks required to deliver the

strategy Linking objectives and appetite shapes culture and enables the cascade of the high

level strategy and appetite down to the operational level where it is actually executed.

Monitoring alignment between exposure and appetite enables understanding of Is the business operating within the boundaries set by, or cascaded

from the Board i.e. appetite? Is the business taking too much or too little risk to achieve its

objectives? Monitoring appetite alignment complements existing, commonly used, one-

dimensional tools, strategy and risk maps

• Engage with your shareholders• Determine how your organisation is going to view risk – the dimensions of

appetite• Business drivers inform the choice of dimensions of appetite• Drivers and Appetite influence choice / discussions around the business model• Select the ‘best’ strategy and set the risk appetite – this is where the board fulfil

one of their key responsibilities – setting the boundaries within which strategy is executed

Risk appetite should influence the

your business model and help

identify the ‘right’ business modelBusiness Goals

Business Drivers

Business Model


Business Objectives

Strategy Management

Appetite Alignment


Compliance


Appetite




purpose?


purpose?





Appetite

Sett

ing

Exec

uti

on

Form

ula

tio

n

Business ModelThe rationale of how an organisation creates, delivers, and captures value - economic, social, or other forms of value. Different business models have different inherit risk/reward characterises.

Business Models are being challenged in many industries by; Increasing and changing regulation Corporate and personal de-leveraging Tight credit conditions On going globalisation Rapidly changing technology

Business Model

Capture value

Create value

Deliver value

Business drivers play a critical

role in the strategy process, and

in this risk appetite frameworkBusiness Goals

Business Drivers

Business Model


Business Objectives

Strategy Management

Appetite Alignment


Compliance


Appetite




purpose?


purpose?





Appetite

Sett

ing

Exec

uti

on

Form

ula

tio

n

Business DriversThe critical factors that determine the success or failure of an organization's strategy and its ability to deliver shareholder value.

Objectives

Risk Appetite

Scenarios

Key Risks

Business drivers Shareholder value

Risk Exposure

Risk Dimensions

Capital

Income

Reputational

Regulatory uncertainty

Share price

Economic Value Add

Return on risk adjusted capital

Return on risk adjusted assetsRisk Events

Technology innovation

Business Driver Relationships Drivers help determine the ‘right’ Business Objectives, their KPIs

and targets. Select the ‘vital few’ drivers to use as risk dimensions to define risk

appetite Assess risk using the same dimensions Link risk events back to drivers to provide powerful strategic

analytics Use business drivers as a base for scenarios to test and validate the

objectives and risk appetite Major changes in business drivers may lead to changes in not only

objectives and risk appetite, but at the most extreme, to the whole business model.

This Risk Appetite framework is based on a ‘vital few’ drivers which

shape thinking around risk appetite and how risk is assessed, and

creates a ‘hard’ link to strategy

Objectives(What are we trying to achieve?)

Risk Appetite(How much risk do we want/

need to take?)

Scenarios(What could go wrong/right?)

Key Risks(What are our uncertainties related to achievement of the

objectives?)


Risk Exposure(How much risk we taking?)

Risk Dimensions(How do we think about risk)

Capital

Income

Reputational


Share price

Economic Value Add


Return on risk adjusted assets

Risk Events(What has gone wrong/right?)


What determines success?

How to define success?

When considering risk appetite, the Board and Executive should

also develop a clear understanding of the organisational Risk

Capacity

Risk Capacity is the absolute maximum amount of risk an

organisation can withstand without causing its failure.

Low Moderate High Extreme

Risk Appetite Risk Capacity

Take emergence action to reduce risk,

and get back into appetite

Put the resolution plan into action to

wind up the business

Risk Appetite and Risk Capacity

Using this approach enables the Board to be very clear

about the operating boundaries for the business

This approach creates shared, clear and actionable understanding of the organisational

appetite, within the Board, the executive and across the enterprise.

Using clearly defined risk dimensions and levels of risk, creates a common language for

the organisation, at all level, to embed risk in a strategic or operational decision-making.

Risk DimensionTime

horizonLow Moderate High Extreme

Capacity Limit

Capital OvernightX% Capital

@RiskX% Capital

@RiskX% Capital

@RiskX% Capital

@RiskAbove X £M

Capital AnnualUp to X £M

X £M to Y £M

X £M to Y £M

X £M to Y £M

Above X £M

Reputation AnnualUp to X vol. Bad coverage

Up to X vol. Bad coverage



The Risk Assessment process is driven by the risk

dimensions used to define risk appetite enabling exposure

to be aligned to appetite

Capital @Risk

Reputation @Risk

Impact x Likelihood (over a time horizon)

Appetite sets the boundaries for the business within which they execute strategy and create value.

Therefore the Appetite Alignment Matrix provides a method of visually monitoring and managing our risk taking according to the strategy, identifying where too much or not enough risk is being taken.

How this approach fits together to enable Boards and

Executive teams to answer some ‘big’ questions.

Business Model

Capture value

Create value

Deliver value

Objectives

Risk Appetite

Scenarios

Key Risks


Risk Exposure

Risk Dimensions

Capital

Income

Reputational


Share price

Economic Value Add


Return on risk adjusted assetsRisk Events


What is our business?

What is our Strategy?

What is our risk exposure?

How do we think about, and what is, our appetite ?

Are we operating within Appetite?

Setting Risk Appetite

Risk Appetite Setting process

This process is designed to quickly establish the organisational boundaries – risk appetite.

Step 3 can be combined with either step 2 or 4.

Splitting the workshops in step 4 is designed to bring out different views / perspectives, but these can be combined.

1. Joint Board / Executive appetite familiarisation workshop(s)

3. Joint risk dimension workshop(s)

4. Board appetite setting workshop(s)

4. Executive appetite setting workshop(s)

2. 1-2-1 follow-up meetings

5. Joint Appetite setting workshop (s)

6. Joint Board / Executive Appetite sign-off

1. Risk Appetite familiarisation

Key deliverables

One 2 hour workshop session

Workshop documentation/notes/report

What does ‘good’ look like?

Full and active participation by the Board and

Executive

Engaging debate demonstrating understanding of

the business value

Answer the question – How does this help us

make money? Create value?








Purpose

To ensure the board and executive have a

shared understanding of risk appetite.

Develop a shared understanding of the

problem and proposed approach.

Key inputs

Risk Appetite training pack


Key deliverables

Meet with all members of the board and

executive

Capture and consolidate feedback/thoughts


All members of the board and executive can

answer the question;

How does risk appetite help us make

money? Create value?








Purpose

To enable individual members of the board or

executive to ask questions, seek clarification,

debate the topic, challenge the approach etc.

Build buy-in and support

Key inputs

Meeting guide


Key deliverables

One 2 hour workshop (additional workshops

maybe required). Alternative approach: Could be

combined with steps 1 or 4

Documented and agreed risk dimensions,

including selection rationale


All members of the board and executive

confidently discuss the business drivers and risk

dimensions








Purpose

Develop a common understanding of the business drivers

Determine which if these drivers should be used as risk dimensions

Key inputs

Strategy documents

Value driver models

Board briefing/options paper

Potentially, working examples

4. Appetite setting workshop(s)

Key deliverables

Two 2 hour workshop (additional workshops

maybe required)

Documented and agreed risk appetite including

selection rationale per team


Any member of each team can confidently

present their view of risk appetite and the

rationale for setting their limits








Purpose

Each team develop their own perspectives

and thinking around appetite

Create challenge and debate within, and

between the two teams

Key inputs

Strategy document

Scenario models

Risk Events / Loss data


Key deliverables

Clearly defined risk appetite statement with

agreement on measureable limits


Any member of each team can confidently

present the organisational risk appetite and its

supporting rationale








Purpose

Develop a common view of risk appetite

between the Board and Executive

Key inputs

Documents from the step 4

Working models / examples based on output

from step 4

Briefing/Options paper


Key deliverables

‘Sign-off’ risk appetite statement


‘Signed-off’ risk appetite statement







6. Appetite sign-off (Board)

Purpose

Board to formally ‘sign-off’ on the risk

appetite

Key inputs

Examples of appetite process output, as set

in step 5 – dashboards, appetite alignment

matrix

About Manigent

www.manigent.com | [email protected] | +44(0)20 7921 0022

Engaging Manigent

“Using Risk-based performance has delivered a more

focused, structured Risk framework, enabling us to focus

on the vital few – the number of Key Risk dropped from

120+ to just 10! - Investment banking client

"Coupled with the implementation of a new risk

management framework, significant business benefits

are emerging“ – Source: Annual accounts of a

Financial Services client

“we have seen a reduction in our Value at Risk (VaR)

of 27% in the first three months of using Risk-based

performance & StratexPoint” – Financial Services

client

“we were able to reduce our operational losses by over

to 50% in the first year of using Risk-based

performance” – Investment banking client

www.manigent.com | [email protected] | +44(0)20 7921 0022

Contact details

Andrew Smart

Managing Director

Manigent

Email: [email protected]

Blog: www.riskbasedperformance.com

Web: www.manigent.com

LinkedIn: http://uk.linkedin.com/in/ajsmart

mailto:[email protected]

http://www.riskbasedperformance.com/

http://www.manigent.com/

http://uk.linkedin.com/in/ajsmart

A final thought....

“the reason that a car has brakes is to allow it to

go faster, and the same [applies to]… business

and risk management.”

integrating risk appetite with strategy

Documents

firms risk appetite

risk appetite statements

definition of risk appetite

entitys risk appetite

longerterm risk appetite

boards risk appetite

monitoring of risk

type of risk