|
Risk Managers’ Forum
What feeds an organization’s risk appetite?
Determining risk appetite is critical for establishing a solid risk management program
By Robert Higgins, CIC, CRM, CPCU, ARM, ARM-P, FRM, CRIS
In today’s world, risk management is essential for business success. And one important criterion for establishing an appropriate risk management program is identifying an organization’s “risk appetite.”
Many times, the hardest thing about setting an organization’s risk appetite is reconciling the “risk attitude” and the different perceptions about risk amongst the various stakeholders of the organization.
People will invariably have different answers for the same fundamental questions: What are our risks? What is an acceptable level of risk? What should we do about the risks? Answering these questions and reconciling the different risk attitudes will set the stage for an organization to formulate an appropriate risk appetite as part of its risk management efforts.
The typical organization falls somewhere between being a risk taker and being risk averse—it will have an appetite for some types of risk and an aversion for others. Risk appetite decisions depend on the context, on the nature of the potential losses or gains, and the extent to which information regarding the risks is complete, reliable and relevant. But wherever the organization falls on the risk appetite scale, defining and articulating risk appetite is an essential element of an organization’s risk management program.
What follows is a brief overview of the risk appetite concept, its use within the risk management framework and how defining and communicating risk appetite as part of the risk management plan can help an organization when it’s deciding on its organizational goals and objectives.
Risk appetite
Risk appetite is the amount of risk an organization is willing to take on or is prepared to accept in pursuing its strategic objectives. The willingness to assume risk depends primarily upon an organization’s risk-taking attitude, its objectives and its financial resources. Given both the organization’s objectives and financial situation, its attitude about risk may vary depending on the likelihood and impact of the potential losses. Where some organizations are willing to assume the chance of large financial loss with little apparent stress, others with the same financial resources will experience high stress and “sleepless nights.” These differences are due to personal preferences and individual objectives.
In general:
• Risk appetite describes the kind of risks an organization is both willing and able to take on to the extent that exposure is within pre-defined risk tolerance boundaries (through various subjective and financial metrics).
• Risk appetite is all about knowing where the line is drawn between unacceptable risk and acceptable risk.
• Risk appetite helps set the direction and threshold for risk treatment decisions, especially an organization’s risk retention choices.
• Risk appetite should reflect an organization’s current operating environment and how it may change over time.
• Risk appetite should be set for a specific time and reviewed at least annually.
• Risk appetite should be established at the board and senior management level and then communicated throughout the organization.
If your client hasn’t formulated its organization’s risk appetite and the reasons for it, then you as the agent may not know whether you are offering an appropriate response to a risk. If management is running the organization with insufficient guidance on the levels of risk that are appropriate for the organization to take, or not seizing important opportunities due to a perception that taking on additional risk is discouraged, then organizational performance will not be maximized. Erratic and inappropriate risk-taking is a calamity waiting to happen.
At the other end of the scale, an organization constantly erring on the side of caution with an overly risk-averse culture is likely to stifle the seeking or exploiting of opportunities.
The benefits of knowing
When properly defined and articulated, risk appetite can be a powerful tool for managing risk and enhancing overall business performance by better aligning decision-making and risk. Organizations that effectively formulate their risk appetite and adequately fund their managed risk-taking are better insulated against shock to future earnings, better placed to allocate organizational resources when and where needed, and better prepared to take advantage of changes in insurance pricing and capacity cycles as they arise.
Specific benefits of an organization’s formulating its risk appetite include:
• Having a framework for the organization to operate within, with clear boundaries regarding what is and is not acceptable risk to the organization.
• Having room for creativity within acceptable limits and reducing the possibility of exposure to unpleasant incidents due to a lack of awareness.
• Having guidelines for considering and approving risk-taking levels and activities that are outside the current appetite for risk.
• Identifying and prioritizing areas where additional resources or controls may be necessary to bring the risk into line with the stated risk appetite.
When an organization defines its risk appetite, that effort helps create an accountable, risk-taking culture at every level of the enterprise, giving managers the information they need to accept the responsibility they have been given—without creating an unrestrained maverick culture.
Key questions
When an organization sets out to define its risk appetite and determine the acceptable and unacceptable levels of risk, here are some questions it should consider:
• What are the risks in our organization and in our industry?
• Are we actively managing those risks?
• Have we communicated to those responsible for the management of those risks, the level of risk-taking we view to be acceptable?
• Do we have an approach to setting and communicating risk appetite in our organization?
• Have we considered risk appetite in the context of the entire portfolio of risks we need to manage?
• Have we identified the limits of our risk appetite—that is, at what point should the decision regarding the management of a risk be escalated?
• Who sets the risk appetite for our organization?
• To what extent are our business strategy, policies and procedures linked to our risk appetite?
Conclusion
Risk appetite is not always dependent upon desired organizational objectives and what risks and risk levels are considered tolerable in light of achieving the desired objectives. It needs to be considered across the entire enterprise and for the overall portfolio of risks faced by the organization in order to ensure that the organization’s risk responses are appropriate.
By determining the amount of risk it is prepared to accept, the organization is able to improve organizational control, enhance decision-making, recognize how to reduce and/or mitigate risks and make better decisions on the deployment of resources to the delivery of the business objectives.
The author
Robert Higgins, CIC, CRM, CPCU, ARM, ARM-P, FRM, CRIS, is an executive vice president with Schiff, Kreidler-Shell in their risk services department and has over 30 years of experience in insurance and risk management. He is a graduate of the University of Kentucky College of Business and Xavier University’s MBA program. He can be reached at (513) 977-3100 or e-mail to rhiggins@sksins.com For more information on the Certified Risk Managers (CRM) program, go to www.TheNationalAlliance.com.
|
