Embedding Risk Appetite

15 Pages·2011·3.62 MB·English

Embedding Risk Appetite

within the Strategy Process
Andrew Smart
with James Creelman
Table of SummAry 3
Contents Introduction: Defining Risk Appetite 4
Risk Appetite and the Strategy Process 5
Strategy formulation 5
Role of Risk Appetite in Strategy Formulation 7
Strategy Setting 9
Role of Risk Appetite in Strategy Setting 10
Strategy Execution 12
Role of Risk Appetite in Strategy Exectuion 12
CONCLUSION 15
About the authors 15
Andrew Smart 15
James Creelman 15
2 EMBEDDING RISK APPETITE WITHIN THE STRATEGY PROCESS
Summary
Risk appetite is the amount and type of risk that an organization is willing to accept, and must
take, to achieve its strategic objectives and therefore create value for shareholders and other
stakeholders. Core to this definition is that risk is not just about managing potential threats but
about exploiting opportunities. Risk appetite impacts all stages of an organization’s strategy
process: formulation, setting and execution.
In formulation, organizations should go further leaders should deliver a clear articulation of the risk
than standard SWOT-type analyses and identify/ appetite and key risks associated with the chosen set
review business drivers (those vital few factors of objectives.
that disproportionally influence the success or
During strategy execution the organization
otherwise of the business or industry) and consider
implements performance and risk management
their business model (how they create, deliver and
processes to ensure that it successfully deliver
capture value).
on the set of agreed objectives while managing
At the formulation stage, risk appetite should play the risks within appetite. At this stage, risk
a key role in strategic options evaluation and the appetite provides the boundaries within which the
decision-making processes around which option(s) organization can execute strategy and provides a
the organization will pursue. The board and mechanism for the alignment of risk taking to the
the executive team should jointly craft a shared strategy.
understanding of the organization’s risk appetite.
An Appetite Alignment Matrix is a simple, visual
In strategy setting, an organization translates way of understanding alignment between the
strategies into a specific set of strategic objectives current level of risk taking based on enterprise-wide
which the organization will seek to achieve over risk assessments and the strategy as expressed by
a specified time horizon. As well as creating a taking an aggregated view of the risk appetite levels
Strategy Map and supporting set of performance assigned to each strategic objective.
indicators, targets and initiatives, organizational
3 EMBEDDING RISK APPETITE WITHIN THE STRATEGY PROCESS
Introduction: Defining Risk Appetite
Since the 2008 credit crunch and in the face of a new set of regulatory demands, from Basel
3, Solvency 2, Dodds-Frank, and potentially catastrophic economic conditions in the US and
Eurozone, risk management has been a much talked about topic.
Within these conversations much emphasis has turn influences the entity’s culture and operating
been placed on risk appetite (that is, how much style. Secondly, COSO establishes the link between
risk an organization is willing to take in pursuit of appetite and strategy, stating explicitly: risk appetite
its business goals). However, what is less broadly is directly related to an entity’s strategy.
discussed or understood is how to properly and
The Risk Management Code of Practice from the
systematically embed risk appetite into strategic
British Standards institution, BS31100:2008 defines
and operational processes. How, for example, can
risk appetite as the amount and type of risk that an
the efficacious management of risk appetite lead
organization is prepared to seek, accept or tolerate.
to better strategic decision-making and subsequent
This standard also relates appetite to strategy and
value creation for shareholders (many of whom
governance stating: considering and setting a risk
are, thanks to the credit crunch, somewhat “risk
appetite enables an organization to increase its
averse,”) and other stakeholders. The integration of
rewards by optimizing risk taking and accepting
risk appetite into strategic and operational processes
calculated risks within an appropriate level of
is critical to successful strategy execution and is
authority.
explained in this paper.
Manigent provides a slightly broader definition of
First though, let’s define risk appetite. The
risk appetite as: the amount and type of risk that
Committee of Sponsoring Organizations of the
an organization is willing to accept, and must take,
Treadway Commission’s (COSO) Enterprise Risk
to achieve their strategic objectives and therefore
Management – an Integrated Framework, 2004
create value for shareholders and other stakeholders.
defines risk appetite as the amount of risk, on a
Core to this definition is that risk is not just about
broad level; an entity is willing to accept in pursuit
managing potential threats, but about exploiting
of value. COSO makes two key points related to
opportunities. Risk has upsides as well as downsides,
appetite. Firstly, it states that [risk appetite] reflects
as we explain later.
the entity’s risk management philosophy, and in
4 EMBEDDING RISK APPETITE WITHIN THE STRATEGY PROCESS
Risk Appetite and the Strategy Process
Risk appetite impacts all stages of an organization’s strategy process and is therefore a core
determinant of whether or not an organization succeeds in delivering its strategic vision and
goals. Figure 1 shows a typical strategy process, broken into three distinct stages (each of which
we consider in detail below alongside the role of risk appetite at that phase): 1) formulation, 2)
setting and 3) execution.
Strategy Formulation
The strategy
process
Identify strengths & Business Goals Identify threats &
weaknesses opportunities
Internal Analysis External Analysis
N
O
TI Is our business Business Drivers Is our business
A model fit for model fit for
L the purpose? the purpose?
U
M
R
Appetite
O
F
Business Model
S Business Objectives
G
N
TI
T
E
S Appetite
Strategy
Are we on-track
Management Are we operating within
to deliver?
appetite?
Performance Appetite
N Risk Management
Management Alignment
O
TI
U
C
E Compliance
X
E manage strengths & manage threats &
opportunities
weaknesses
Initiative
Management
5 EMBEDDING RISK APPETITE WITHIN THE STRATEGY PROCESS
During the strategy formulation stage an their business model accordingly. This action also
organization develops or reviews a set of broad, implies they had an appetite for the implied level
often long term, business goals, and a series of of risk taking associated with funding via wholesale
strategic options for their achievement. markets. Post credit crunch, with significantly lower
risk appetites across the industry but capital still
Any good strategy textbook will tell you that
a key driver, many banks are turning away from
during this process the organization should scan
wholesale markets and focusing on building their
the external environment for market opportunities
branch networks to generate funding. As part of the
and threats as well as analysing their internal
strategy formulation process organization should
environment to understand where its real strengths
assess whether the business drivers themselves are
and weaknesses lie. Traditionally, this exercise is
changing because of either external or internal
conducted via a SWOT (Strengths, Weaknesses,
factors, and if so take appropriate action. They
Opportunities, and Threats) analysis or something
should also be mindful of changes in business
similar.
models been deployed by competitors (this could
include non-industry participants). Business model
Manigent goes beyond the standard textbooks/
innovation is becoming an increasingly important
definitions and add that organizations should
source of competitive advantage. Business model
also identify/review the business drivers of their
innovation maybe driven from within the industry,
industry generally, and their organization specifically,
whereby an existing player takes a different
and consider their business model.
approach to creating, delivering and capture value
Business drivers are those vital few factors that than its industry peers or it may come from outside
disproportionally influence the success or otherwise the industry where a new entrant comes into the
of the business or industry. Whereas the business market via a different business model. An example
model describes how an organisation creates, is the Apple’s IPod/ITunes model. In a world where
delivers and captures value. music was typically purchased on CDs and where
the consumer had to pay for the entire CD to get
For example, access to capital at a competitive
the one or two songs they actually wanted, Apple
price might be a key determent of success of a
introduced the ability to download music via an
bank, therefore capital maybe defined as one of the
integration hardware and software platform and
bank’s business drivers. Prior to the credit crunch
enable individual songs to be purchased. This was
a number of UK retail banking organizations were
a radically different business model and it changed
reducing their reliance on their branch network as
the economic dynamics of the music industry.
a channel to raise capital in the form of deposits to
risk appetites across the industry but capital still
provide loans, mortgages, etc. Instead, many chose
a key driver, many banks are turning away from
the wholesale money markets to raise capital. They wholesale markets and focusing on building their
had chosen this funding route because at that time branch networks to generate funding. As part of the
there was an extremely competitive retail market strategy formulation process organization should
and all participants were chasing growth while assess whether the business drivers themselves are
simultaneously seeking to carefully control costs. changing because of either external or internal
While they may not have expressed it clearly, the factors, and if so take appropriate action. They
organizations that access the wholesale markets should also be mindful of changes in business
were doing so because they were recognising models been deployed by
capital as one of their key drivers and adjusted
6 EMBEDDING RISK APPETITE WITHIN THE STRATEGY PROCESS
Role of Risk Appetite in Strategy Formulation
At the formulation stage, risk appetite should play a key role in strategic options evaluation and
the decision-making processes around which option(s) the organization will pursue.
The board and the executive team should jointly Depending on the business strategies and model
form a shared understanding of the organizational selected, the organization may have to re-evaluate
risk appetite. They should then precisely and its thinking around its business drivers. Moreover,
unambiguously define what they mean by risk it should keep in mind that different strategies and
appetite (critical for both the strategy making different business models have different inherent
process and for the later communicating of risk to risks and demand different levels of capital and
the employee-base and to shareholders as well as capital provisions. This is particularly important
other stakeholders). As part of this, the business when considering an organization’s approach to
drivers and levels of risk appetite should be agreed regulatory frameworks such as Solvency 2 (a capital
and documented. With risk appetite acting as a adequacy regime for the European insurance sector)
boundary for the organisation to operate within, and Basel 3 (the Capital Requirements Directive
strategic objectives and key risks (see below) are (CRD) is an updated capital adequacy regime for
defined. investment firms), both of which have important
implications on the level of capital held against the
The senior team
risk profile of the specific business units.
sets out what the When considering and applying risk appetite, an
important consideration is its multidimensional
organization is aiming nature (see Figure 2) For example, the amount
of capital an organization is willing to put at risk
to achieve (objectives) overnight is generally very different from the
amount to be put at risk for 90 days, one year, etc.
Thinking about risk appetite as a multidimensional
and the threats and
construct enables a more realistic, robust and stable
approach to risk appetite. It increases the visibility
opportunities (risks)
and transparency around risk taking and of which
risks are acceptable and which are not. Finally it
associated with those
improves the quality of the conversation between
the board and the executive team, setting the “tone
ambitions.
from the top,” and enabling appetite to be cascaded
down the organization.

7 EMBEDDING RISK APPETITE WITHIN THE STRATEGY PROCESS
Manigent suggest that a sub-set of the identified
Risk Appetite Annual risk business drivers, called key drivers are used to
Time Horizons 90 days el of provide a framework for articulating risk appetite
overnight ev and to frame how it thinks about risk assessments
l
extreme (Figure 3). Therefore key drivers serve as a lens
k through which an organization views, discusses,
s
High ri thinks about and assesses risk.
f
o
l
Moderate ve Once the key drivers have been selected and the
e
l time horizon agreed, the various levels of risk taking
low are defined by using common expressions of levels
Type of risk of risk – Low, Moderate, High etc., and providing
concrete definitions of what each level means to the
Credit Market liquidity operational strategic oorrggaanniizzaattiioonn.a lI nri sekf faepcpt ethtiitse bsetactoemmeesn tt.he basis of the
It also becomes the basis for the risk assessment
process, because the same key drivers which are
used to define appetite are used to define how risk
will be assessed in the organization. For example,
if as suggested above Capital is a key driver for a
bank, when the risks faced by the bank are assessed,
they will be assessed on the basis of their impact on
Capital providing a Capital@Risk value.
Using a common set of key drivers for appetite and
the assessment process enables organizations to
align their risk exposure to appetite, thus creating
an environment where risk taking as measured by
risk exposure is managed in alignment with the
organizational strategy as expressed by strategic
objectives and the risk appetite for each objective.
8 EMBEDDING RISK APPETITE WITHIN THE STRATEGY PROCESS
Defining Levels
Risk dimension Time no LoW modeRATe HiGH eXTReme CAPACiTY
of Risk using HoRiZon APPeTiTe LimiT
Key Drivers
CAPITAL Overnight No Capital X % Capital X % Capital X % Capital X % Capital Above
@ Risk @ Risk @ Risk @ Risk @ Risk X £ m
Up to X £ m to X £ m to X £ m to Above
CAPITAL Annual
X £ m y £ m y £ m y £ m X £ m
Up to X Up to X Up to X Up to X
No Bad
REPUTATION Annual Vol. Bad Vol. Bad Vol. Bad Vol. Bad
Coverage
Coverage Coverage Coverage Coverage
Strategy Setting
Stage two in the strategy process is strategy setting. This phase is about translating those
business goals and strategies into a specific set of strategic objectives which the organization will
seek to achieve over the time horizon of the strategy.
Following a traditional performance-only approach, strategy. Some organizations also choose to include
a key output of the strategy setting stage is strategic themes on their Strategy Map. These run
typically a Strategy Map and a supporting set of vertically across one or more perspectives within
performance indicators, targets and initiatives: the map and are used to communicate the 2-3 key
typically a scorecard approach would be used to priorities of the organization (an example being
organise indicators, targets etc. customer management) and they group objectives
related directly to those priorities.
The Strategy Map (figure 4) is one of the most
powerful management tools to emerge in the last 20 The Strategy Map provides a tool for explaining
years. It was developed by Harvard Business School and demonstrating how intangible assets, such as
Professor Dr Robert Kaplan (also the co-creator of people, information systems, culture, processes etc.,
Activity-Based Costing) and management consultant create customer outcomes and ultimately deliver
Dr. David Norton. The Strategy Map is a key part tangible financial benefits for shareholders. A well-
of any strategically focused Balanced Scorecard constructed Strategy Map should be the summary
implementation (somewhat confusingly, perhaps, a of the organization’s “strategic story,” - a narrative
Balanced Scorecard comprises a Strategy Map and a which clearly explains what the organization
scorecard). is seeking to achieve and how it will go about
achieving its strategy. Reaching the level of clarify
Typically a Strategy Map is structured around four
required to enable the development of a clear
perspectives which run horizontal across the map
Strategy Map will ensure that those directly involved
and which communicate the causal relationship
with the development have a deep understanding
within the strategy: Financial and Customer
of, and buy-in to, the strategy. It also means that
perspectives focus on desired outcomes whereas
communicating and engaging those not directly
Processes and Learning & Growth are enablers of
involved will be a more straightforward task.
9 EMBEDDING RISK APPETITE WITHIN THE STRATEGY PROCESS
Example Strategy GROwTh CUSTOMER MANAGEMENT MANAGE COSTS & RISk
Map assembled L Increase P
according to NCIA Grow income in keyP shareholder value R Achieve the lowest P
growth, customer FINA segments R Inschraeraes oef awvearlalegte RP tcoo ssetr ovfe fiunn tdhes i&nd cuosstrty R
management and R
manage costs & USTOME in“ng oPovrsooaodvtli iudvvetaei ol mufinenes a”awnnictdhi a l RP t“r uBsePt remodyv iFvdianelarun”ecdia,l RP “Pcroovsitsd,e ecr movincev ewesni”thie lnotw RP
risk themes C
Drive P P
NAL SSES extphereco usctaieolsenss o f CR Tcnauersgwteo tmo efexfressir siwtninigthg CR Manage the P
INTERPROCE aBwusaielrdge mnmeeasnrskt ebty CRP 3cD6ue0sv tveoilemowpe roas f CRP bafulanndcineg of CR cehbRxarepnadnlnouecilcth &ien n grcee otodwsnutolc ibnrinkye g CRP
&
EARNING GROwTh isntfMroaratmengaaitgcioe a nos uasrse ta CRP sRfienelal- sn&kc siialull opsuoprlo usrtttia otfofn ttsaol CRP perforDmceauvneltcluoer pefo ac used CRP
L
Role of Risk Appetite in Strategy Setting
While distilling the strategy into a handful of risk–taking the organization is also providing an
strategic objectives with supporting indicators, answer to the strategy questions of “What are the
etc., is very important, to borrow from Harvard key threats and opportunities (Risks) related to our
Business School Professor Dr Michael Porter (a strategy,” and “What are the strategic boundaries
noted thought leader in strategy formulation and within which management teams can execute
execution), it is necessary but not sufficient in strategy.”
today’s post credit crunch environment. In addition,
The role of risk appetite at this stage is to ensure
the strategy setting stage should deliver a clear
that the agreed-on strategic objectives and targets
articulation of risk appetite and key risks associated
are defined at a level which is aligned to the
with the chosen set of objectives. This enables
acceptable level of risk, as defined by the board.
the executive team to set out the strategy to the
The executive team might also consider slicing the
organization in a way that goes beyond answering
strategy into themes and consider risk by theme:
the traditional strategy questions of “What are we
this has a powerful effect in ensuring that objectives
going to achieve?” and “What are our performance
and performance targets are set at levels that do
targets?” By setting out the risks to the successful
not promote unacceptable levels of risk taking, and
execution of the strategy and boundaries for
unacceptable behaviours.
10 EMBEDDING RISK APPETITE WITHIN THE STRATEGY PROCESS