Common mistakes in risk appetite – Part 2: The devil is in the detail

This week Tony and John go into more detail about using operational risk software and the common mistakes made in risk appetite work. 

This exert is taken from their book Mastering Risk Management…

There are many reasons to have a risk appetite and many mistakes to be made along the way.  A risk appetite encourages management to be involved in risk management and helps define the role of the CRO.  In some ways, the risk appetite is one of the most crucial parts of the risk management process. 

“Many firms are confused about what risk appetite is and how it can be implemented. There is also frequent confusion between the risk appetite framework, the risk appetite statement and risk appetite limits. Often the framework and the statement are combined into a single document mixing the two concepts and leading to confusion on the subject. In addition, there is uncertainty as to the link between quantitative appetite and qualitative appetite.” Extract from Mastering Risk Management by Blunden and Thirlwell, published in February 2022 by FT International.

Lack of involvement of business lines in limits

In practical terms, it will be the business lines who will be executing the real-world side of risk appetite. It is therefore essential that at least the heads of the business lines are involved in setting the limits. A best practice approach is to involve all business line heads and their direct reports as well as any person who has a significant influence on the limits.  The limits that the board will set will of course be an aggregation of the limits at the business line level or alternatively (and more accurately) the board’s limits will be disaggregated to the business lines.

Lack of recognition of current work providing appetite commentary

In reality, many firms are already carrying out significant appetite work. This is often within the reports that are distributed on a monthly and quarterly basis to senior management and the board. The problem is that the reports are not seen as risk appetite reports but rather as simply the general risk reports. If there is reference to a heat map or to KRI red amber and green levels then there is an implicit reference to risk appetite.

Lack of knowledge of effective reporting for risk appetite

Linked with the above point is the problem of how to construct meaningful and usable reports. There is no point in overwhelming management with data. Reports must be concise, informing and enable action to be taken. 

Lack of appreciation of control appetite

Risk appetite is comprised of the appetite for the risks themselves and the appetite for the controls which mitigate the risks. There is no point in having a low appetite for the risks and yet being unwilling to spend time, money or resources on controls. There is a clear link between a firm’s appetite for control spend and its appetite for its risks.

Lack of understanding of use of Monte Carlo analysis in appetite work

Monte Carlo analysis can be used for many purposes in risk management, not only for the calculation of capital.  Because modelling of risk turns exposure into actual monetary values it is possible to investigate and analyse a variety of exposures. Cost benefit analysis of controls becomes easily possible and with that, of course, a clear statement of appetite for the size of controls versus the cost of them.  Additionally, the exposure to particular risk owners and control owners can be stated and therefore appetite deduced.

Focus on one level of appetite rather than appetite spread over a number of time horizons

Almost all appetite work focuses on a single level of appetite rather than how that appetite may change over a number of time horizons. For example, a firm may have an appetite of £1,000,000 for the total losses in the year but what is it willing to be exposed to in the worst year in three, or the worst year in five or the worst year in 10 or worst year in 25?  Using Monte Carlo analysis, appetite can be investigated and understood not only in the day-to-day work of today but also in the rarely investigated timeframes of expected loss in the future.  This approach enables the firm to truly manage its risk appetite.

Summary

“At first glance, risk appetite can appear either confusing or daunting.” … “a firm could be forgiven for believing that this is one step too far. However, having an appetite is fundamental to the management of risk. If appetite is broken down into its component parts and then analysed one part at a time, appetite becomes both manageable and useful for the business.”  Extract from Mastering Risk Management by Blunden and Thirlwell, published in February 2022 by FT International.

Taken from Mastering Risk Management by Tony Blunden and John Thirlwell and published with kind permission from Pearson Education Published.  Readers of this blog are entitled to a 25% discount on Mastering Risk Management through the following URL: https://www.pearson.com/en-gb/subject-catalog/p/mastering-risk-management/P200000003761/9781292331317   Please use discount code MSTRSK-25