In the wake of the financial crisis, regulators are paying more attention to how businesses quantify the risk they undertake. What approaches are being taken across the profession?
A common expression in the financial world is risk appetite – the amount of risk an organisation is willing to take in pursuit of its objectives. But its application outside finance is “patchy”, says Wellcome Trust enterprise risk manager Richard Archer. UK risk management association Airmic adds: “Risk management remains a specific, difficult to apply, often ill-defined and much debated topic.”
Theory
There are several reasons for this. One of the main ones is that there’s not much agreement on the implications of exceeding risk appetite, nor whether, having defined one, it will act as a strict ceiling on the size of risk the organisation takes on. Regardless of the fact that their risk appetites were likely to have been formally defined, in the run-up to the financial crisis, banks were clearly biting off more than they could chew. The size of their appetite had no bearing at all on how much risk they were gobbling up.
In light of this, evidence suggests that regulators are now focusing much more attention on risk appetite and how it is linked to strategic decision-making.
“For the risk appetite concept to have teeth, it must be enforced by the board,” Archer says. “But it is easy to see how the risk appetite statement could be ignored if it conflicts with the chief executive’s preferred strategy. It is also possible to circumnavigate the risk policy by incorrectly downgrading risks or not allowing risks to be upgraded.
“Another issue is that managers may favour palatable risk appetite statements over truthful risk appetite statements,” Archer adds.
Both of these dirty tricks seem to have been systemic in the run-up to the financial meltdown, which allowed risks to escalate out of control.
There are other factors holding some companies back from adopting the risk appetite concept. Some might be concerned that the risk appetite statement will enter the public domain and be used against the company, explains Archer. “A national railway operator could expect some negative reaction if it stated explicitly that it was willing to accept any safety risk,” he says.
Practice
Given all these issues, where is the value in the risk appetite concept? And is it actually worth the stress?
Amlin head of risk management Alex Hindson believes it is. “It is core to how we manage risk in our business,” he says.
“We have a risk appetite framework based around six key risk categories: operational, strategic, insurance, market, credit and liquidity. This is linked to our risk management framework. Risk appetite is a key element linked to accountabilities of risk owners.”
Risk appetite statements can be prepared with inherent (without controls) or residual (with controls) risk exposure limits, explains Archer. “Those who favour inherent risk exposure argue that it is a more conservative measure. Those who favour residual risk exposure argue that this is better as it is the level of risk actually faced.”
Archer adds: “The risk appetite statement is only of value if the risk exposure is known. To produce an accurate estimate of the risk exposure, it is important that all significant risks are identified (without double counting) and evaluated correctly – which is a challenge.
“We only quantify investment portfolio risks, which, due to their financial nature, are possible to quantify. Otherwise, we assess risk qualitatively.
“The difficulties in estimating hard-to-quantify risks, especially reputation risks, are a major barrier to developing holistic risk appetite statements. After all, you can’t quantify the unquantifiable.”
Hindson takes a slightly different approach. “We don’t quantify risk appetites specifically. These are high-level statements of risk preferences. Supporting appetites,
we have specific measurable risk tolerances (the limits to which risks need to be controlled), which are set at group level and cascaded to each business and are what we hold risk owners to account for managing their risks within.”
He is convinced of the benefits. “Risk appetite brings visibility and transparency of risk governance. We are also linking risk appetite to the allocation of capital and hence to business planning and return on equity considerations.
“We want to understand whether we are being adequately rewarded for the risks we take, and understand the trade-offs and return on the risk taken.” SR
