The role of the CRO in defining risk appetite

Incorporating risk appetite into an organisation’s decision-making framework creates great clarity for management and allows them to be innovative within the boundaries set by law and the board.

It is a very straightforward concept, so I really don’t understand why the professional community still discusses it so much.

Here are some of the key aspects of risk appetite, and how it was integrated into the company where I was a CRO:

Risk appetite imposed by laws, contracts and regulations

Approximately 10% of the time, risk appetite is determined by external factors such as government regulations, market conditions, or industry standards.

Examples include zero-tolerance policies on safety, bribery, corruption, pollution, loan covenants, or sanctions.

”Approximately 10% of the time, risk appetite is determined by external factors”

These are compliance matters and legal, treasury and compliance departments usually already ensure the organisation adheres to these imposed limits and operates within the established boundaries.

As a risk professional, I found I didn’t need to contribute much here.

Risk appetite as a gentlemen’s agreement between the board and management

In another 10% of cases, risk appetite is defined by the boundaries set for management decision-making by the board of directors.

Examples include deal approval thresholds, limits on cash holdings, market risk limits, credit risk limits, or investment restrictions.

”A CRO can help to define what the limits should be given the historical and implied volatilities”

These boundaries help the board maintain oversight while empowering management to make informed decisions.

Here a CRO can help to define what the limits should be given the historical and implied volatilities.

Risk appetite as a risk-reward trade-off

For the remaining 80% of decisions, risk appetite is determined by balancing the risks and rewards of each decision.

To facilitate this, decision-makers should be provided with transparent information about the uncertainties associated with each option.

One common application of the concept of risk appetite is showing alternative decisions against the efficient frontier. When comparing alternatives, it can be helpful to use a risk/return plot to visualise the relative risks and potential returns of each alternative.

”Risk managers should collaborate with internal auditors to verify adherence to limits and assess their effectiveness and practicality.”

This enables them to choose alternatives that offer the most appropriate risk-reward balance according to their individual appetites.

This is the sweet spot for the CRO because it implies that every significant decision has to be supported by a quantitative risk analysis.

To ensure that risk appetite is effectively incorporated into decision-making, boards should encourage risk managers to review and update existing policies and procedures.

In cases where risk appetite has already been established, risk managers should collaborate with internal auditors to verify adherence to limits and assess their effectiveness and practicality.