Implementing a Strategic Risk Appetite Statement: A Practical Guide

1. How to define and implement a Risk Appetite StatementConcept | Methodology | Technology IOR Scottish Chapter 2nd Annual Conference Glasgow Caledonian University October 26th, 2012

2. Setting the scene "People know risk appetite is important, and they think they've got it. But the industry is still falling short on how to think about it [Risk Appetite]..." "Our challenge as non-executives is there is no definition. We are dealing with words, not well-understood and agreed concepts. There's no 'hitchhikers' guide' to risk appetite and no agreement there should be one" Tapestry Networks, Inc - Bank Governance Leadership Network, Insights from the non-executive dinners, June 16, 2010

3. Objectives • To provide a practical approach to define and deploying risk appetite as a strategic management tool • Explain the role of risk appetite within the overall strategy process • Outline the steps and process around building a robust Risk Appetite statement Provide a ‘Hitchhikers guide’ to Risk Appetite!

4. The credit crunch and subsequent fall-out is rewriting the rules on strategy execution and risk management

5. Corporate governance weaknesses related to Risk Appetite contributed to the credit crunch Supervisors see insufficient evidence of board involvement in setting and monitoring adherence to firms’ risk appetite. Risk appetite statements are generally not sufficiently robust; such statements rarely reflect a suitably wide range of measures and lack actionable elements that clearly articulate firms’ intended responses to losses of capital and breaches in limits. Board-level engagement in risk oversight should be materially increased, with particular attention to the monitoring of risk and discussion leading to decisions on the entity’s risk appetite and tolerance. Remuneration structures for all such “high end” employees are appropriately aligned with the medium and longer-term risk appetite and strategy of the entity. In essence, the obligation of the board in respect of risk should be to ensure that risks are promptly identified and assessed; that risks are effectively controlled; that strategy is informed by and aligned with the board’s risk appetite; and that a supportive risk culture is appropriately embedded so that all employees are alert to the wider impact on the whole organisation of their actions and decisions.

6. Post credit crunch, UK Corporate Governance Code was updated to be more specific about Risk Appetite The UK Corporate Governance Code issued in May 2010 states that ‚the Board is responsible for determining the nature and extent of the significant risks it is willing to take in achieving its strategic objectives…and should maintain sound risk management and internal control systems.

7. Organisations are increasingly looking to ‘Risk Management’ as a source of competitive advantage 64% Almost two-thirds of Risk Masters 64% indicate that their risk management capabilities provide competitive advantage to “a great extent,” compared with only 42% of the peer set. Neither too cautious nor too reckless, the best companies use their risk management capabilities to adjust either their capacity or their appetite to make more prudent— and ultimately successful— investment decisions. Source: Accenture 2011 Global Risk Management Study

8. Evidence suggests many corporate governance weaknesses and Board level challenges still exist “the Board is responsible for determining the nature and extent of the significant risks it is willing to take in achieving its strategic goals.” UK Corporate Governance Code, 2010 21% “only 21% align their risks with their business strategy” – Grant Thornton Corporate Governance Review 2011 Where the Board need to spend more time… 70% Strategy “results indicate a need to better educate Boards on industry dynamics and how their companies create value...” 42% Execution 47% Performance Management 21% “Only 21% of directors surveyed claim a complete understanding of their companies’ current strategy” – Mckinsey Global Survey – Corporate Governance, 2011 67% Risk Management Approx. 1500 participants

9. The definition of Risk Appetite is clear, but the application is less well understood • The COSO definition provides ‘What, Who, When and Why’ of risk appetite • What: the amount and type of risk • Who: an organisational entity  • When: over a defined time horizon   • Why: to achieve the objectives of the entity Risk appetite is the amount and type of risk that is acceptable to be taken by an organisational entity over a defined time period, to achieve the objectives of that entity – COSO Enterprise Risk Management Risk appetite sets the boundaries within which strategy is executed – Manigent

10. Risk Appetite is a multidimensional construct, which changes depending on the organisational entity and its objectives Annual 90 days Overnight Investment Banking example We are willing to put £x million of capital @ risk to trade on our own account over the next 12 month period. We hold no more than x% of our capital in overnight positions. We will accept operational losses of £x million per month. Extreme High Moderate Low Water Industry example We have no appetite for causing customer illness by supplying poor quality water. We have no appetite for appearing in local press related to leaks or fines for more than 2 consecutive days. Credit Market Liquidity Operational Strategic

11. Risk Appetite Setting process 4. Board appetite setting workshop(s) 1. Joint Board / Executive appetite familiarisation workshop(s) 2. 1-2-1 follow-up meetings 3. Joint risk dimension workshop(s) 5. Joint Appetite setting workshop (s) 6. Joint Board / Executive Appetite sign-off 4. Executive appetite setting workshop(s) • This process is designed to quickly establish the organisational boundaries – risk appetite. • Step 3 can be combined with either step 2 or 4. • Splitting the workshops in step 4 is designed to bring out different views / perspectives, but these can be combined.

12. Defining Risk Appetite in Seven Steps To design a robust risk appetite statement follow these steps: • Identify the Key Value Drivers for the Business • Define Risk ‘Buckets’ based on Key Value Drivers • Define a set of Strategic Objectives • Define and Assess a set of Key Risks • Align Risk-taking to Strategy • Define the Risk Appetite statement • Monitor the Alignment of Risk-taking to Appetite

13. 1. Identify the Key Value Drivers for the Business Identify strengths & weaknesses Business Goals Identify threats & opportunities Internal Analysis External Analysis Is our business model fit for purpose? Is our business model fit for purpose? Business Drivers Formulation Develop the strategic plan Appetite Business Model Business Objectives Distil strategy into actionable objectives with defined appetites Setting Appetite Strategy Are we on-track to deliver? Are we operating within appetite? Continuously align and monitor risk taking to business strategy Execution Performance Management Appetite Risk Management Manage strengths & weaknesses Manage threats & opportunities Appetite Alignment

14. 1. Identify the Key Value Drivers for the Business cont. Strategy Management What are we trying to achieve? What is our Risk Appetite? Performance Management Risk Management Are we on track? Are we operating within appetite? Appetite Governance & Communications Culture

15. 1. Identify the Key Value Drivers for the Business cont. Business drivers Shareholder value Strategy Capital Share price Manage Performance Appetite Manage Risk Income Economic value add Reputation Profit Align Risk-taking to Strategy Communication Governance Appetite Culture

16. 2. Define Risk ‘Buckets’ based on Key Value Drivers Business Drivers Low Moderate High Extreme Capacity Limit Income X% Capital @Risk X% Capital @Risk X% Capital @Risk X% Capital @Risk Capital Up to X £M X £M to Y £M X £M to Y £M X £M to Y £M Above X £M Reputation Up to X vol. Bad coverage Up to X vol. Bad coverage Up to X vol. Bad coverage Up to X vol. Bad coverage

17. 2. Define Risk ‘Buckets’ based on Key Value Drivers cont. Business Drivers Low Moderate High Extreme Capacity Limit Income X% Capital @Risk X% Capital @Risk X% Capital @Risk X% Capital @Risk Capital Up to X £M X £M to Y £M X £M to Y £M X £M to Y £M Above X £M Reputation Up to X vol. Bad coverage Up to X vol. Bad coverage Up to X vol. Bad coverage Up to X vol. Bad coverage

18. 3. Define a set of Strategic Objectives

19. 4. Define and Assess a set of Key Risks The risk of (what, where, when)….. caused by (how) ……resulting in..…(impact/consequences) Examples • The risk of financial deficit at end of year caused by decreased in-patient activity and revenue, resulting in rationalisation of service offerings. • The risk of exceeding A&Ewaiting times, caused by increased demand and staff vacancies, resulting in not meeting community expectations and adverse patient outcomes

20. 4. Define and Assess a set of Key Risks cont. The risk of (what, where, when)….. caused by (how) ……resulting in..…(impact/consequences) Examples • The risk of financial deficit at end of year caused by decreased in-patient activity and revenue, resulting in rationalisation of service offerings. • The risk of exceeding A&Ewaiting times, caused by increased demand and staff vacancies, resulting in not meeting community expectations and adverse patient outcomes

21. 4. Define and Assess a set of Key Risks cont.

22. 5. Align Risk-taking to Strategy

23. 6. Define the Risk Appetite statement Business Drivers Low Moderate High Extreme Capacity Limit Income X% Capital @Risk X% Capital @Risk X% Capital @Risk X% Capital @Risk Capital Up to X £M X £M to Y £M X £M to Y £M X £M to Y £M Above X £M Reputation Up to X vol. Bad coverage Up to X vol. Bad coverage Up to X vol. Bad coverage Up to X vol. Bad coverage

24. 6. Define the Risk Appetite statement cont.

25. 7. Monitor the Alignment of Risk-taking to Appetite Appetite sets the boundaries for the business within which they execute strategy and create value. Therefore the Appetite Alignment Matrix provides a method of visually monitoring and managing our risk taking according to the strategy, identifying where too much or not enough risk is being taken. Reputation @Risk Capital @Risk Impact x Likelihood (over a time horizon)

26. 7. Monitor the Alignment of Risk-taking to Appetite Strategy Map Risk Map Appetite Alignment Matrix

27. Q & A