5 Steps towards an Actionable Risk Appetite

Defining Risk Appetite and Risk Tolerance

According to the IIA, both risk appetite and risk tolerance set boundaries of how much risk an entity is prepared to accept, but there is an important difference between risk appetite and risk tolerance. Understanding this difference is crucial for developing an effective risk program that actually helps your company’s performance, as well as tracking its effectiveness over time.

Risk Appetite vs. Risk Tolerance

Risk appetite is a higher-level statement that considers the broad levels of risk that management deems acceptable. A risk appetite statement sets a course of action, or goal, based on what the organization would like to achieve. Risk tolerances, on the other hand, set acceptable levels of variation in performance that can be readily measured.

For example, a company that says it doesn’t accept risks that could result in a significant loss of its revenue base is expressing a risk appetite. When the same company says it doesn’t wish to accept risks that would cause revenue from its top customers to decline by more than a fixed percentage, it is expressing a risk tolerance.

Here are a few more examples of risk appetite and risk tolerance statements.

Our first example looks at a health service organization. This organization’s risk appetite, as you can see, is a high-level statement that simply sets standards on where they’re willing to accept risks. Their risk tolerance statement is much more granular, going as far as to set levels of acceptable patient wait-times.

In our second example, we’re looking at a company in the finance industry. For a risk appetite, management has decided it is willing to accept small losses in 15% of investments it has deemed ‘risky.’ Again, this risk appetite is more high-level and less granular than the risk tolerance, which states the company can’t lose more than 75% in over 5% of its investments, along with not losing more than 25% in over 30% of its investments.

Let’s look at a graphic representation of risk appetite and risk tolerance. In the charts below, the organization’s projected path of performance is plotted in green. This line and the immediate area around it represent the risk appetite or goal of the organization. If the organization was to pursue or retain all risks in their environment, their performance could fall anywhere between the grey lines. Most organizations are uncomfortable taking on all available risk, and new laws and regulations require companies to implement more narrow tolerances, which is highlighted in blue.

Operating within risk tolerances provides management greater assurance that the company remains within its risk appetite, which in turn, provides a higher degree of comfort that the company will achieve its strategic objectives.

Before we leave the subject of actionable risk appetites, we’d like to show you another way to leverage risk tolerance statements. First, you can use your risk tolerance level as a “cut level” to better determine which risks require more resources and attention.

Conducting a gap analysis with a risk tolerance level will help you identify emerging risks before they rise out of tolerance and it becomes clear that certain mitigation activities are no longer sufficient. Every day, process owners are making operational decisions about risks without reading their organization’s risk appetite statements. This means that process owners must evaluate their assessments and, if a risk exceeds a set tolerance, adjust mitigation activities, procedures, or controls to get within the tolerance.

Over time, risk tolerances will align overall risk appetite and strategic goals, improve risk mitigation effectiveness, and allow you to achieve your strategic goals. Aligning your tolerances with risk appetite and strategic goals can be challenging, but trending risks over time allows you to get a more accurate picture of where you are and where you need to be.

There is a lot that goes into the formation, implementation, and monitoring of risk appetites and tolerances. To simplify the process, and make it as applicable as possible, we have outlined the five most important things to consider when putting risk tolerances into action.

Your organization’s goals can be categorized in many ways. To create an actionable risk tolerance, we divide organizational goals and risk tolerance into 3 areas with a top-down approach:

• Strategic
• Tactical
• Operational

Consider this very simplified example of how to create an actionable risk tolerance at the strategic level:

Start from the top with your strategic goals and create a risk appetite statement as it relates to those goals. Here we see a risk appetite statement relating to a company’s goals for market share growth. The statement is general and discusses the type of risk an organization is prepared to pursue:

“[The Company] will take risk in the pursuit of strategic success, but only if those risks align with strategies to meet market share growth objectives by the end of Y year.”

This is a high-level strategic goal – a vision of where management sees the company down the road. From here, we can move on to an associated tolerance range. In this case, the target market share is 30% by the end of Y year, with a tolerance that ranges from 20% to 40%.

At this point, our risk appetite statement is linked to strategic goals. Achievement of these goals will ensure the organization is within its risk tolerance.

Every day, throughout every organization, front-line managers make operational decisions involving risk. These lower-level management decisions can be the most frequent, as well as most impactful, decisions made within a company. Implementing risk tolerances at this level is vital. By doing so, you are connecting front-line decisions with the organization’s overall goals and risk appetite. This process begins by translating strategic goals to the tactical level.

Tactical goals describe high-level activities which facilitate the achievement of strategic goals. In this case, the strategic goal is to increase US market share to 30%. At the tactical level, the company will accept risks that align with these strategic goals, specifically related to new market entry. In this case, the company aims to enter 3 new markets, with a tolerance range of 2 to 4. This represents a risk tolerance at the tactical level, closely linked to strategic objectives:

“[The Company] will take risks in the pursuit of strategic and tactical goals, only if those risks align with the tactical objective to expand US market presence during Y year.”

Now, we take it to the operational level. This level covers short-term, specific goals that facilitate tactical and strategic objectives. By looking at operational activities within the organization, we can determine goals as well as associated control activities and risk tolerances. In this case, the company is willing to take risks that align with both strategic and tactical objectives. The Company focuses on specific operational activities which will allow these goals to be achieved:

“[The Company] will take risks in the pursuit of strategic, tactical, and operational goals, but only if those risks align with operational objectives for employee hiring and training and efficiency in operations.”

Managers then create tolerances around these operational goals, in this case around staffing and performing market analyses. Since these operational goals are tied in closely to tactical and strategic goals, managing activity at the operational level ensures achievement of strategic goals. This is the benefit of “translating risk appetite to the process level. This process relies on engagement from managers at each level of the company.

The example covers very high-level activities. In initial assessments, operational activities can be as granular or as high-level as is appropriate to demonstrate value to your board or senior leadership. By linking to higher-level operational activities, you can easily establish relationships between general business process areas and strategic risk tolerances. By identifying more granular activities, you can begin to gain tighter control and more oversight over your risk levels relating to strategic risk appetite and tolerance. Both of these approaches lead to better business decision-making as a result of your ERM program.

Once risk tolerances are established around front-line processes, you then need to decide on the appropriate metrics to track and measure success. To do this, you need to be monitoring the root causes of risk at every level.

For example, say your risk appetite sets a low tolerance for customer dissatisfaction. Here, a logical metric to track would be customer satisfaction levels over time. You might choose to implement customer surveys to measure these levels. Methods like these, however, fail to address the heart of the problem. No matter what the survey results say, you are only measuring satisfaction against predetermined dimensions. You’re still missing ways to catch unidentified root causes of the problem, which could bring about actionable solutions for raising customer satisfaction.

Instead, it is best to track the specific root causes of customer dissatisfaction. Looking at factors like call wait time and email response time provides insight that can be acted upon, allowing you to adapt business processes and meet organizational goals. While these factors contribute to the high level of customer dissatisfaction, they are not the root causes of the problem. Through risk assessments, all three factors can be traced back to one central issue: poor employee training. Once a root-cause risk is identified, mitigation activities and controls are put in place, and the organization works to improve business processes and eliminate the associated problem.

Another roadblock in being able to apply risk tolerances in an actionable way comes from the way current risk mitigation activities are collected and reported. Typically, metrics collected around risk only measure what has happened to date, and do not provide many insights into recurring patterns that could affect your tolerances. Establishing more forward-looking points of reporting will allow you to detect emerging trends long before they have significantly impacted your organization.

Let’s go back to our example of wanting to increase customer satisfaction. Avoid using tools like surveys and yes-or-no testing for monitoring mitigation activities, such as how often employees have customers on hold for 2 or more minutes. These types of collection methods only test compliance with internal policies, which may or may not tie back to the specific risks that the policies were designed to mitigate.

When tracking an identified root cause of a problem, like unsatisfactory employee training, make sure you’re measuring it in the right way. Tracking counts of complaints against employees alone is not comparable over time or across products because the number of total customers will always vary. Instead, measure and compare root causes in percentages. For example, compare the percentage of customers who complain after interacting with employees who completed an advanced training program to those who only completed an older, less comprehensive, training program.

To help make choosing the right metrics easier, employ a risk-based balanced scorecard approach for identifying the correct root causes of risk. A balanced scorecard is a management system that enables organizations to clarify their vision and strategy, and then translate it into action. It provides feedback around both the internal business processes and external outcomes in order to make sure you are continuously improving strategic performance and results at every level. When fully deployed, the balanced scorecard transforms strategic planning from an academic exercise into the nerve center of your enterprise.