After completing this reading, you should be able to:
- Describe best practices for the implementation and communication of a risk appetite framework at a firm.
- Explain the relationship between a firm’s risk appetite framework and its risk culture, and between the risk appetite framework and a firm’s strategy and business planning process.
- Explain key challenges to the implementation of a risk appetite framework and describe ways that a firm can overcome each challenge.
- Assess the role of stress testing within a risk appetite framework, and describe challenges in aggregating firm-wide risk exposures.
- Explain the lessons learned in the implementation of a risk appetite framework through the presented case studies.
Risk Appetite – Definition
Several definitions exist that explain what risk appetite is, but they all bring out the same concept. One definition is that risk appetite is: “a firm’s view on how strategic risk taking can help achieve business objectives while respecting constraints to which the organization is subject.”
Another definition says that “risk appetite is the amount and type of risk that a company is able and willing to accept in pursuit of its business objective\es.”
The creation and implementation of a robust risk appetite framework is a crucial part of any risk management practice.
To define a company’s risk appetite, one needs to come up with a document called a “statement of risk appetite”. This is the document that outlines and brings together the needs of all stakeholders by acting both as a governor of risk and a driver of current and future business activity.
The statement of risk covers all risk, in both qualitative and quantitative aspects.
A risk appetite framework is, therefore, a structure that is put in place to outline a firm’s approach to the management, measurement, and control of risk.
Best Practices for the Implementation and Communication of a Risk Appetite Framework
Time and Resources
A good risk appetite framework will require time and significant intellectual and financial resources.
A recognition by the firms’ leadership of the need to strengthen risk management and governance arrangements ensures that the necessary resources are made available. The leadership needs to understand that creating and implementing a risk appetite framework is not to simply meet regulatory requirements.
Different firms are at different stages of developing and implementing their risk management frameworks. There is also a wide range of approaches that are being adopted.
This is because each firm has a different business model, structure, and degree of complexity.
No one risk appetite framework fits all organizations. While some practices do cut across various organizations, diversity of approach is inevitable and should not be discouraged. Supervisors and risk management heads need to be alert to this and avoid insisting on formulaic solutions that may not be aligned with business needs.
Effective Communication and Training
Communication and education on the benefits of a risk appetite framework are essential.
Members of senior management need to be visibly and consistently associated with these.
Business unit heads must own local business plans, which in turn must pay proper regard to risk. This, including the link to the wider risk appetite, should be clearly and consistently communicated to staff.
Continuous and open dialogue about risks is also key in effectively embedding risk appetite in the business lines.
When this dialogue about risks—within and across business units and with risk and senior management—works well, it facilitates both intelligent challenges to the risk appetite boundaries and their evolution over time. In this way, the risk appetite framework is made dynamic and is able to sensibly accommodate new business opportunities over time.
Comprehensive View and Coverage of All Risks
To be effective, the risk appetite framework needs to incorporate all material forms of risk, including those that are not readily quantifiable.
Firms should make a maximum effort to quantify such risks, making use of such innovative approaches as estimates of earnings foregone.
Maximum use should also be made of proxies and other metrics, even where these do not permit the direct quantification of losses. Quantification and the development of proxies need to draw on operational risk frameworks.
A well-functioning risk appetite framework is one that is pervasive throughout the organization. Attempts to introduce risk appetite as a remote and disembodied aspect of risk management have tended to fail.
Incorporation with Culture, Governance & Business Strategy
The process has been much more successful where it has been recognized that risk appetite needs to be intimately bound up with corporate culture, corporate governance, and strategy and planning as well as risk.
Boards have an integral part to play in the definition and monitoring of risk appetite and the interchange with management, risk management, and the business is crucial in this.
Board members need to be properly equipped to engage fully with risk and risk appetite. They need to understand generic risk concepts and the relevance of these to the business. They also need to have access to the information and expertise necessary to enable them to develop a good understanding of the risk profile of the firm.
They should insist that the material provided to them strikes the right balance between providing a comprehensive macro perspective and illustrating the required level of detail.
Board members should be proactive in insisting on proper support from management and risk management professionals, in terms of education on risk concepts and approaches, technical briefings, and updates on the risk implications of products and activities.
The Board needs to establish the framework for risk, typically through the articulation of a clear and meaningful risk appetite statement. This is likely to include several key metrics as well as clear qualitative guidance with respect to less quantifiable risks.
Board members need to ensure that risk appetite is used in a dynamic and iterative way.
An effective risk appetite framework extends far beyond a mechanism that simply creates limits. Instead, it involves a dynamic or iterative process in which the Board provides a clear statement or set of signals regarding its preferred risk/return trade-off. Such an iterative approach results in Board members having other significant challenge functions. This challenge is essential to ensuring that the risk appetite framework is neither too rigid nor too flexible.
These challenge functions include, but are not confined, to:
- Making sure that mechanisms are in place to ensure that new business initiatives, transactions, or products are consistent with the enterprise-wide risk appetite, and that the risk implications of these are fully understood before the activity proceeds.
- Ensuring that mechanisms are in place to monitor and manage risks that are not readily quantifiable e.g. reputation and legal risks, and that their level is consistent with overall risk appetite.
- Ensuring that stress testing is undertaken in a rigorous and comprehensive way and that the Board can assess the results in the context of the risk appetite framework (more on this below).
In general, an effective risk appetite framework is indissolubly linked to the culture of an institution. There are no simple measures of risk culture, and it is a key responsibility of Boards to understand and shape this culture.
A Good Risk Management Team
Development and maintenance of an effective risk appetite framework is a shared responsibility, with risk management staff playing an essential role in the process.
Risk management needs to be actively involved at multiple levels in the development of the risk appetite framework. They should provide clarity of concept and definition and support in understanding the implications of the risk appetite statements and metrics as they develop, through the necessary coaching and training.
An effective risk appetite framework covers all risks, and it is important that risk management work with all stakeholders in developing the right balance of appropriate quantitative and qualitative metrics.
Risk appetite is an iterative process that requires perseverance. It is worth noting that the challenges faced early in the process are different from those experienced later. At all stages, it is important for risk management to ensure full engagement by all key stakeholders, including the Board, senior management, and risk practitioners.
Risk management must allow the businesses to take charge of the process of developing line-of-business-level risk appetite statements. This means the business unit leaders themselves, not the embedded risk management staff within the business units.
Risk management needs to provide the appropriate infrastructure and controls to support the ongoing maintenance of the risk appetite framework. This includes comprehensive and timely reporting to senior management and the Board to provide clear reference to the current risk profile and to make the framework itself both real and relevant. Ongoing reporting of the firm’s risk profile relative to the agreed-upon risk appetite—and how this is changing—and repeated/iterative discussions of the evolving frame-work itself, will help to build both “pattern recognition” and acceptance of the framework as a useful tool.
Education and communication are areas in which it is vital for risk management to participate on an ongoing basis. It is necessary to effectively communicate the key elements of the design, implementation, and maintenance of the risk appetite framework to all stakeholders internally and externally. It also is important that the Board be able to address questions raised by shareholders and regulators alike as to the appropriateness of the nature and quantum of the risks being assumed, both individually and in aggregate, and how senior management is challenged in this regard
Stress Testing and Monitoring
Risk appetite needs to be viewed in the context of both normal and stress conditions. Risk management needs to be capable of providing both perspectives and facilitating the appropriate discussion at the Board level with regard to the potential impact on business strategy and planning.
Risk appetite should also be monitored on an ongoing basis at the group level and that a contingency plan or escalation procedure is triggered when a risk appetite metric is exceeded.
Relationship between a Firm’s Risk Appetite Framework and its Risk Culture, and the Firm’s Strategy and Business Planning Process.
Risk Appetite Framework vs. Risk Culture
The risk appetite framework forms the link between risk governance and risk culture. It also enhances risk awareness in a firm. While risk culture is advised by individuals’ personal views and biases towards risk as well as the firm’s traditional views towards risk, risk appetite framework comes in to define what is acceptable within that risk culture, and what is not.
Risk culture comes from the norms, habits, and traditions of employees within a firm that determine how they view, understand and manage the risks that the firm is faced with. It affects how the employees view and receive any risk appetite framework that the firm attempts to implement.
The interaction between risk appetite framework and risk culture can be summarised as follows:
- Firms that have a strong risk culture tend to have a more straightforward experience than others in implementing a risk appetite framework. At the same time, an effective risk appetite framework can help to consolidate and reinforce a good and strong risk culture whereby employees and the firm’s management feel encouraged to do the right thing.
- Existing traditions and structures also contribute to the interaction between risk culture and risk appetite frameworks. In companies where there is traditionally a less direct link between profit/return and employees’ remuneration, risk appetite may be easier to introduce and implement within the organization.
- The steps for getting the culture of risk appetite right are similar to those for getting overall risk culture right.
- With the right intentions and actions, the implementation of a risk appetite framework can act as a powerful reinforcement to a strong risk culture. It is not a substitute for proper systems, controls, and limits, but it does supplement and motivate these and may even enhance compliance.
- Firms with strong risk cultures that provide staff with guidance for their own behavior and what to look for are much more effective in the implementation process. This is particularly important when developing appetite statements around those risks that are less quantifiable (e.g., operational risk, risks of legal or regulatory non-compliance, and reputational risk).
Risk Appetite Framework vs. Business Strategy and Business Planning Process
Risk appetite articulates the level of risk a company is prepared to accept to achieve its strategic objectives. Risk appetite frameworks help management to understand a company’s risk profile, find an optimal balance between risk and return, and nurture a healthy risk culture in the organization.
Risk appetite is about the organization being clear and making clear to others its desired level of risk. This, in turn, informs the planning and risk-taking decisions of the business units. Decision-makers, while continuing to be bound by policies and limits, have a clearer understanding of why the policies and limits are as they are.
Implementation of an effective risk appetite framework is highly dependent on visible support from senior management.
To be effective it is essential that senior management set the tone and lead the discussion regarding risk appetite. Senior management must be seen as taking a leadership role in articulating the importance and benefit of risk appetite throughout an organization.
The creation of an enterprise-wide risk appetite framework is an iterative process involving the Board, senior management, and risk management staff. At the heart of the process is an ongoing dialogue, and senior management should expect to be challenged by the Board as to what is being recommended, including risk/return tradeoffs and regular close scrutiny and discussion of all aspects of the firm’s risk profile under stressed conditions.
It is an absolute requirement that the business (and not just risk management) take ownership and drive the development of line-of-business risk appetite and profile. It must be recognized that risk appetite does not belong to the risk management staff and is not simply another way to set limits and constrain business.
Senior management needs to ensure that the risk appetite framework includes full consideration of and appropriately reflects business strategy. It is important that the Board and the market understand that the senior management takes risks in areas that are central to its key strategies and businesses and that losses in those areas, while not positive, are expected and understood as a likely outcome in both normal business conditions and under a difficult market/stress scenario. Smaller and more peripheral businesses, by contrast, should not be a source of significant losses.
It is important that senior management understands and accepts how the risk appetite framework will apply to its activities and impact any initiatives, growth plans, or acquisitions that may be under consideration. The strategic planning process must include discussions relating to risk appetite and profile. While risk appetite needs to become a fundamental driver of strategy and of front-line business decisions, it should be accepted that it will take time and effort to get this to a point at which business unit leaders and risk managers are comfortable with the process.
Business leaders must ensure that risk metrics adequately capture and reflect all material risks of their business. These metrics should be meaningful and pertain to their key business and risk drivers. Similarly, the businesses are responsible for putting appropriate controls in place to effectively manage their risks, so as to ensure that they do not exceed their defined risk appetite.
The establishment of an effective link between the risk appetite framework and the strategy and business planning processes is fundamental.
The firms that have made the most progress in this typically followed a process that involved some variation of the following:
- The Board set key, top-level principles and risk parameters for the overall risk appetite at the group level.
- Use of these guidelines by the business units in drafting their own, divisional business and budget plans. In some cases, this involves the creation of local risk appetite statements. In others, it involves the articulation of a risk “posture” that indicates whether risk is expected to increase, decrease, or remain constant in the business unit.
- Ensuring that, whatever the form of the local plan, it embeds and is fully consistent with the high-level risk appetite statement or principles.
- Individual and aggregated assessment at the group level of proposed business and budget plans and comparison with the group risk appetite.
- Revision and amendment as appropriate of divisional level plans and budgets—or, in some cases, group risk appetite.
Checking back with the risk appetite framework and adjusting as necessary—was observed to be the key and an important method to creating essential alignment between the divisional and business unit plans and the group risk appetite statement.
This process also builds common awareness of the inter-action and tradeoffs between key risk appetite constraints and revenue opportunities. Some firms have found the use of standardized formats for setting out strategic plans incorporating mandatory sections on risk profile and risk appetite to be useful mechanisms for ensuring that these issues have the appropriate prominence in the planning process.
The value of a stronger link between risk appetite and business-level planning was summed up by one company as “Building of the consideration of risk appetite into the group’s strategic planning process has been a significant step forward and has given both management and Board transparency either to amend the strategy to align with the existing appetite or the appetite to allow for the proposed strategy over decisions.”
Key Challenges to the Implementation of a Risk Appetite Framework
- Poor Communication
- Lack of Proper and Adequate Training
- Initial Resistance & Skepticism: The benefits of an effective risk appetite framework, while very real, are often not apparent to more junior staff and, indeed, there may be some initial resistance or skepticism among these groups.
- Lack of a Comprehensive View of Risks: Expressing risk appetite in a way that covers all relevant risks is also proving a challenge for firms. This is particularly true with respect to risks that are less quantifiable and require a more qualitative approach. Once the process moves beyond traditional credit and market risks—where historical data is abundantly available—to focus on reputational, strategic, and operational risks, significant challenges remain.
- Weak Risk Culture
- Lack of Involvement from the Senior Leadership
Overcoming the Challenges Associated with Implementing Risk Appetite Frameworks
Communication & Training
Effective internal communication that makes risk appetite directly relevant to employees in the business units is seen as a major challenge by all participating banks.
An effective risk appetite framework should be pervasive throughout the organization in that all staff with any significant decision-making authority should understand the institution’s stance toward risk and what it means for them.
For this reason, communication and training are essential starting points.
Effectively cascading the risk appetite framework throughout the firm and embedding and integrating it into the operational decision-making process is clearly the largest challenge for almost all firms.
The firm’s senior management, particularly the Chief Executive Officer needs to be personally involved in promulgating the message about the risk appetite framework and what it means.
There needs to be complete agreement within the Board and management on a meaningful and comprehensive definition of risk appetite, and the concepts need to be communicated in a straight-forward way without jargon. There also needs to be clarity in communications about where risk appetite fits alongside risk capacity or tolerance, that is, how much risk it is technically possible to take, and the current level of risk being taken.
Finally, there needs to be clarity regarding the ownership of risk. The risk function should own the overall risk framework and the interface with the Board on risk appetite. However, responsibility for risk within the business units and for achieving consistency with the enterprise-wide risk stance rests squarely with business unit heads.
The link with the wider risk culture is of central importance but is also problematic in some firms.
Broad discussion among firms reinforces the point that without a strong risk culture success on the risk appetite journey is extremely difficult, if not impossible, while it is easiest to implement an effective risk appetite framework where there is already a strong culture around risk.
A strong culture implies that staff understands what is required of them with respect to risk and why, and where such a strong risk culture exists it may be possible for firms to place less reliance on narrow compliance with limits and processes.
Nevertheless, even the strongest culture needs to be supported with good systems, controls, and limits.
It is also necessary to establish a strong link between risk appetite and compensation. At the simplest level, this can be an assessment of whether business results and key performance indicators have been achieved by operating within limits and in accordance with the behaviors and culture described and embedded within the risk appetite. Where this is not the case remuneration incentive awards should be moderated or adjusted accordingly.
Expressing Risk Appetite in a Way that Covers All Relevant Risks
This is particularly true with respect to risks that are less quantifiable and require a more qualitative approach. Once the process moves beyond traditional credit and market risks—where historical data is abundantly available—to focus on reputational, strategic, and operational risks, significant challenges remain.
However, it is widely recognized that a risk appetite framework cannot be confined to risks that can be easily measured.
To be meaningful, risk appetite needs to take a comprehensive view across a firm, and risk appetite statements need to capture and include those risks that cannot be easily quantified.
The Role of Stress Testing within a Risk Appetite Framework
How can appropriate levels of risk be determined for individual businesses and in aggregate for the group in total?
It is crucial to consciously constrain aggregate risks in advance to ensure a firm’s survival under severe stress scenarios. A comprehensive, enterprise-wide stress testing mechanism is a key part of a fully effective risk appetite framework.
The senior management and the Board need to carefully analyze and understand the likely distribution of potential outcomes that would be experienced over time under a variety of severe, but plausible economic and market scenarios and to determine what level of loss would be tolerated under each of these scenarios.
Stress testing involves a combination of macroeconomic scenarios and changes in market variables, to understand financial outcomes for the group, including potential credit and market losses and the likely reduction or loss of business revenues under severe economic and market scenarios.
It is also a requirement by national regulators to carry out stress testing.
It enables the management to assess and determine the implications for the firm.
Results of stress tests need to be linked to key objective variables e.g. P&L and illustrate explicitly how outcomes for these would comply with risk appetite boundaries through time.
Challenges in Aggregating Firm-Wide Risk Exposures
Risk appetite aggregation defines the process through which an organization decides whether the risk appetite boundaries set by the individual business, on aggregate, fit within the organization’s overall risk appetite. It checks whether the boundaries set align with the organization’s risk appetite framework.
Some of the challenges experienced in executing this process include:
- The inability of capital measures to capture and reflect non-quantifiable risks.
- The challenges of determining the appropriate treatment of risk concentrations and diversification within and between risk types.
- The difficulty of directly linking capital measures to specific macroeconomic stress scenarios.
- The inability of capital measures to capture the liquidity dimensions of risk, which are so crucial for understanding potential losses in severe scenarios.
- The non-intuitive nature of capital measures. Experience has shown that it is difficult to get senior managers and directors to engage in a meaningful way with statistical variables and capital measures (e.g., Value at Risk at 99% or 99.95% confidence levels) and use them with confidence in the risk appetite process. The experience of several firms has been that it can be easier to get active engagement from senior management and directors around specific macroeconomic scenario assumptions.
For these reasons, it is difficult to determine an acceptable level of aggregate risks using capital measures alone. This is one reason why, in addition to capital and liquidity measures, leading banks in certain jurisdictions are increasingly using a variety of stress testing processes.
Some ways that have been tried and tested in combating these challenges are outlined below:
- All risks should be included in the aggregation process, not just those that are quantifiable, such as market, credit, and liquidity.
- For risks that are quantifiable, comparison of the enterprise-level limit framework to the aggregation of business unit limits—including single name, Industry concentration limits or economic and regulatory capital allocation—is an effective and practical measure of alignment.
- Attention to the diversity, quality, and stability of earnings across the enterprise is essential;
- Aggregation should identify areas of excessive risk concentration. In this regard, it is also important that when aggregating risk, over-reliance not be placed on a potential diversification benefit. Recent history has proved that in times of crisis, diversification of risk often fails in practice.
- For all risks, the aggregate view of risk posture is helpful in determining how an organization is approaching risk overall. If, for example, the individual business units are each willing to take on more risk in the coming year, comparison of risk posture at the platform level is a simple cross-check to determine if senior management has that same awareness.
Lessons Learned in the Implementation of a Risk Appetite Framework through the Presented Case Studies
- RBC – May 2011
- National Australia Bank
- Scotiabank – A Canadian Experience May 2011
- Commonwealth Bank of Australia
Developing a Risk Appetite Framework at RBC – May 2011
Work to formalize RBC’s enterprise risk appetite began in 2006. It was executed as part of the annual process to benchmark and refresh credit risk and market risk limits.
An initial presentation on risk appetite was made to the Risk Committee of the Board of Directors to gain feedback on the approach to articulating RBC’s risk appetite, and confirm areas of priority.
These are the highlights from the RBC case study:
- Strong support from the Board of Directors, Chief Executive Officer, and senior management.
- The emphasis on risk appetite as an enterprise priority been framed and accepted as a critical element to advance their strong risk culture.
- Repeated iterations with stakeholders were helpful in gradually building pattern recognition, senior management buy-in, Board of Directors’ support, and confirmation of the central components of our Risk Appetite Framework.
- Risk appetite development was led by the CRO, with ongoing facilitation by senior executives in Group Risk Management and engagement with business segments. They began to build business segment ownership of business segment—level risk appetite by integrating risk appetite with business strategy.
- A flexible approach was required because one method would not be fit for all businesses and stakeholders.
- The risk frameworks contained straightforward terminology that could be generally understood by all stakeholders. They avoided overly technical and complex discussions about risk with the Board and senior management and focused their discussions within the context of real and current issues for the institution.
- The business segment statements of risk appetite were quite focused and business driver-specific, for example, concentration risk for certain sectors, acceptable earnings volatility, and levels of capital at risk.
- It was initially challenging to achieve clarity on what risk appetite means and how it is used to drive management decisions.
- Board and senior management decisions implied a high-level risk appetite; however, it was initially challenging to gain consensus and concisely articulate risk appetite for the enterprise.
- Iterative discussions on the framework and ongoing reporting of risk profile helped improve their definition of risk appetite and build understanding and acceptance with senior management and the Board.
- By articulating risk appetite at both an enterprise and business segment level, they managed to achieve an effective combination of top-down constraints and business-specific risk drivers. The linkage between the enterprise-level constraints and the actions of businesses to grow or change risk profile became clear. Ownership of issues also became clearer.
- Risk appetite and risk profile are effective communication tools. Increased transparency and reporting on these matters facilitated internal alignment among business and functional leaders, and supported effective decision making.
- The enterprise risk profile provided a consolidated view of risk concentrations and deficits to ensure alignment between actual risk exposure and target risk exposure.
- The Risk Appetite Framework and risk profile have also been very helpful in conversations with the Board, regulators and rating agencies.
- Risk appetite became increasingly integrated into their business strategies and planning processes so that strategies are developed and approved in the context of risk appetite.
They are embedding into their annual strategic planning process analysis of how growth objectives, degree of planned change and “risk posture” may impact business segment risk profile and risk appetite.
Risk Appetite within National Australia Bank: An Ongoing Journey
The setting of risk appetite within the National Australia Bank currently manifests itself in two key ways. Firstly, the framework by which the Bank determines its risk posture is strongly aligned to, and informs the planning process. Secondly, the statement of risk appetite (the Risk Appetite Statement (RAS)) and its three elements (“posture,” “budget” and “settings,” described below) sets out the Bank’s capacity for taking on risk and the settings associated therewith.
Highlights and lessons from The National Australia Bank case study:
- Fostering leadership of the debate on risk appetite from the CEO, the CRO and the Board Risk Committee;
- Fostering a receptive internal environment. The organization has worked hard on its culture over time and has a strong emphasis on teamwork, collaboration and enterprise thinking. This, alongside the wake-up call issued to all parties associated with the financial services sector (arising from the global financial crisis and its aftermath), has enabled more sophisticated and planned discussions and analysis on the forward outlook for risk and the environment and our response through posture, appetite, and strategy;
- Identifying a single, dedicated team with accountability for the RAS and the broader framework has allowed them to attain consistency in approach and provide the impetus for innovation;
- Separating discussion of risk appetite into three parts, each of which is linked but serve a different purpose: risk posture, risk budget, and risk settings;
- Integrating the risk appetite and RAS with the strategic and financial planning process;
- Increasing the dialogue with the business units around their view of risk posture;
- Delivering three RASs to the Board with the cycle and content linked to the planning process. This has allowed for more regular Board discussion on risk appetite and has reinforced the link between risk appetite and the business strategies and plans. The Board now sees more careful consideration of the implications of proposed actions and activities on the Group risk profile and its relation to the Group Risk Appetite and evidence of risk appetite thinking in its discussions with management;
- Supplementing the RAS and associated discussion with risk workshops and targeted risk papers for the Board, has assisted the Board in linking risk appetite to the business activities and the portfolios;
- Engaging with the Regulator;
- Identifying key stakeholders in the business to champion risk appetite discussion; and
- Maintaining the ongoing commitment of key stakeholders such as the Board and senior executive.
- Balancing the desire for quantitative or prescriptive criteria to define risk posture with the flexibility and generality that qualitative, “principles-based” definitions provide.
- Choosing the appropriate metric for each application. For example, economic capital is the metric for risk “budgeting” across the Group, but other metrics are more useful for other applications, such as exposure limits, trading desk limits, industry or country credit exposure limits, etc.
- Whilst used as the measure of risk budget, the use of economic capital remains a challenge.
- Balancing coverage of credit risk with other material risks (e.g. operational or reputation risk), which are less easily quantified or described.
- The key for National Australia Bank in advancing the risk appetite framework has been:
- Identifying dedicated resources for accountability;
- Developing a standardized risk language around posture, appetite, settings;
- Aligning risk with strategy and finance;
- Fully engaging risk as key participant in the planning process;
- Continuing to develop thinking around the risk appetite framework by engaging with the key stakeholders; and
- Seeking ways to broaden the view and understanding of risk appetite so others feel more engaged in its development.
Scotiabank–A Canadian Experience in Setting Risk Appetite May 2011
The financial crisis that was experienced in the year 2008 sparked a strategic inflection point for the world’s view on “risk”. It compelled the Risk Management discipline in global financial institutions to re-assess every method and assumption embedded in their processes.
One such institution was Scotiabank in Canada.
Scotiabank considers the implementation of its Risk Appetite Framework to have been successful.
Scotiabank already had a risk appetite position embedded in its strong risk culture that had served it well through the financial crisis. However, Scotiabank recognized the potential value of a more clearly defined, comprehensive Risk Appetite Framework based on governing financial objectives, risk principles, and risk appetite measures.
Scotiabank integrated these key dimensions into an enterprise-wide framework, strengthening its overall approach to governing risk-taking activities. The Risk Appetite Framework was approved by the Bank’s Board of Directors in early 2010.
The biggest benefits of defining the Risk Appetite Framework for Scotiabank have been that it provides greater transparency of the key objectives, principles, and measures defining the Bank’s appetite for risk in the pursuit of value, and it has enabled greater awareness and more effective communication with internal risk decision-makers and external stakeholders.
This “case” captures how the development of a strong and functioning Risk Appetite Framework can be accomplished in the setting of a strong, existing risk culture where there is a deep network of established controls, limits, and risk oversight structure. The development of the Framework was the straight-forward part. Work continues on key challenges around implementation and further alignment.
The key challenge continues to be:
- awareness and application of the Framework within the Business Lines; and
- finding the right balance between broad principles and granular guidance for day-to-day decision-making with line management throughout the Bank.
In terms of awareness, the program was launched with “road shows,” but more communication work needs to be done to evolve from reliance on the culture and norms, to embedding the Framework as the more clearly defined and rigorous context for decision-making.
As for “the right balance,” there still needs to be linkage between the high-level principles and metrics as expressions of risk appetite at the top of the Bank and the risk indicators and limits deployed at a business unit level. While some measures of credit and market risk have been allocated to businesses, others, including most measures for operational risk are not easily aggregated, nor divided. As such, the Bank (and the industry) continues to work at an effective way to link certain “top of the house” measures with business-specific risk performance measures. Additional work also remains to further integrate the Risk Appetite Framework with other risk policies and the enterprise-wide stress testing program. Ultimately, Scotiabank’s test of an effective Risk Appetite Framework is that it fits the organization; the Board understands it; management is having good discussions reflecting both qualitative and quantitative measures; decisions are made and action is taken; and sustainable long-term earnings growth is achieved.
Risk Appetite Framework Development at the Commonwealth Bank of Australia
Within the Commonwealth Bank of Australia (CBA) Group, risk appetite had always been part of the risk vocabulary.
However, historically there has been little documentation of a formal framework.
During the mid-2000s, some attempts had been made to define the framework but it was not until the appointment of the new Group Chief Risk Officer in 2008 and the actions of an energetic Board Risk Committee chairman that the need for a formal, Board-owned risk appetite foundation gathered real traction. Consequently, a project to develop a risk appetite framework was launched at the start of 2009, and this case study covers the various stages of its development to date.
There have been several aspects of the development of risk appetite that have been successful and translated into meaningful benefits for the Group:
- Firstly, the approach to engaging with the Board led to a strong sense of ownership and a depth of understanding of risk appetite by the Board that would not otherwise have been achieved.
- By setting clear Risk Culture expectations in the Group RAS and putting ownership for developing business unit RASs on the heads of the business units (rather than the business unit risk teams), there has been a cultural shift in the ownership of risk from Risk Management to the businesses. Business units now act with clearer responsibility (ownership) for the risk they take on.
- The incorporation of the review of risk appetite as part of the strategic planning process, and the presentation of strategic plans, formally accompanied by recently agreed-upon risk appetite statements, to both management and Board has brought risk appetite considerations formally into key decision making and strategy setting discussions.
- The understanding of the interaction of strategy and risk appetite has changed previously held views that risk appetite was a barrier to progress, and in particular that it could not be challenged or changed. A lot of work has gone into explaining the connection between strategy and appetite and the important way that they are brought together in strategic planning, to give both management and the Board transparency over decisions either to amend the strategy to align with the existing appetite, or the appetite to allow the proposed strategy. The joint consideration and refinement of strategy and risk appetite is now part of business as usual.
- By establishing clear boundaries, Business units understand what is outside appetite and therefore do not pursue these opportunities, leading to a reduction in both wasted effort and frustration.
- By bringing the requirement to operate into alignment with the Group and local risk appetite statements into the performance management and remuneration framework, risk appetite has achieved a high level of awareness and influence on behaviors. Key behaviors are found in the Group RAS, e.g., responsibility to raise issues, protection for doing so and “no harm” to people who raise false-positive issues.
- Without sponsorship from the top, it is difficult to get traction in developing a risk appetite framework.
- finding the right balance between broad principles and granular guidance for day-to-day decision-making with line management throughout the Bank.
- The conversations around risk appetite are equally as important and beneficial as the actual Risk Appetite Statement document produced from them.
- Culture is a fundamental part of risk appetite and to the success of embedding risk appetite in the organization. Taking the time to craft descriptions of what risk appetite the Group and business units have for variance in risk culture breathes life into risk culture.