Risk – organizations encounter it every day as they work through decisions that lead them to achieving their objectives. But what guidance are they using to determine how much risk to take?
Risk appetite is the level of risk that an organization is willing to accept while pursuing its objectives. When used properly, it can be an extremely effective decision-making framework. It can force leaders to have difficult conversations in order to understand potential contradictory risk appetite statements.
This process is critical, because it allows those involved to work through potential contradictory decision options, or tension points. Oftentimes, these conversations are as valuable as the decisions they produce. Once leaders have reached a decision, they should communicate it to the rest of the organization to build understanding of its risk tolerance and risk management strategies.
To demonstrate this process in action, here are two examples of how organizations have used risk appetite to work through contradictory statements.
Example one: Funding a loan to a local foodbank
This scenario from COSO demonstrates the potential contradiction in decision making. The example is of a community bank that has, among its risk appetite statements, the following:
- We encourage our staff to offer financial products to our customers that serve their needs, but not where the credit risk exceeds prudent levels.
- We seek to support our local community in becoming a vibrant and diverse place to live within a profitable business context.
The bank has recently been asked to fund a loan to the local food bank to help it upgrade its premises to better serve the community. But there is an issue and a potential tension point.
The issue: The ability of the food bank to service the loan is questionable because it is highly dependent on donations, which can vary as social values and behaviors change.
Would the community bank be prepared to foreclose on a loan, and in so doing, cause people to go hungry? Does the risk of financial loss from a poorly performing loan outweigh the risk that comes from not supporting the local community and developing a strong business context in that sector? While the resolution to this scenario is not provided, it demonstrates how the natural tension within risk appetite statements helps to stimulate a deeper business conversation.
Example two: Offering in-person education during COVID-19
This scenario from Ontario Community College arose in September of 2020, before COVID-19 vaccinations were widespread. The college was considering how they could best offer their Fall 2020 course catalogue.
They started with two of their key risk appetite statements:
- We will ensure personal safety of all stakeholders – students, staff, contractors.
- We will seek to provide all educational offerings that are of top quality.
The issue: The college started with the premise that in-person offerings were of higher quality than online offerings. However, their contradiction, or tension point, was that this would violate their risk appetite statement of ensuring personal safety. As you’ll remember, at the start of the pandemic, people were being asked to avoid gathering in groups as much as possible.
So, how did they resolve the business decision of offering courses for the September 2020 term? The first major decision was to offer all second- and third-year classes online. It was postulated that those students already had the grounding of face-to-face sessions in their first year where they got to know their instructor and fellow classmates.
The second major decision was to defer all first-year classes until such time when vaccinations were widely available – which at that time was estimated to be in another nine months. The college could do this because there were sufficient financial reserves and political backing to defer revenues for nine months. With that important caveat in place, the college could then adhere to the two risk statements of personal safety and of offering in-person courses for first-year students.
Identifying and discussing contradictions in risk appetite statements can greatly alleviate potential problems before they occur. And remember, the results of these discussions among senior leaders must be communicated through the rest of the organization to increase understanding of its risk tolerance and risk management strategies. This is how risk appetite can be positively utilized, and not just exist as a stand-alone set of principles that is put on the back pages of an annual report.
Author info
William (Bill) Wesioly is a CPA, CMA, in Ontario, an independent risk management consultant, and a professional leadership coach. Prior to becoming an independent consultant, he worked in the financial services industry in risk management roles for Bank of Montreal and Royal Bank of Canada. He currently teaches the CPA ERM certification program in Toronto for CPA Ontario.
