“Business people need to understand the psychology of risk more than the mathematics of risk.”
– Paul Gibbons, FRSA.
Every organisation starts taking risks the minute they open their doors (literally and figuratively) whether you are a for-profit business, not-for-profit business, bank, food services, or health services, provider. Therefore, it is imperative management identify their risks, measure them, track them, and make business decisions based on them.
How is your organisation’s risk management? And, most importantly, how hungry are you? Every organisation has a strategic level of risk appetite that they are ready to undertake in pursuit of its objectives. In Breakfast Briefing #10 for this second season, Matt Humphrey, RSM Risk Advisory Partner, pursued the theme of risk appetite from the strategic risk “Holy Trinity”.
As part of this risk management’s virtuous trinity, Matt pointed out that objectives, strategic risks and risk appetite are the critical components that should be aligned for a greater good.
Matt also shared some of the key findings from a recent RSM risk appetite survey. He also had time to draw on his own recent experiences and to help tease out what might be some worthwhile risk appetite takeaways for session participants.
Let’s do a recap on this conversation.
Matt Humphrey presenting his COVID-19 Risk Appetite Survey from RSM for November 2020.
Are Objectives Aligned?
Organisations normally possess common objectives, values and a shared vision. Nonetheless, they have to prioritise and consider to align all these statements with their strategic risks and risk appetite. That’ll only help to achieve an increase of applicability and functionality.
By integrating objectives with strategic risks and risk appetite along, organisations will secure a well-run risk management process.
Fundamental Strategic Risks
Strategic risks are those affected or created by business strategy decisions. Strategic risks are both an opportunity for failure or a chance to embrace change. The acceleration in the discovery of these risks will represent a tremendous growth opportunity for any organisation.
But, what about risk appetite?
COVID-19 still emerges as an unforeseen risk which few could have imagined
Why Risk Appetite?
In these unstable geopolitical times –with turbulence as the new normal– risk appetite represents the amount and type of risk that an organisation should follow, undertake and retain. So, it is the degree of risk that the organisation is prepared to accept in pursuit of its strategic objectives and business plan.
Ask yourself this question: Would you take up sailing? If your answer is “no,” this means you have no appetite for this kind of risk. From a policy perspective, you could simply state “that it is your policy not to participate in sailing activity”. What if you do want to participate in sailing activity? You may be drawn to the upside of such activity which could include exercise, spending time on the water, developing nautical skills,
But you also know there are risks factors associated with this activity such as hypothermia, overexertion, sunburn, physical damage to you or the boat, and of course the most critical risk, death (by drowning or other means). These are all components of a risk appetite that can be defined and measured. So here your risk appetite statement would say “Management is willing to accept risks associated with open water sailing activity with effective controls in place to minimise harm to individuals”
Different types and levels of risk can be adjusted accordingly:
- A low appetite for risks that increases safety incidents.
- A moderate appetite for risks that reduce reputation.
- A high appetite related to improving operational efficiencies.
In this picture, emerging risks should also be considered such as Brexit and COVID-19.
The RSM Survey
Matt presented the summarised results of their recent COVID-19 risk appetite survey, which was deployed across a number of clients in all sectors, followed by discussions with business leaders.
He explained that they have summarised positive headline themes and messaging to be used for purposes of compare and contrast. The survey posed the following questions:
- As a result of Covid 19 has your board/organisation reviewed its risk appetite?
- Has your board/organisation risk appetite changed as a result of Covid 19?
- In what way has your board/organisation risk appetite changed as a result of Covid 19?
- How has the change in the board/organisation risk appetite been reflected in the way in which decisions are made / services delivered to customers?
- The risk appetite of the board is defined and communicated across the organisation in the form of a risk appetite statement line.
COVID-19 Risk Appetite Survey from RSM for November 2020.
A Shift in Mindset
Matt made great emphasis on the results addressing ways that boards/organisations risk appetite had changed as a result of Covid 19. There were 3 key outcomes that he highlighted:
- Emphasis on horizon scanning and future strategising – being committed to planning for the future.
- A shift in mindset – making sure that the Board are engaged in conversation about the future direction and strategy.
- An attitude change – and the impacts on organisation behaviours and resilience (something yet to be explored).
According to Matt, “now organisations are talking about corporate resilience both in their finances and plans and also their people”. This has changed the dynamics of risk appetite. He continued saying that “we are starting to see more emotional aspects altering the way we think about risk appetite”.
Regarding how changes in the organisation risk appetite have been reflected in the way in which decisions are made and in customer service, Matt explained the major conclusions, among others:
- Greater demand for information/evidence to inform decision making – coupled with more regular meetings.
- The intensified urge to prepare for change – almost seek it out.
- An increasing need to understand how COVID-19 is impacting on stakeholders.
- Accelerated use of digital technology to provide services.
Matt continued clarifying that “on a macro-level, these indicators are pointing out that there is a greater need for more informed assessment and measurement of the risks with regards to decisions that are being made”.
More than ever, and as Matt said, “there is a great desire to get more informed evidence to make decisions”. “Evidence-based decisions should prevail over emotional ones”, he shared.
The Foreseen Risks
“Some risks that are thought to be unknown, are not unknown. With some foresight and critical thought, some risks that at first glance may seem unforeseen, can in fact be foreseen. Armed with the right set of tools, procedures, knowledge and insight, light can be shed on variables that lead to risk, allowing us to manage them.”
― Daniel Wagner, Country Risk Solutions
As organisations, we should effectively define and communicate what risk appetite statements mean, with highlighted headlines of themes (rejected or taken). Rather than risks, said Matt, we should be talking about ” a collective bucket of stuff”.
In summary, there are many benefits of the implementation of the “Holy Trinity”, especially of effective risks appetite procedures:
- Understanding their inter-relationship and deciding what level of risk exposure we are prepared to accept. This should be embedded in how we think about risk so that when reporting to the Board, it is reflected in papers and reports.
- Ensuring that organisations continue to actively manage their risk approach through ‘Horizon Scanning’ and ‘Scenario Planning’
- Organisational resilience should be an embedded mental capability among the organisations to address and overcome issues this journey to the ‘next normal’.
Remember, some risks can be foreseen and, therefore, assessed and planned beforehand. This should be embedded in how we think about risk.
Do you want more?
If you are interested in risk management, then check out our blog on “Managing strategic risks in a crisis” (Link below).
If you would like to discuss any of the items raised in this blog then please contact firstname.lastname@example.org