• An effective risk tolerance, appetite, criteria, etc. statement

• A discussion of Risk Appetite by thought leaders

• Just what is risk appetite and how does it differ from risk tolerance?

• The tricky business of risk appetite: a check-the-box chimera or an effective guide to risk-taking?

What is your risk appetite?://

• New guidance on risk appetite and tolerance. I like some parts, disagree with others

I am drawn to write about this flawed concept yet again by two developments. First, a respected risk practitioner told me that he has found that in many banks (and presumably other financial services companies) the board agrees on risk limits and appetite statements with management, but those limits are not shared with everybody that has day-to-day responsibility for running the business and staying within desired levels of risk.

This is the primary area with which I have a problem when it comes to the idea of a risk appetite statement. Something that satisfies the needs of the board and top management to establish and monitor aggregate risk across the enterprise fails if it does not direct the actions of those people who are taking risk every day, not only in transactions but in decision-making.

Then, my good friend (and that is an honest statement with which that I believe he will agree) Jim DeLoach of Protiviti penned a piece on risk appetite and tolerance for Corporate Compliance Insights.

Jim shares some truths:

“Risk levels and uncertainty change significantly over time. Competitors make new and sometimes unexpected moves on the board, new regulatory mandates complicate the picture, economies fluctuate, disruptive technologies emerge and nations start new conflicts that can escalate quickly and broadly. Not to mention that, quite simply, stuff happens, meaning tsunamis, hurricanes, floods and other catastrophic events can hit at any time. Indeed, the world is a risky place in which to do business.”

“Value creation is a goal many managers seek, and rightfully so, as no one doubts that successful organizations must take risk to create enterprise value and grow. The question is, how much risk should they take? A balanced approach to value creation means the enterprise accepts only those risks that are prudent to undertake and that it can reasonably expect to manage successfully in pursuing its value creation objectives.”

But then the discussion veers towards the too-common misperception that the only limit that should be set on risk is the upper level – a constraint that stops management from taking too much risk.

In fact, as Jim points out, companies will only succeed if they take risk: “a company may choose to drive growth through extending more credit to its customers, entering certain third-world markets or investing in a completely different line of business”.

So, it is important to ensure that not only does management not take on too much risk, but they do not act timidly and fail to take on the risk that will drive performance and value creation.

I know Jim well and have total confidence that he appreciates that companies need not only ceilings but floors on the levels of risk they should take (and not limit their risk criteria to quantitative factors) to ensure they are taking the right risks.

I just wish his paper focused less on the negative (with comments like “What ceilings are placed on capital expenditures, M&A activity, R&D and other investments? In what areas are there policy restrictions (e.g., avoidance of certain markets and use of certain financial instruments)?”) and helped organizations recognize when to take more risk.

I also wish that Jim brought into his pieces a greater appreciation of the perspective on risk and uncertainty reflected in the ISO 31000:2009 global risk management standard, instead of limiting himself to the concepts (some of which, like risk appetite, I believe to be flawed) of COSO ERM.

Norman Marks, CPA, is vice president, governance, risk, and compliance for SAP's BusinessObjects division, and has been a chief audit executive of major global corporations for more than 15 years. He is the contributing editor to Internal Auditor’s “Governance Perspectives” column.
normanmarks.wordpress.com/

Les médias du groupe Finyear

Lisez gratuitement chaque jour (5j/7) le quotidien Finyear.
Recevez chaque matin par mail la newsletter Finyear, une sélection quotidienne des meilleures infos et expertises de la finance d’entreprise.
Lien direct pour vous abonner : www.finyear.com/abonnement

Lisez gratuitement chaque mois :
- le magazine digital Finyear sur www.finyear.com/magazine
- la lettre digitale "Le Directeur Financier" sur www.finyear.com/ledirecteurfinancier
- la lettre digitale "Le Trésorier" sur www.finyear.com/letresorier
- la lettre digitale "Le Credit Manager" sur www.finyear.com/lecreditmanager
- la lettre digitale "Le Capital Investisseur" sur www.finyear.com/lecapitalinvestisseur
- la lettre digitale "Le Contrôleur de Gestion" (PROJET 2014) sur www.finyear.com/lecontroleurdegestion
- la lettre digitale "GRC Manager" (PROJET 2014) sur www.finyear.com/grcmanager

Un seul formulaire d'abonnement pour 7 lettres