Risk appetite frameworks – designing the right tool for the job

Estimated reading time: 5 minutes

The old saying goes that a good worker never blames their tools. Nevertheless, if the tools are not designed to make the job easier, then you might argue that there isn’t much to do but complain? 

Risk appetite frameworks are a great tool for a company to have at its disposal, but only if they are well thought-through and ingrained within the business, which is easier said than done.

Over the last few years, Barnett Waddingham has been working closely with companies to help them “think again” about risk appetites, and in turn, make a tool that is more than just a second line tick-box exercise. In this blog, we highlight some of the key learning points and give examples of how firms can see their risk appetites develop into the right tool for the job.

Framework? A few statements should be enough, no?

The purpose of any framework is to ensure tools are designed to be fit for purpose, not just for today, but also for an ever-changing business environment. It is common for firms to jump straight to the answer they think they want, rather than setting the framework to ensure it covers the right areas and helps to manage risk at appropriate levels as the business develops. 

In developing a framework, management should look to formalise a clear risk strategy, reflecting the areas of risk that the business is prepared to accept in order to remain operationally effective. This will ensure risk appetite tools work together with the wider focus of the business, rather than hindering and acting as a bureaucratic hurdle to key projects. The appetites will help to set limits in relation to the business strategy, linking individual quantitative tolerances back to the overall capacity for any risk. In using these measures, a firm sets the groundwork to ensure any new or developing area of risk can be included without contradicting the appetites or the overall strategy already in place.

Risk appetite terminology can also be confusing. What is the difference between an ‘appetite’, a ‘metric’, a ‘tolerance’ or a ‘trigger’? These are often used interchangeably between organisations, but the key point to note is that as long as the business has clear definitions that management agree upon, there is no need to worry. The framework should set this out clearly and then the risk appetite statements will provide the detail and justification for each risk, and focus on setting measurable identifiers at appropriate levels.

Getting appetites to work together

One of the key processes in developing good risk appetites is considering how each appetite and metric will interact with others, in particular at different levels of risk. A great example is how a firm’s overall solvency appetite metric (usually noted as a minimum solvency coverage ratio) will interact with the metrics set at sub-risks, such as market risk. 
Market risk is an area that the firm can adjust very quickly with investment strategies.

The appetite for this risk may well depend on the firm’s overall solvency position. For example, when a company’s solvency coverage ratio decreases, management will likely look to take on less market risk and invest in assets that better match liabilities to reduce the risk of any market falls. This means that setting an absolute limit on market risk is not a true reflection of the company’s dynamic appetite. This needs to be considered carefully in relation to the wider solvency position.

Setting metrics: getting the balance right

We all know there is more than one way to look at most problems and risk appetites are no different. Choosing the right metrics should be given significant consideration and, for some risk appetites, may require different or multiple approaches to best capture all aspects of the risk. 

The first port of call in measuring risk appetites is often the SII coverage ratio or, for sub risks, the related capital requirement. There is no doubt that this is a clear measure of risk, but it is complex, takes time to produce and may not be the best measure for some risks, such as operational risk. In fact, if your metric cannot be measured in close to real time, is this going to provide real value to the business when decisions have to be made? Firms must challenge the metrics to find the ideal balance of simplicity and effectiveness, rather than simply relying on outputs from models that already exist. 

We want to help you take control of your risk appetite framework and make it work for your business needs. Get in touch with us below to talk through your options or to discuss any of the topics covered in this article.