Risk appetite How hungry are you?

by Richard Barfield

the journal Special risk management edition

Richard Barfield
Director, Valuation & Strategy, UK
Tel: 44 20 7804 6658
Email: [email protected]

Regulatory pressures, such as Basel II

and a greater focus on corporate
governance, have been a stimulus
for many changes in the industry
one of these has been the recognition
of the need to articulate risk appetite
more clearly. On the face of it, this may
seem easy to do. After all, is it not simply
a combination of an institutions desired
credit rating, regulatory capital structure
and the relevant solvency needs which
set the ability of the institution to
withstand shocks and therefore represent
its risk appetite? For some smaller firms
this approach may well be enough, but for
others risk appetite is a more complicated
affair at the heart of risk management
strategy and indeed the business strategy.
Defined well, risk appetite translates
risk metrics and methods into business
decisions, reporting and day-to-day
business discussions. It sets the
boundaries which form a dynamic
link between strategy, target setting
and risk management.
Risk appetite is of course in the eye of
the beholder (if the reader will excuse a
mixed metaphor!). Different parts of the
organisation and external stakeholders
have different perspectives. Equity

investors appetite for risk will differ

from that of the rating agencies. Equity
investors want to see a return; rating
agencies want to minimise risk of default.
The regulators perspective differs from
managements which differs from that
of customers, employees, bondholders
etc. Consequently, articulating risk
appetite is a complex task which requires

the balancing of many views. Some

elements can be quantified but ultimately
it is a question of judgement. All too
often many parties take false comfort
from purely quantitative risk measures
which, if they were actually attained, would
in practice result in huge reputational
damage and job losses for the CEO and
the chief risk officer (CRO).

Benefits to the organisation

and the CRO
There are considerable benefits in
taking the time to articulate risk
appetite properly. If a financial institution
(or indeed any corporate) has arrived
at a crisp definition of its risk appetite
it will have achieved:
Clarity over the risks that the
organisation wishes to assume;

The basis for consistent communication

to different stakeholders; and
Explicit articulation of the attitudes
to risk of the senior management.
As CROs play a fuller role at board level1,
initiating a risk appetite discussion can be
an ideal way to engage senior colleagues
and the board on risk issues and strategy.
In our experience, a top-down approach
is usually the best way to begin to tackle
the problem of defining risk appetite.
A top-down approach makes the
requirements of the various external
stakeholders explicit and stimulates
debate in the executive team. The process
can also be used to engage board and
non-executive directors on the subject.
The result is a robust framework that can
be used to articulate appetite throughout
the group and to external stakeholders.
Figure 1 (overleaf) conveys an overall
approach which involves assessing
risk appetite from different stakeholder
perspectives and risk types. The topdown view of risk appetite leads typically
into an assessment of the desired riskprofile and an action plan to achieve it.
PricewaterhouseCoopers has developed

1 See for example the PricewaterhouseCoopers/EIU briefing: Uncertainty tamed? The evolution of risk management in the financial services industry

the journal Special risk management edition

Risk appetite How hungry are you?

10

a number of tools and concepts to help

clients cut through the complexities of
this multi-dimensional problem. For
example, we have found it helpful to
introduce the concept of risk capacity.
An organisations risk capacity is the
maximum amount of risk that it can
assume. This is an important concept
because risk appetite must be set at a
level within the capacity limit. Capacity
needs to be considered before appetite.
Stakeholder views will differ on the
desired safety margin and it is crucial
to understand this in setting and
understanding appetite. It is also
necessary to assess other factors such
as the potential impact of a risk incident,
as well as the ability of the organisation
to control the activity and the markets
perception of the fit with the institutions
other activities. These qualitative factors,
when combined with risk capacity and
risk measures, enable a balanced
appetite to be articulated and monitored.
A top-down approach works better
than a detailed bottom-up assessment.
The reason for this is that it is really the
only way to bring in the views of external
stakeholders and to create a proactive
statement of what management believes
its risk appetite should be. In our
experience, bottom-up approaches
tend to endorse the status quo and
the existing risk profile. They do not
take the thinking forward. The result is

the journal Special risk management edition

often a passive description of risk

appetite today rather than a proactive
view of where management wants to take
the organisation. Another benefit of the
top-down approach is that it ensures
that senior management are on the
same page on risk appetite. This may
require more investment at the start but
it pays dividends by making subsequent
roll-out much easier.
At one client the first appointee to the
newly created role of CRO has used
risk appetite discussions to engage the
business unit heads in defining the links
between risk and strategy. This is the first
time that risk has been considered as
an integral part of the business agenda.
Previously risk was treated primarily as

a compliance issue to be monitored by

internal audit.

Risk, return and reputation

It is also important to look at other
aspects of risk. For example, it is
essential to discuss risk in the context
of a companys desired levels of return
and growth. At corporate level in a
quoted company this might involve a
Total Shareholder Return (TSR) target.
Many companies set targets for these
and publicise them usually in terms
of outperforming a peer group. If we turn
this around and look at it from the risk
perspective, it could be interpreted that
management wishes to outperform its
peers in assuming risk! We have yet

Figure 1: Approach to risk appetite

Risk appetite: the quantum of risk that

the firm is willing to accept within
its overall capacity

Risk Appetite

Risk capacity: the maximum risk that the

firm can bear which is linked to capital,
liquid assets, borrowing capacity etc

Risk Capacity
Target Risk Profile
Actual Risk Profile
BR

CR

Business

Credit

MR

OR

LR
OR

Market Operational Liquidity

Source: PricewaterhouseCoopers

GR
Group

Risk profile: target profile represents

the allocation of appetite to risk
categories. Actual profile represents
risks that are currently assumed
Risk categories: tailored
for the business

11

to see a company set risk-adjusted

TSR targets.
If management, however, is clear about
its risk appetite and develops a core
competence in risk management it
should, everything else being equal,
be able to deliver superior returns to its
shareholders. Similar arguments apply
to unquoted companies such as mutual

Without a top-down perspective,

such risks can be missed.
It is essential to take a multi-dimensional
and balanced view of risk appetite and
periodically to refresh it. Admittedly this
can be difficult, as it is often very hard for
management to be objective about how
others see the institution.

Risk appetite and culture

institutions and cooperative banks. By

building a risk management competence,
returns to members should improve.
Hunger for returns without a defined
appetite for risk can lead to disaster.
Many apparent risk management
failures have been caused by profits
being chased and risks being assumed
that were poorly understood. Often
management makes the mistake of
focusing on the appetite of one group
of stakeholders without giving sufficient
weight to the appetites of others.
Experience shows that reputation can
be damaged even if the firm survives.
Sometimes severe reputational damage
can be caused by an incident in one
part of the group leading to contagion
and damage elsewhere. This can be
particularly acute in financial institutions
which require the trust of their depositors
or policyholders to remain solvent.

One of the more interesting internal

challenges in financial services
organisations, which often tend to
be risk averse and conservative, is to
ensure that business unit management
is assuming sufficient risk! Retail banks
in mature markets must rise to this
challenge as they strive to find new
growth opportunities. Incumbent
management teams, who are often
very good at maintaining the existing
machine, find they need new skills
to tune up the engine and go faster.
Without a change in risk appetite,
these companies can find themselves
underperforming in terms of returns.
Culture, strategy, and competitive
position all influence risk appetite.
Different firms will have different
tolerances for different risk types.
Furthermore, within a firm, appetite
should differ between business units.
A banks appetite for credit risk in

consumer lending might be quite

different to its appetite for market risk
in its investment banking operation.
Managements appetite for risk will differ
in a start-up operation in a new market
compared to maintaining an established
business in a mature market and so on.
A major benefit of defining risk appetite
is that it forces the debate and helps
ensure that risks are made explicit.
To change behaviours in relation to risk,
interventions through additional training
or changing personnel may be needed,
but in most organisations the tone set by
senior management tends to have by far
the greatest impact.

The role of economic capital

From a group perspective, risk appetite
is an important input to determining
economic capital which, in turn, influences
overall capital requirements. Economic
capital usually has a key role to play
in the quantification of risk and in
embedding risk appetite in the
operational infrastructure of the business.
These methodologies give business
management a tool to quantify risk and
to understand much better the
relationship between risk and return.
There are justifiable concerns, however,
about relying entirely on bottom-up
economic capital models.

the journal Special risk management edition

Risk appetite How hungry are you?

12

Management needs a top-down view as

a cross-check. For example, the problems
encountered measuring diversification
benefits or determining capital
requirements for difficult to quantify
risks such as strategic risk mean that
bottom-up views may not reflect the
true position. Indeed many companies
face major difficulties in quantifying the
capital associated with operational risk.
A top-down view of risk appetite
informs a top-down view of capital
requirements. The imminent arrival
of Pillar 2 means that some banks
are developing such a view for the
first time. Without a clear position,
an institution is likely to be at
a disadvantage with its supervisor.

Difficult to quantify risks

Naturally enough, if some elements
of risk appetite cannot be measured
they could be more difficult to manage.
Examples might include business
risk or reputational risk. Arguably
these are the risks that can benefit
most from being articulated more
clearly, even if it is in qualitative terms.
Nevertheless, quantitative techniques
are improving all the time.
The implication for management is clear:
identify the risks that the organisation
faces, measure them and articulate the

the journal Special risk management edition

Figure 2: Risk appetite

Quantitative measures

Hard measures of risk

Describe the type and quantum of risk the business
wants to and is willing to take
Relate directly to business plans and risk measurement
processes
E.g. appetite for earnings volatility

Qualitative measures

Recognise that not all risk is measurable but can affect

business performance
E.g. appetite for business activities outside core
competencies

Zero tolerance risks

A subset of the above - identify the categories of risk we

wish to avoid
E.g. appetite for regulatory mis-compliance

Source: PricewaterhouseCoopers

appetite for them. This needs to be done

in a comprehensive and balanced way
where quantitative measures are
combined with qualitative measures,
as well as those for which the institution
may have zero tolerance. These three
key components of a group-level risk
appetite definition are shown in Figure 2.

Linking risk appetite

to the business
To embed risk appetite effectively
in the business requires management
to establish limits for each risk type
and cascade them to lower levels
in the organisation.

Establishing a clearer statement of risk

appetite has important consequences in
terms of management information and
performance management requirements.
There are also likely to be implications
for risk assessment, measurement and
reporting. New management information
may be required to monitor risks and the
consumption of appetite across a group.
In some cases, this will involve new cuts
on existing data; in others it will require
new information feeds (which could be
as straightforward as monitoring certain
risk concentrations on a group-wide basis).
In most cases, it will require harmonisation
of existing limit structures and clarification
of roles and responsibilities.

13

A critical issue is to gather sufficient

leading indicator data that allows
management to take pre-emptive
action before appetite is exceeded
or limits are breached. It is of little
value to report passively at the end
of the month that appetite has been
exceeded. It is of greater value to
take preventive action. Provided the
information is available, management
will have a range of options to
choose from. These might include
risk transfer (for example, the
use of derivatives and swaps);
unwinding of positions; deceleration
of growth etc.
Furthermore, risk information needs
to be interpreted dynamically.
As credit risk exposures increase,
appetite for market risk may decrease.
The degree of flexibility granted to
particular managers to adjust the dials
on the risk management dashboard,
however, will clearly depend on the
firms risk governance approach.

Can you describe the appetites of

all of your main stakeholder groups:
supervisor, rating agencies, investors
and customers?
Can you populate Figure 2 with
the key metrics and values for
your organisation?
If the answer to any of these questions
is no, the chances are that your
firm could benefit from re-defining
its risk appetite.
Risk is good but it needs to be
understood. That understanding
begins with the board and senior
management. Risk appetite definition
is often the first step to deepening
and broadening that understanding
and shaping risk management strategy.

Do you need to take action?

Ask yourself three questions to see if you
need to take action:
Has your senior team recently
debated its view of the organisations
risk appetite?

the journal Special risk management edition