Risk appetite and tolerance are key concepts in risk management that help you align your strategic objectives with your risk profile. However, many organizations struggle to define and communicate them clearly and consistently. In this article, you will learn how to create a clear risk appetite and tolerance framework that can guide your decision-making and risk culture.
Risk appetite is the amount and type of risk that you are willing to accept or pursue in order to achieve your goals. It reflects your risk preferences, values, and expectations. Risk tolerance is the maximum level of risk that you are able to withstand without jeopardizing your viability or reputation. It defines your risk limits, boundaries, and thresholds. Both risk appetite and tolerance should be expressed in measurable terms, such as financial, operational, reputational, or compliance indicators.
This concept is easily one of the most confusing in risk management. Let's dissect it with an example. A company may establish a "moderate" risk appetite for a regulatory compliance risk, accepting certain degree of non-compliance instances in pursuit of its objectives. The company's tolerance level is defined as no more than three regulatory observations and zero MRA per regulatory exam.
In my experience it comes down to the confidence of a CEO to push a team to deliver strategic objectives. Successful delivery is a hit rate and you will accept different hit rates for different types of strategic projects. A client project has to be 100% successful but prototyping can tolerate much lower threshold of success to promote learning.
My area of expertise lies within the energy sector and, specifically, oil & natural gas. Producers of oil and gas have 100% commodity price exposure. Market risk reduction is accomplished by hedging price risk through the use of various derivatives such as futures, forwards, swaps, spreads and options. The percentage of production that an E&P company hedges indicates their appetite for risk. Their is an unwritten rule that producers should hedge at least 50% of the production but no more than 80%. If one is looking to invest in an oil & gas company, you can determine their tolerance for risk based upon their hedge percentage. Far too many oil and gas producers just "go with the market" with is essentially, pure speculation.
Risk appetite may differ between risk categories relevant to the business so it is important to set the appetite in the context of the particular category as well as the business as a whole. Risk categories would be used to organise risks for management and reporting purposes so they should already be defined and used within the business.
The foundation of arriving at a Risk appetite & tolerance framework is the complete understanding of the COSO principles and internal controls as applied to different Industries and Entities. This directly correlates to the risk frame-work pursued by any institution. Apetite relates to the type of risk you are willing to consider while tolerance relates to the amount of risk you are willing to accept without negative exposures.
A risk appetite and tolerance framework is a tool that helps you articulate, communicate, and monitor your risk appetite and tolerance across your organization. It enables you to align your risk-taking behavior with your strategic vision and mission, create a common language and understanding of risk among stakeholders, identify and prioritize the most significant risks and opportunities for your organization, allocate resources and responsibilities for risk management, and enhance your risk culture and governance. By using this framework, you can promote accountability, transparency, and trust within your organization.
If you are producing or manufacturing something, there is a market price for it and you know the cost to produce it. If you are able to lock-in future sales at prices that meet or exceed your profit threshold, it is alwasy wise to do so. But it is an individual business decision. Again, in the oil & gas industry, the many highs and lows can be "smoothed-out" with a well-defined, conservative risk management policy. That policy and its implementation should not be deviated from merely because someone internally believes they can "call the market". The top CEOs in the world don't know what market prices will do in the future, it's only speculation. Develop a plan and stick to it. And, make sure to have strict controls in place.
A key aspect in any framework is the interaction of labour/time/capital. It is not fashionable but my view is you should take more time to deliver to improve outcomes and to improve trust.
A robust risk appetite and tolerance framework identifies and prioritizes key risks, enabling effective resource allocation and mitigation efforts. For example, a financial institution may use this framework to determine its tolerance for investment risks, ensuring that resources are allocated appropriately to high-potential opportunities while mitigating excessive risk exposure.
The risk appetite for a business must be agreed in order to be able to assess whether risks are above or below the appetite. Risks that are above will require active management to reduce them to below (or equal to) risk appetite. Risks that are already below risk appetite should be monitored but are not in need of immediate management. An effective approach would be to assess risks before and after the application of mitigating controls and therefore set similar risk appetites for Inherent Risk (before) and Residual Risk (after).
Developing a risk appetite and tolerance framework is a collaborative and iterative process that involves defining your strategic objectives and key drivers of value creation, identifying and assessing the internal and external factors that affect your risk profile and performance, engaging stakeholders to determine your risk appetite and tolerance for each strategic objective and key risk area, documenting and communicating your risk appetite and tolerance statements, metrics, and targets in a clear and concise manner, and reviewing and updating your framework regularly to reflect changes in your environment, strategy, and performance.
You need to first clearly define the risks your organization is exposed to. Then, you set about determining the various possible ways to reduce that risk. For publically-traded oil & gas companies that choose to hedge their production, they have to report on their use of energy financial derivatives. And each derivative has to be tied to a physical transaction or else those financial instruments are speculative. Therefore, they need a formal risk policy along with defined procedures and controls over the implementation of financial derivative products. A Risk Control group should be established. Daily, monthly and quarterly reports need to be generated to quantify the inherent risks in the derivatives due to market price fluctuations.
For new risk officers seeking to introduce an appetite/tolerance framework, seek out opportunities to support growth and innovation. A trial initiative can be developed around an expected new product, a leap into a new market, or an aquisition. Seek a seat at the table of growth, and establish risk management as a long term partner.
Implementing a risk framework should be an iterative process by engaging all the relevant stakeholders at every stage of their process by creating a value added benefits that can slowly be part of their process DNA.
The operation of an effective risk management framework requires input from across the business and should fit into a "three lines of defence" model. Risk appetite would be typically be set by management (3rd line) and risks identified at the operations level (1st line). Mitigating controls would be operated at both 1st and 2nd lines of defence. A methodology to assess risks will need to be agreed in order to compare the risk assessment with the agreed risk appetite to then determine an appropriate course of action.
Implementing a risk appetite and tolerance framework requires a consistent and coordinated approach that integrates risk management into your planning, decision-making, and reporting processes. To do this, you should align your policies, procedures, and controls with your framework. Additionally, it’s important to educate and train your staff on the meaning and implications of the framework. Moreover, embed metrics and targets into your performance management and incentive systems and monitor and report on your risk exposure. Finally, any breaches or deviations from the framework should be escalated and addressed.
One of the Risk Management steps is to implementing the risk appetite and tolerance framework into decision making process. The tolerance framework depends on the nature of risk a party is willing to take and might be set by the stakeholders involved per their risk appetite. Implementing this involves quantifying the risk, aligning the work as per/within the framework and also monitoring the risk management solutions after its implementation. One has to thoroughly valuate the current frameworks, even if it might be the most optimal, to continuously look for opportunities. The risk has to be adjusted according to the dynamic conditions and risk appetite of the stakeholders involved.
Philosophy is an important aspect to measuring risk - you have to be prepared to challenge metrics to deliver a good framework. There is a danger all businesses end up following metrics, whereas culture rather than strategy/frameworks will normally the dominant factor driving success.
There are several vendors of risk management software systems for energy financial derivatives. All transactions should be entered into these systems for overall "book" assessment. Reports generated by these systems should be disseminated to all levels of interest from the Traders to the C-levels. Everyone should understand the positions and exposures embedded in these derivatives. Risk limits should also be established and exceedence in any area should be addressed immediately. Penalties for violations of risk policies or tolerances, including termination, should be spelled-out in detail and the risk policies should be formally acknowledged by those dealing in the derivative on behalf of the organization.
Improving a risk appetite and tolerance framework is an ongoing and dynamic process that requires feedback, learning, and adaptation. You should solicit and incorporate feedback from your board, senior management, and other stakeholders on the effectiveness and relevance of your framework. It's also important to evaluate and benchmark your framework against best practices and industry standards. To make progress in this area, you should identify and implement improvements and enhancements based on the feedback, evaluation, and benchmarking. Finally, it's important to communicate and celebrate your achievements and challenges in implementing and improving your risk appetite and tolerance framework.
Oil & Gas companies have been using energy financial derivatives for decades now to reduce market risk. Along the way, they have adjusted their strategies and made changes as new regulations have been implemented such as Sarbanes-Oxley and Dodd-Frank. Risk policies and strategies need to be reviewed at least on an annual basis. Some strategies may not have worked well in the past and cash needed for margin or to purchase options may change also. The market constantly changes and, as a result, risk exposures change and hedging strategies will need to be adjusted.
Consider for the Risk Appetite Control Framework to underpin and enhance operational excellence, which would in turn seve the organization!
You will need to have sufficient capital to make good adverse business experience. In terms of balance many businesses split their revenues between some combination of regular income (farming) and irregular revenues (hunting). You then allocate resources between the two based on information to hand. A leap of faith is always required when hunting.