One of the key steps in developing an organization’s enterprise-wide risk management (ERM) framework is establishing written statements regarding its risk appetite and tolerance. These statements serve as guideposts to help employees make both strategic and tactical decisions; thresholds for risk metrics; and benchmarks for assessing whether the organization is comfortable with its own risk profile. They are vastly important. So, who should be involved in developing them and what does that process look like?
As discussed in the first blog in our ERM Toolbox series, "Why Do I Need Risk Appetite and Tolerance Statements?, establishing an organization’s risk appetite and risk tolerance statements is a vital step. Once an organization has seen the light and made the business case for setting these guidelines, the follow-up question is, “How are these statements developed?” For an organization that has not yet defined its risk appetite and risk tolerance statements, this question can seem intimidating. So, I’ll break it down into three smaller questions:
1. Who should be involved in developing the statements?
2. What is the best way to elicit information from participants?
3. Who should be involved in approving them?
Invitees to the party usually include the organization’s top level of management—AKA its executive team, senior leadership, or C-suite. This core group of individuals is going to be most familiar with and responsible for achieving the organization’s mission and strategic objectives.
Add to this group any subject matter experts that provide necessary insight into certain risks that the organization faces. If an individual’s voice must be heard, either because they are instrumental in achieving strategic objectives or they manage the mitigation of a key risk, invite them.
Lastly, include members of the risk management group—whether they’re assigned to a formal, independent risk management function or given ad hoc responsibility.
As a pragmatic concern, the group should not be too large as it is harder to develop consensus with larger groups. Up to 12 members should suffice.
Theoretically, risk appetite and risk tolerance statements could be drafted and agreed upon through an iterative series of questionnaires or through software that allows for deep collaboration. However, in my experience, a workshop is the most efficient way. Methods may be dictated by what you are hoping to achieve, namely a consensus on which risks are acceptable and which are not.
Workshops do present their own challenges. However, participant training, competent workshop facilitation, and clear workshop objectives will help address those challenges. Many of the following steps might seem self-evident, but my advice for holding a successful workshop is as follows:
1. Schedule it so that everyone can participate. This is easier said than done, as these people are BUSY!
2. Ensure all participants know what is expected of them during the workshop—as workshop participants and as a group. This can be handled simply by providing a meeting invitation that includes an agenda and location, and establishes workshop “rules” (e.g., no phone calls, texting, or email during the session).
3. Establish a base level of ERM concept knowledge for participants. Understanding of the terms risk appetite; risk tolerance; risk mitigation; and inherent and residual risk; as well as risk types, is important. This training can be provided separately but can be very effective if provided on the same day, ahead of the actual workshop. The goal is full participation from all workshop attendees, not just those who are “in the know.”
4. Request that all participants bring copies of the corporate policies for which they are responsible. For example, the treasurer might bring the banking policy and the CIO might bring the acceptable use policy. These policies often serve as a starting point for risk tolerance statements.
5. Consider hiring a professional facilitator. The facilitator’s job is complex; they must be mindful of assessment bias, prevent or negotiate conflict among attendees, dissuade individuals from dominating the conversation, and encourage participation by those inclined to be wallflowers. Knowing when to table a discussion and move on is also a valuable skill. Rabbit holes explored by just a few individuals can cause the larger group to lose focus.
6. If the number of workshop participants is large or is having trouble reaching consensus, consider using break-out sessions based on topic (e.g., risk type), then bringing recommendations back to the full group.
7. At the conclusion of the workshop, summarize outstanding items (there will be some), assign ownership, discuss next steps, and communicate a timeline. Follow up in a timely manner with an email to the participants, providing this same information. Ensure that each individual understands their required deliverables and timeline.
8. About a week after the session, reach out to participants to gauge their impressions of the workshop. Ask if they think the workshop was effective in building consensus around the risks the organization is willing to accept, those that it will not accept, and a delineation between the two.
9. Don’t seek perfection. There is no need for endless debate over each metric—like whether a 3, 4, or 5 percent ROI is ideal. It is natural that, like a new pair of shoes, these initial metrics may need to be adjusted.
Obtaining approval of the risk appetite and risk tolerance statements is the “blessing” that puts them into practice. They then become the rulebook, the guidebook, the playbook for risk taking. However, the task of gaining approval may reveal additional risk threshold questions that must be answered by management.
Organizations usually have some form of supervisory body on which approval of risk appetite and tolerance statements will fall. In a corporation, this is their board of directors. In a public sector organization, it may be their council. To prepare the board/council for this responsibility and to ensure everyone is in alignment with expectations, they should be given the same baseline ERM training as management. And management should be prepared to respond and adapt to the board/council’s oversight.
For an organization looking to define and publish their initial risk appetite and risk tolerance statements, the process can seem intimidating. However, involving the right individuals, holding an effective workshop, and seeking the right approvals, can make this process achievable. The key is to effectively channel senior management’s time to discuss, debate, and come to a consensus on enterprise-wide risk constraints. The clarity gained will equip employees to manage their individual risks and empower the organization as a whole to respond to risk more confidently and consistently.
Read the first blog in our ERM Toolbox series.