Risk Appetite and Risk Tolerance Flashcards
What is the definition of risk appetite according to Hopkin?
The immediate short term willingness of an organisation to undertake an activity that involves risk. It can be the total value of corporate resources that the board is willing to put at risk. It can only be looked at in the context of STOC.
What is the IRM definition of risk appetite?
The amount of risk that an organisation is willing to seek or accept in pursuit of long term objectives.
What is actual risk exposure?
The total cost of risk (all types of risk). There should be adjustments made to factor in the correlated nature of some risks rather than the sum of individual risks.
What is the risk universe?
All risks considered at board level.
How should risk appetite be viewed?
It should be viewed within the internal and external context of an organisation, its strategy, tactics, operations and compliance core processes.
What is the definition of risk tolerance?
COSO ERM 2004 - The acceptable level of variation relative to a achievement of a specific objective, and often best measured in the same units as those used to measure the related objective.
How are risk tolerances used?
Management considers the relative importance of the objective and aligns risk tolerances with the risk appetite. Operating within risk tolerances helps ensure that the entity remains within its risk appetite, and in turn, achieve its objectives.
How may risk tolerances be expressed?
Can be expressed in absolute terms - “we will not expose more than x% of our capital losses in a certain line of business.”
How may a firm ensure that core processes are carried out in line with the risk appetite?
Delegation of Authority - sets authorisation limits, expenditure limits and other constraints.
What is the process for setting a risk appetite statemen - six stages?
- Identify stakeholders and their expectations - CSFSRS
- Define company wide risk exposure through analysing STOC as set out in the risk register.
- Establish the desire levels of risk exposure that will lead to a risk appetite statement that provides a set of qualitative and quantitative statements.
- Define the range of acceptable volatility or uncertainty around each of the types of risks leading to a statement of acceptable risk tolerances.
- Reconcile the risk appetite and risk tolerances with the current level of risk exposure and plan actions to bring risk exposure in line with appetite.
- Formalise and ratify a risk appetite statement, communicate the statement with stakeholders and implement accordingly.
How are risks handled?
EM3 - Embrace, Mitigate, Manage, Minimise
Opportunity risks are embraced (strategy)
Uncertainty risks are managed (tactics)
Hazard risks are mitigated (operations)
Compliance risks are minimised (compliance)
What types of things might an insurer have zero risk appetite for?
- Censures, fines or prosecution
- Failure of internal controls
- Damage to brand, reputation from inappropriate acceptance of risk.
- Underwriting new classes of business without management authority.
According to the UK Corporate Governance Code, who is responsible for determining the nature and extent of the risks inherent in achieving strategic objectives?
Board
What are the principles underpinning risk appetite (6)?
- Setting risk appetite is complex - acknowledge the complexity.
- Risk appetite needs to be measurable - how are performance indicators impacted by risk e.g. shareholder value or Economic Value Added.
- Risk appetite is not a single, fixed concept - there are a range of risk appetite for different risks. These appetites may vary over time.
- Risk appetite should be developed in the context of the organisation’s risk management capability and risk management maturity. Culture and systems and processes to manage risk form part of the context.
- Risk appetite need to be addressed at all levels of the organisation for it to make practical sense - STOC.
- Risk appetite should be integrated with the control culture of the organisation e.g. propensity to take risk and the propensity to exercise control. The propensity to take risk may be greater at a strategic level, while the propensity to exercise control may be greater at an operational level.
What are the 5 tests for risk appetite frameworks?
- Do managers know the extent to which they are permitted to expose the firm to the consequences of an event or situation?
- Do the executives understand their aggregated and interlinked level of risk to determine whether it is acceptable or not?
- Do the board and executive leadership understand the aggregated and interlinked level of risk for the whole organisation?
- Are managers and executives clear that the risk appetite is not constant?
- Are risk decisions made with full consideration of reward?
