6 Steps to Ensure Risk Appetite Drives Your Business Strategy

Step 1:  Business and business model identification. Evaluate the firm’s current business and operating model, because business environments and structures change over time. New products, working environments and/or human capital mix impact the business and its model. It is important to conduct this analysis each year during the strategy development process, whether or not the business or model has changed.

Step 2:  Risk identification. Identify the risks associated with business activities. It is not yet necessary to identify “key” risks. However, a comprehensive list of all identified risks should be made, as risks not identified will not be assessed or adequately controlled, dooming a strategy to failure. The last thing a management team wants to say is, “We failed to plan for that.”

Step 3. Risk appetite development. The risk appetite sets the rules of the road. Think of it as the guard rails on a fast-moving highway consisting of ranges for different risks or risk categories. The board should review and approve the business’s risk appetite each year, since risk assessments set the guidelines for implement strategy. Establish compliance procedures for these limits on risk regularly. 

Risk appetite is paramount to developing a strong risk culture within the company, for without one, colleagues may not know what risks are unacceptable and incorrectly interpret the warning signs when they see them. Risk appetite may identify businesses in which the firm will not engage because the board would deem them as risky. Developing a strategy without a risk appetite is like driving a car at night with no headlights. Eventually, management could drive off the road or, even worse, over a cliff.

Step 4: Strategy development. With a risk appetite sufficiently assessed and established, it’s time to focus on strategy development. Understanding of the business, model, risks and risk appetite allows for the development of a risk-focused strategy. When formulating the strategy, continually look to the risk appetite for guidance. For instance, to grow a particular function, ensure that they don’t breach a risk concentration limit. 

Step 5:  Risk assessment. Begin assessing risk once the strategy is developed end evaluate risks for the inherently uncontrolled exposure presented. This help you identify key risks and, based on risk appetite, decide on a risk treatment:

• Acceptance: Do nothing to control the risk.
• Avoidance: Do not engage in the activity that produces the risk.
• Reduce: Use controls to reduce the risk to a level consistent with the risk appetite.
• Share/Transfer: Move the risk to a counter-party.

If risk is in line with the risk appetite, management may choose to accept the risk. If it cannot be effectively controlled or just cannot be accepted for any reason, avoid the risk. Choose to reduce risk if you can effectively establish controls. Share or transfer the risk through the use of insurance. The risk exposures that remain after controls are executed are considered residual risk. Residual risk must always remain within the risk appetite.

Step 6:  Strategy execution. During this phase, closely monitor key risks to ensure alignment with the risk appetite. When negative trends are identified, develop corrective action plans. A proactive risk-management approach helps ensure key risks never breach their limits, requiring you to manage risk events, not simply mitigate them.

Everything in strategy and execution relates to the risk appetite. All firms are exposed to some type of risk. How the firm manages those risks determine its long-term prospects for success or disaster. You cannot build a risk-based strategy without assessing and establishing a risk appetite, nor can you ensure they are effectively managing those risks. When the risk-assessment process is properly employed, the risk appetite will drive the business strategy and play a crucial role in its ultimate success.