Week 3 - ERM Process Flashcards
What is risk culture
“Risk culture is a term describing the values, beliefs, knowledge, attitudes and understanding about risk shared by a group of people with a common purpose, in particular the employees of an organization. It is the set of common assumptions or beliefs in a company that allow you to “predict” how people will behave and what they will achieve”
What is effective risk culture
Effective culture promotes appropriate risk-taking and transparency with a clear, consistent, ethical tone at the top, which filters through to all employees
How do you manage risk culture
1) culture change is a long process
2) there should be a clear and compelling vision and strategy that people can understand and which they can buy into
3) the desired culture should be articulated and modeled from the highest level in the organization
Risk culture factors (hard vs soft)
Corporations cannot optimize risk management simply by establishing oversight committees, audit processes, and risk reports. These processes and systems comprise the “hard” side of risk management.
The “soft” side includes all the factors that influence individual decision-making and behavior. In a sound risk culture, everyone not only knows and understands the policies, but also shares the values behind them and adjusts their behavior accordingly
Steps in building culture
1) Hire the right people
2) Set the tone from the top
3) Make good risk culture easy and accessible
4) Use an appropriate yardstick
5) Understand the information
6) Communicate the problem
7) Act on it
8) Assess the risk culture regularly
Impact of Culture/Conduct
- Reputational impact and monetary fines
- Public perception can be significant even for what management
perceives as small - Government policies/guidelines – company can mitigate by having
effective compliance and ethics program - Compensation structure – can easily derail culture by incentivizing
wrong/bad behavior (ie. large commission payouts to those who take
undue risks but make outsized profits)
How to recognize a culture issue
Difficult to identify culture problem. Signs can be:
– Board and senior management may say right things but “middle” management might not be
following through
– Trends and patterns in whistleblower complaints not always analyzed and taken seriously
– Incentive comp not always issue – sometimes focus is on “pleasing your manager”
– It is how performance goals are achieved
Risk Appetite Statement (RAS)
The Risk Appetite Statement defines the
amount of risk that the firm is willing to
accept
➢ It is aligned with the strategic objectives of
the enterprise
➢ The Risk Appetite Statement defines key
risk requirements within two broad
categories: qualitative and quantitative
➢ It has been approved by management and
the Board or a committee of the Board and
is used by the businesses to guide their
risk-taking activities
➢ It considers the efficient, safe, and sound
deployment of capital
Key questions to determine risk appetite
Key questions:
* What risks will the organization not accept?
(e.g. environmental or quality compromises)
* What risks will the organization take on new initiatives?
(e.g. new product lines)
* What risks will the organization accept for competing
objectives?
(e.g. gross profit vs. market share?)
Risk appetite vs risk tolerance
Risk appetite: the company doesnt accept risks that could result in a significant loss of its revenues base
Risk tolerance: the company doesnt accept risks that would cause revenue from its top 10 customers to decline by more than 1%
Effective risk appetite framework
RAF:
- considers all relevant risks
- contains quantitative and qualitative statements
- incorporates stress conditions
- links risk appetite to strategic and capital planning
- institutionalized throughout the firm
- business line limit frameworks aligned with RAF
- effective monitoring of RAF and escalation of breaks
Breakdown the levels of risk tolerance
1) Risk Capacity - the maximum risk that the firm can bear and remain viable
2) Risk Appetite - the maximum risk the firm is willing to accept within its capacity
3) Risk Limits - the maximum amount the firm wants to accept
4) Risk Profile - the actual risk the firm is taking
Risk tolerance - the acceptable level of variation relative to achievement of a specific objective
Risk Capacity
Risk Capacity - Represents a company’s overall ability to absorb potential losses. Capacity represents the absolute maximum loss a company is able (not simply willing) to take on.
Risk Appetite
Risk Appetite - Represents the types and aggregate levels of risk an organization is willing to take on to actively pursue its strategic objectives.
It should fall within the broader umbrella of risk capacity and will align closely with the organization’s current risk profile.
A high risk appetite will consume a greater portion of risk capacity,
while a low risk appetite will consume a smaller portion, thus
providing a greater buffer zone and reducing the vulnerability of the
organization’s capital and resources.
Scale goes: Averse, Minimalist, Cautious, Flexible, Open
Risk Limits
Risk Limits - Risk limits are the parameters within which a company (or business unit or function) must operate in order to achieve its risk appetite.
Whereas risk appetite is a strategic determination based on long-
term objectives, risk limits can be seen as a tactical readiness to bear
a specific risk within established parameters.
Enterprise-wide strategic risk appetite is thus translated into specific
tactical risk tolerances that constrain risk-acceptance activities at the
business level.
