Is your company myopically focused on optimizing short-term financial gain?
We all want to achieve positive financial results. However, there is a growing body of evidence, supported by the continued evolution of risk management as a core business discipline, that the long view will more than likely deliver sustainable, lasting results. The continued evolution of enterprise risk management capabilities, processes and technology has more clearly brought into focus the relationship between short-term profit and long-term risk. Companies are more aware now than ever before, of the need to protect their brand and company reputation, achieve sustainable long-term financial returns, operate to sound values and ethical standards, and drive accountability through the organization to deliver on shareholder commitments.
That’s the good news!
However, challenges remain for the continued maturation and adoption of risk management, including increasing operating costs (i.e., increased headcount, technology investments etc.) coupled with the need to improve senior management visibility to a tangible return on investment. The latter is often times the greatest challenge. Yet, full integration of risk management into a company’s core operations, control environment and governance protocols, helps turn the intangible to tangible.
Defining your organization's risk appetite doesn't have to be a complex undertaking.
Here are some considerations of activities to aid the process:
Map your organization's exposure to enterprise risk – reputational, strategic, market, credit, operational, organizational, etc.
Prioritize identified risks based on the potential impact to your organization's strategic goals, vision and values
Use quantitative and qualitative analysis to assess your organization's current risk profile against each prioritized risk type
Assess the point at which each risk type could cause a disruption in your organization's ability to operate in a safe and sound manner, or meet strategic goals
Define your organization's risk appetite across each risk type, and set tolerance thresholds to trigger senior management and board of directors engagement as changes in risk profile occur
Use scenario analysis to test the impact of potential loss events to the organization's strategic goals and verify the adequacy of defined risk appetite and tolerance thresholds
Lastly, defining organizational risk appetite is not a one-time event. It is intended to continuously evolve and should become a component of the business planning cycle. It is also a key platform for risk management leaders to prioritize program objectives, align resources to priorities and secure investments to build new - or enhance existing - capabilities.
