Every organization that takes on positions or exposures sensitive to risk, whether from counterparty defaults, market fluctuations (prices and interest rates), compliance with contractual obligations, operating processes, technology and security vulnerabilities, requires as good practice a proper Risk Appetite and Tolerance Statement.
This Statement is the tool in which the Board of Directors and Senior Management define the risks they wish to take on, as well as the deviations they are willing to tolerate, in exceptional cases, by type of risk to achieve strategic and business objectives. It is useful for monitoring, managing and communicating integrated risks appropriately.
It is common to see multiple errors in the preparation of the Risk Appetite and Tolerance Statement, since in some cases it is done only because of regulatory obligation or simply as a reference document and not for the effective management of risks.
For the integrated risk management function to truly add value to the institution and, in turn, help protect its productive assets and its ability to generate profits, it is advisable to consider at least the following aspects when preparing the Statement:
Consistent with the institution’s strategic plan and objectives. The institution’s business and profitability objectives must be in line with the risks it would be willing to take on and tolerate. The involvement of the person responsible for risk management is vital in this process.
Risk indicators. Identify indicators that measure the factors that could cast doubt on the achievement of objectives. They must be risk indicators, forward-looking, and measure the losses or consequences of the risk materializing. Avoid excessive or exclusive use of performance or asset quality indicators in the Risk Appetite and Tolerance Statement, and also avoid confusing it with risk acceptance and authority policies.
Granular and operational. Define the variables and indicators in as much detail as possible. These can be determined by: a) types of risk, b) products or services, c) lines of business, d) customer profile, e) counterparties, f) location, etc. This makes it possible to “operationalize” its execution and monitoring.
Threshold definition. It is important that thresholds be consistent with the institution’s appetite and capacity and not merely a historical average of the indicator. It is common to see indicators within the defined thresholds that are nonetheless not coherent with one another.
Limit management. Recurring follow-up and monitoring of the behavior of each indicator against the defined limits and thresholds. The Risk Appetite and Tolerance Statementmust state the hierarchical position or body within the institution that could approve exceptions to the appetite, provided the result of the decision keeps the indicator within the tolerance levels. Limits must not, for any reason, be allowed to exceed tolerated levels.
Likewise, the maximum exception period and the actions to be taken in the short term to return the indicator to the desired levels within the declared risk appetite must be approved.
Review and update. It is very important that the person responsible for risk management at each institution ensures that the Statement is reviewed and updated at least annually or when the company is in an adverse situation.
Knowing how relevant and necessary it is to maintain a proper Risk Appetite and Tolerance Statement, the main recommendations for preparing it and the restrictions on its execution, do you think it is really a straitjacket for the institution’s management?
The answer is that definitely yes. The statement may surprise you, but it will depend on how it is interpreted and on the institution’s maturity in managing its risks.
It is considered restrictive because it keeps operations within the desired thresholds, preserving risk-adjusted profitability optimally according to the institution’s capacity; it does not accept exposures beyond tolerated levels and its monitoring is constantly communicated to the Board of Directors. Now, is that bad? It really is not.
Looking at the other side of the coin, what would be bad is if the Risk Appetite and Tolerance Statement were not prepared with the right criteria, affecting the institution’s performance and sound decision-making and becoming an obstacle to achieving objectives. In that case, the answer would still be yes, that is, it would be a straitjacket for the institution’s management, but in the negative sense.
It would be worth asking ourselves the following question: Is our Risk Appetite and Tolerance Statement a straitjacket on our management in a positive way? I hope the answer is yes; otherwise, it is never too late to make the necessary adjustments, promote risk culture in our institutions and add value.
Author: Carlos J. Rijo Montás
Linkedin
Leave A Comment
You must be logged in to post a comment.