The “Risk Appetite” of the Corporate Board

 Building a risk intelligent board requires multidimensional thinking, asking profound questions, taking a periodic risk assessment; weighing risk and reward, and focusing on governance effectiveness.

We live in an era of information abundance but insight scarcity, full of uncertainty, velocity, complexity, and ambiguity. The result is a higher risk of conflict and inertia.

 For the majority of organizations, the accountability for the 'oversight' of risk is ultimately on each individual. Senior board leaders should set the tone and have the right dose of risk appetite for improving risk management effectiveness and overall governance maturity. That means looking into an unknown future and attempting to define the landscape with its risks and opportunities, to steer the business ship in the right direction.


The risk attitude and appetite of the corporate board: The real BoDs dilemma is that driving the business forward is extremely difficult. Generally speaking, there are two types of risks: negative (loss of value, money, and business) & positive (opportunity to make money, expand the business, and create value). There are all sorts of risks such as planning risks, operation risks, innovation risks, expansion risks or reputation risks, etc, Some risks can be quantifiable; others can only be approximated, which is not good enough and it’s the main reason why management may choose to forgo mitigating such risks. BoDs do not manage risks but oversee risk and ensure that management has put in place an effective risk-management process. It’s important to evaluate how robust the organization's risk assurance system is, all the way up to the management board.

Risk appetite implies some abilities to actually measure risk level, the directors assess whether risks are undertaken and managed consistently with the established risk appetite. The corporate board’s responsibilities include taking control of the softer issues such as making policy, the strategic thinking of GRC, setting risk appetite, etc. This also involves addressing risks to reputation, and the need to be transparent and the ability to define risk appetite and risk culture for the business. No board will find this easy, but continuous practice will ensure a more controlled outcome that protects reputation risk.

The risk context of the organization: Technically, most of today’s risk and risk management is reserved for huge and costly endeavors. The problem with this is that poor decision-making and a lack of risk awareness creates more blind spots uncovered and gaps unfilled. Operational management will often do the business risk oversight and report up to the Board. Risk management context aids us in understanding what’s relevant and what’s not. ”Seeing' the context you are “part” of, allows the management to identify the leverage points of the business system and then 'choose' the 'decisive' factors.

More often, business is still fundamentally looking at risk in a negative context but in reality, risks and opportunities co-exist in today’s business dynamic. Thus, adapting risk context at the point of analysis to identify the upside can make a significant impact on unlocking business growth potential. Companies should put in place a risk appetite system that goes beyond high-level statements. You can then use the more granular risk appetite statements to monitor risk-taking in the business, and make a seamless transition from risk mitigation to risk intelligence.

Information Technology risk context factors: Technology brings both significant opportunities and risks for organizations today, IT is often one of the disruptive forces behind digital innovations. Therefore, Digital Boards today need to become IT-friendly and technology savvy, to ensure rigorous compliance with regulatory requirements and develop the best/next practices to implement risk intelligence, in order to run and protect business flawlessly. When board directors or senior leaders have sufficient knowledge and understanding of IT, they can leverage IT risk context factors, make a sound judgment about IT investment and know-how to assess IT performance objectively.

In fact, IT becomes a frequent topic in the boardroom, beginning with the IT leader’s sum up of IT project/portfolio status, and articulating significant details the boards are supposed to know. Portfolio management is essential to successful corporate governance and as such, a comprehensive fusing of a firm's strategic capabilities. The successful understanding of IT risk context leads to survival by mitigating risks, and the accumulation of enough resources to thrive by capturing opportunities in it and adapting to the uncertainty and changes timely.

Delegations of risk management: Whereby the BoD assumes the dual role of guidance and governance steering, whilst leaving the day-to-day leadership/management process in the hands of the C-level executives. They should take the key responsibility for ensuring that whoever is delegated has all the systems and controls, along with the necessary authority, required to manage the risk. Regardless of what methods or indicators are used, the key is to oversee risks in business terms that can really make a business impact.

Since nearly every decision impacts future events that have yet to happen, this really means that understanding and managing risk should be a part of everyone's job description. Instead of risk management being viewed as the role of a few people in risk management or internal review, it needs to be viewed as the responsibility of every person in the organization that makes a decision and involves risk. The corporate board should set good policies to improve accountability and delegations of risk management to ensure smooth business transactions and transformation.

Organizations encounter more risks than ever due to over-complex business dynamics. Lacking risk awareness creates more blind spots uncovered and gaps unfilled; lack of risk appetite perhaps causes business stagnation, and lack of risk intelligence might lead to the mighty falling down sooner than later. Building a risk intelligent board requires multidimensional thinking, asking profound questions, taking a periodic risk assessment; weighing risk and reward, and focusing on governance effectiveness.

Posted in: Board Room,GRC