Creighton campus building architecture

Risk Appetite Statements

May 28, 2020

WHY THE PANDEMIC RENDERED MOST RISK APPETITE STATEMENTS OBSOLETE

Just as Chief Risk Officers (CRO’s) were getting their Enterprise Risk Management (ERM) frameworks and governance models in place, in comes a disruptive pandemic risk! The venerable Risk Appetite Statement (RAS), which serves as the guiding risk governing document, has probably exceeded many key risk indicator (KRI) threshold levels.

What does this mean? Essentially, we are operating in an environment that is volatile, unprecedented, complex, and ambiguous (VUCA). From a CRO’s perspective, there are several strategic and policy related issues that need to be addressed. Of those issues, stress testing strategic initiatives through scenario planning, resetting performance and risk indicators, and developing skilled and agile response teams should be among the greatest importance. The importance of scenario and stress testing of the identified organizational strategic initiatives cannot be overstated. The Board of Directors and Senior Management would greatly benefit from engaging in formal and expertly facilitated scenario planning of the strategic initiatives. Ideally, the organization should develop three to four different scenarios , as diverse as possible, and organizational planned responses for each. How do the strategic initiatives hold up under these scenarios? What are the likely resulting economic impacts? What organizational strategies, operational changes, and communication strategies, would the organization utilize? 

Risk Appetite Statements

An organizational planned response like, “employees will have to work from home”, does not fully explore the intended and unintended consequences of that decision. There were probably plenty of organizations that had “work from home” as their response to several risk scenarios, but it wasn’t until the Pandemic that we fully understood all the details related to working from home. Response plans to scenarios need to be understood at a level where the organization can fully comprehend the operational and financial impacts of their decisions. If scenario and strategic planning work isn’t integrated correctly, the plans will not be effective in guiding an organization through the next major catastrophic crisis. Due to many factors, including technology and social media, potentially destructive organizational risks are now occurring more severely and frequently than ever before. The expert counsel of a trained scenarios planning facilitator can help guide the way. 

Another very important issue to address is the need to update the RAS. Most likely your Key Risk Indicators (KRI’s), which serve as early warning signs of threats to the strategic initiative assumptions, have also challenged their threshold limits. Likewise, KPI’s which track organizational performance towards plan and strategic goals, may also need to be recast. 

Trying to set new KRI and KPI levels in the midst of unprecedented events is probably not useful. Instead, consider first reviewing the organizational KPI’s and KRI’s and critically examine whether they are still the best indicators based on recent events. Next, track them for the next few quarters or up to 18 months depending on current circumstances. Keep in mind that indicators are going to be off for some time, as businesses and the economy try to recover. Tracking and observation will provide to be a better approach, with the establishment of new indicator warning levels resuming when ranges return to a more “normal” range. It’s also important to discuss the recent effectiveness of your organization’s RAS and KRI’s. In the case of the pandemic, the speed at which the risks evolved and impacted many organizations was simply too fast to fully warn the organization. By its nature, catastrophic risks often “hit” quickly and provide little to no time for an organization to react. If the risk is also unprecedented and impacts many aspects of operational, strategic, and financial areas, they can threaten the existence of any organization. While the current risk metric levels your organization is experiencing today may not be ideal for regular operating environments, benchmarking crisis levels are also valuable for future planning. 

When preparation seems to be a less effective way to address quickly emerging risks, then agility becomes paramount. To that end, the establishment of Critical Response, Emergency Operations, Office Oversight, Compliance Oversight and Policy Review Board teams can be an organizations best chance for survival. If an organization is well prepared and skilled, agility can provide additional strength. 

Stress testing strategic initiatives through scenario planning, resetting performance and risk indicators, benchmarking crisis risk levels, and developing skilled and agile response teams, are all immediately worthwhile pursuits for risk officers, senior management and board members. Unprecedented times are often when risk management and scenario discussions are the most important. Shared experiential learning through stories of things like the pandemic can often reveal opportunities and warning signs, which become clearer with the benefit of hindsight. Now is the time for Chief Risk Officers and risk owners to “sharpen the saw” and use the recent events as the burning platform needed to drive real process and governance change that will pay huge dividends down the road. 

Ed Horwitz

This article was a contribution by Ed Horwitz, Ph.D., CFP, FBS, ChFC, CLU, CSA. Dr. Horwitz is the Executive Director, Mutual of Omaha Chair in Risk Management and Associate Professor of Practice in the Department of Economics and Finance at Creighton University Heider College of Business. A business management senior executive, applied clinical researcher and published author with over 30 years of experience in the Financial Planning and Risk Management industry, Dr. Horwitz is regarded as a knowledgeable and optimistic leader who brings a winning attitude and trusted confidence to all settings. He is experienced in the development, implementation and coordination of new collegiate educational programs for financial planning, insurance, enterprise risk management, and financial psychology and behavioral finance.

Learn more about Creighton University’s offering in risk management. We also invite you to join our online crisis planning and enterprise communication management course or our online disaster recovery and business continuity refresh workshop being offered this Summer, 2020.