8 | | APRIL 2025RISK APPETITEBy Hugo Assagra, Group Head of Credit Risk Strategy, OSB GroupIN MY OPINIONBy effectively managing risk appetite, financial institutions can strike a balance between pursuing their objectives and maintaining prudent risk management practicesRisks are inherent to anything we do, and no organization can operate without being exposed to risks as they are necessary for achieving its objectives (the reward part of the equation). However, some risks can lead to devastating consequences and losses. So, the key is knowing what risks a company is exposed to or is willing to take and have the appropriate monitoring and management in place to respond quickly in case a mitigation action is required. The ISO 31000 risk management standard refers to risk appetite as the "Amount and type of risk that an organization is prepared to pursue, retain or take". This concept helps guide an organization's approach to risk management.Risk appetite management is an essential aspect of risk management framework. It helps define the level of risk that an organization is willing to accept in pursuit of its objectives and ensures that risks are properly monitored and controlled. When it comes to measuring risk appetite, both quantitative and qualitative measures are often employed:· Quantitative measures involve the use of numerical data and statistical analysis to assess risk levels. This can include metrics such as Value at Risk (VaR), stress tests, or risk-adjusted return on capital (RAROC). These measures provide a quantitative assessment of the potential impact of risks and help determine the tolerable limits within which an institution can operate;· Qualitative measures focus on the subjective assessment of risk appetite and often rely on descriptions, narratives and judgements rather than a numerical approach. This involves understanding the institution's risk culture and awareness, strategic goals, risk tolerance, amongst other qualitative aspects of the risk management framework. An effective risk appetite framework must have both depth to support the company's strategy execution, and breadth to reflect all risk categories a company is exposed to ­ financial and non-financial risks. The implementation of a risk appetite framework should follow the following high-level approach:· First and foremost, a company needs to have clarity on its strategic objectives as this will drive the enterprise-wide risk appetite statement measures and limits a company is committed to operate within. This happens at the highest level of the organization and will be governed by the board of directors and Executive Committee;· Secondly, key risk drivers and specific policies and principles should be derived from the risk appetite statements and determine the way measures and limits will be operationalised;· Finally, the principles and policies will support the definition of detailed and more specific risk appetite metrics, limits and triggers articulating both quantitative and qualitative measures across all types of risk.Risk Appetite ManagementOnce the risk appetite framework is well defined and approved by the Board, the company needs to establish the appropriate Hugo Assagra
< Page 7 | Page 9 >