An exceptional risk management professional, Jason Moses leverages more than 10 years of experience to help financial institutions implement risk management solutions – including developing risk appetite statements. As Senior Business Advisor at Ncontracts, he collaborates with banks, credit unions, and other financial companies to build out robust appetite statements that help them make strategically sound decisions.
We sat down with Jason to find out what goes into a risk appetite statement and how to use it as a tool to guide your institution to success.
Table of Contents
- What’s the goal of a risk appetite statement?
- Where do financial institutions go wrong with risk appetite statements?
- Why is it a problem to have an underdeveloped risk appetite statement? Can you give me an example?
- What’s the first step in drafting a risk appetite statement?
- What role do key risk indicators (KRIs) play with risk appetite statements?
- Any closing thoughts on risk appetite statements?
Q: What’s the goal of a risk appetite statement?
Jason: A risk appetite statement translates the whole organization into a very detailed strategy document. It gives you a centralized sense of where you stand as an organization.
It goes back to strategic planning and strategic initiatives. Are we implementing the right strategies? Did we make the right decisions?
If you’re choosing the wrong strategies and miscalculating risk, your risk appetite will be a guidepost showing that, hey, this isn’t working like we planned.
Q: Where do financial institutions go wrong with risk appetite statements?
Jason: Many risk appetite statements are very simplistic, one-page documents. They don’t go into any supporting detail answering why, for example, the risk appetite for compliance risk is low or moderate.
It’s a 30,000-foot view of risk, and it doesn’t speak to where the institution is organizationally.
Eventually, institutions need to have a viable risk appetite statement. It’s not just putting together a piece of paper because you need it for an exam or to show the board.
It must make sense and has to mean something. When you’re completing all your risk assessments, you need to compare the results to something. That something is your risk appetite.
On a positive note, I see a lot of institutions are beginning to realize their risk appetite statements are not up to par, and they want to improve them.
Q: Why is it a problem to have an underdeveloped risk appetite statement?
Jason: Risk appetite statements are critical from a strategic standpoint. They define an institution’s appetite for different types of risk so that institutions understand how they can grow and make prudent decisions.
It’s hard to make prudent decisions as an organization when you’re operating without a real risk appetite statement. Just picture a billion-dollar organization that has no idea where it stands or what its appetite level is in different areas of risk. It’s a dangerous way to operate.
Related: Emerging Risks in Banking 2023
Q: What’s the first step in drafting a risk appetite statement?
Jason: It starts with research. Interview all your key departments, stakeholders, and those involved at the business processes level to get a full picture. Hold a Q&A session.
You want supporting data for why your risk appetite is low, moderate, or high. If the risk appetite is changing, show why that is the case.
Let’s use credit risk as an example. Let’s say your institution only wanted super safe loans on its books and had a strict limit on the volume of risky loans. Looking at the data, you might discover loan growth is stagnant and loan losses are minimal. You are losing to the competition. You might find there is a lot more room to take more risk in this particular area.
In this case, you might make a strategic change to still mostly underwrite loans from fully documented loans to borrowers with 680+ credit scores but will now take a slightly larger, clearly defined percentage of riskier loans. You want that level of detail, all the minutia, bullet points, and supporting detail for why risk appetite has changed.
Now that you know risk is higher, you’ll want to make sure that risk is mitigated appropriately. That switch from low to moderate risk appetite is a significant change organizationally.
Q: Can you give me an example?
Jason: Let’s say you’re developing a new product. You need to know how much risk the new product could pose to your organization, how much your company could lose, and if it’s too big a gamble.
I like to use the term risk capacity. Does the organization have the risk capacity to handle potential losses and the negative consequences of the risk?
Related: Risk, Reward and a 3,000-Foot Drop: Breaking Down the Risk in Free Solo
On the other hand, there's actually a lot of positive elements of risk too. Risk management requires looking at both sides of the coin and making an educated estimate knowing that if it's miscalculated, it could be very damaging to the institution.
You don’t want to spend all sorts of time and effort on research and development only for the product to fail due to lack of interest in the product. Your institution may be significantly harmed by the results.
Q: What role do key risk indicators (KRIs) play with risk appetite statements?
Jason: There's a lot of connecting tissue between KRIs and risk appetite statements. They all tie back to the risk management process.
Your risk indicators are forward looking. They help you see patterns. They show if you are moving in the right direction. In many ways, they are a symptom.
For example, there might be a concerning pattern of key employee attrition. If you see an uptick when you check in – whether that’s quarterly, every six months, or however often your policy or procedure requires a check in – it shows you there might be a problem. It might show that risk is increasing, so you can take steps to address it early on before it exceeds your risk appetite.
You’ll want to explore the root cause of what’s happening within the organization. This leads to risk controls. You need to go under the hood and collaborate with stakeholders, decision makers, and others within the organization to discover why there is an issue.
Related: Hate Talking About Risk Management Controls? You’re Not Alone.
Is it an issue of pay? Compensation packages? Is it the culture of the organization? Have there been complaints? Is it a management issue? Is it your location?
You want to know which way you’re going, why it’s happening, and whether you need to do anything about it.
Q: Any closing thoughts on risk appetite statements?
Jason: Just like everything else in risk management, your risk appetite statement is a living document. It’s a guidepost, but it can change. However, those changes must be carefully researched, discussed, and documented. It’s a lot harder to hit a moving target.
Aiming to improve your FI’s risk posture?
Learn more about Nrisk and Ncontracts professional services.
Subscribe to the Nsight Blog
Share this
Risk Management Planning
Regulating the Future: What Financial Institutions Need to Know About AI and Regulatory Risks
