Skip to main content
Blog Post

Bringing risk appetite into strategy

Insurance Consulting and Technology|Reinsurance
Risk Culture

By Paul Simmons | August 14, 2019

A Strategic CRO must help the board and management understand the organization’s risk appetite to better support business planning discussions.

Unlock More

About our ‘A Year in the Life of the Strategic CRO’ series

In our ongoing A Year in the Life of the Strategic CRO series, risk experts from our Insurance Consulting and Technology team, Willis Re and other parts of Willis Towers Watson cover how how a strategically focused CRO can drive corporate strategy through the enterprise risk management planning process and throughout the year.

Viewing the risk appetite purely as a red flag is simplistic and fails to appreciate the value and assurance that the strategic chief risk officer (CRO) can bring to the business planning process. This article from A Year in the Life of the Strategic CRO series explains how to enhance the risk appetite to better support business planning discussions.

What role does the risk appetite play in setting strategy? In the first instance, the board needs to understand how the proposed strategy compares with their preferences for risk. The risk appetite therefore needs to be designed in preparation for that comparison. Analyzing that comparison, the consequences, the options available to management and demonstrating the robustness (or otherwise) of all of these is where the strategic CRO can use risk appetite to add value to the strategy process.

What can the strategic CRO do in advance of the strategic discussion?

Designing the risk appetite to be adaptable and flexible, and to facilitate a strategic discussion, is important. In practice, the board’s preferences for risk will always have some lines that are harder than others. The key is to carefully articulate the risk appetite to reflect this flexibility but also to retain teeth where it matters.

The risk appetite also needs to be meaningful throughout the business planning horizon. Or from another perspective, since the business plan is forward-looking, risk appetite should be too. Including the rationale for a risk appetite statement as part of that plan, can help identify circumstances when the appetite should be adapted as the business plan progresses, so that it remains as relevant at the end of the business planning horizon as it is at the start. Equally, understanding the rationale for risk appetite can facilitate analysis of how it might respond to key strategic decisions, and to identify circumstances when the risk appetite is no longer fit for purpose and should be restated.

Can a breach of risk appetite ever be tolerable? When articulating the risk appetite, it can help to challenge the board about what should actually happen in practice when a threshold is breached, and whether it would ever be acceptable for a business plan to include a predicted breach. The practicalities of a breach should include:

  • Management information and alerts that should be triggered (including those to regulators)
  • Ongoing monitoring and reporting, and the requirements on management or the board to take action to remediate the breach

We would expect these to vary by risk, and on the circumstances. The latter in particular, will require careful articulation to allow the board a degree of flexibility but also remain robust. To illustrate, we would typically expect a firm’s risk appetite to feature a ladder of intervention, with the earliest thresholds triggering alerts to management and elevated levels of monitoring and reporting, but requiring no action unless projections show the position worsening or failing to recover.

What levers does the strategic CRO have to support a strategy? Defining the management options available to improve the business’s key metrics before the strategy discussion is an important step in the risk management process. Risks should not be managed only as they arise; businesses should be prepared to manage risks before they happen. Undertaking such exercises, prior to the business planning process, provides comfort to the board (and regulators) that the business is robust and prepared for any eventuality. Yet any options must be carefully presented to avoid expectations that force management to act against their will.

Considerations for analyzing management options include:

  • How much impact will such options have?
  • How long will they take to implement?
  • What steps are required in practice to put the option into effect?
  • How might circumstances and time affect the availability of options?

Having a menu of such options and ensuring they are carefully considered and credible can enable the strategic CRO to readily provide solutions rather than just problems.

How will the strategy perform under different circumstances? Alas, no strategy is certain. The strategic CRO can help articulate the risks inherent in the strategy by highlighting the key assumptions and the impact of those on business plans. Understanding the risks that most preoccupy board members (along with those that should concern them), will help drive engagement in the financial projections. And demonstrating how the plan can withstand those risks, perhaps through the exercising of management options, or otherwise, can help provide assurance as to the robustness of the plan.

What other risk appetite-related considerations should the strategic CRO bring to the strategy process?

  • Risk appetite should reflect the metrics that matter to the business. If investors and regulators are concerned by the solvency ratio, then the risk appetite, the associated management reporting of capital and appetite, and the possible management options, should all focus on the solvency ratio.
  • The strategic CRO should maintain sight of non-biting metrics. We frequently see companies calculating combinations of regulatory, economic and rating agency capital, but board attention is solely focused on the biting constraint. The CRO needs to understand the circumstances when a switchover might occur, and to bring that discussion into the board’s strategic considerations when relevant. Equally, we would expect the CRO to maintain sight over a range of metrics, both currently and over the business planning horizon, that might not otherwise concern the board, in case any grow to become significant.
  • The discussion of strategy and risk appetite should not be restricted to financial or quantifiable risks.
  • Ultimately, the risk appetite needs to reflect the board’s attitude toward risk, not just now but over time and as the business evolves. Fully capturing that attitude, and the implications are the key to elevating the risk appetite into the heart of the business planning and strategic decision-making processes.

    Previously in the A Year in the Life of the Strategic CRO series: Wild risks that could dramatically change the world


Paul Simmons
Senior Consultant

Contact Us

Related solutions