Is Corporate Risk Appetite Truly Relevant for Business Decisions?
This article challenges the conventional wisdom surrounding corporate risk appetite statements, arguing that they often fail to directly influence day-to-day business decisions. For internal audit and assurance professionals, this perspective is crucial for re-evaluating the practical utility and focus of risk appetite frameworks within their organizations, prompting a shift towards more granular, context-specific risk analysis rather than broad, abstract statements.
The Disconnect Between Risk Appetite Statements and Decision-Making
The author, Norman Marks, provocatively questions the relevance of corporate risk appetite statements in the context of real-world business decisions. He posits that while decisions inherently involve risk, the formal, overarching risk appetite statement rarely serves as a direct guide for specific choices. Marks draws a parallel to personal life, asking if individuals consult a personal risk appetite statement before making significant decisions like buying a house or choosing a spouse. He suggests that if such a statement isn't necessary for personal choices, its utility in business might also be overstated.
A Case Study in Pricing Decisions
To illustrate his point, Marks presents a detailed scenario: a company considering a price increase for its flagship product. He outlines the complex factors involved, including market sensitivity, competitor reactions, cost increases, and board pressure. A cross-functional team, including the CFO, CRO, and heads of various departments, analyzes three options: no change, a 5% increase, or a 10% increase. For each option, a multitude of risks and opportunities are identified, such as the likelihood of competitors following suit, customer loyalty impacts, and effects on cash flow. Marks emphasizes that an "informed and intelligent decision" relies on a thorough understanding of these specific risks and opportunities, not on a general risk appetite statement.
Focusing on Informed Decisions, Not Abstract Appetites
Marks argues that the value lies in the detailed analysis of specific risks and opportunities associated with each decision option. He contends that a corporate risk appetite statement does not, and cannot, effectively aggregate disparate and often unconnected sources of risk to provide actionable guidance for individual business choices. Instead, he suggests that tools like calculating the expected value of each option, facilitated by a CRO or a "math whiz," offer more practical and direct support for decision-makers. The core takeaway for internal audit is to encourage a focus on robust, context-specific risk analysis that directly informs strategic and operational decisions, rather than relying on abstract risk appetite declarations.
- Risk appetite statements often lack direct applicability to specific business decisions.
- Real-world decisions require detailed analysis of context-specific risks and opportunities.
- Aggregating diverse risks into a single "appetite" is impractical and unhelpful for decision-making.
- Internal audit should promote granular risk analysis and expected value calculations over broad risk appetite statements.
Read more
