Overview

Reviewing risk appetite is an important process for any business to support effective risk management. It involves assessing whether the current risk appetite is aligned with strategic objectives, operational capabilities, and the external environment.

The risk appetite helps guide a business in developing its processes, ensuring that risks are taken and managed in line with business goals. For a business with lower risk appetites, this often means implementing more robust control processes to manage risks within acceptable thresholds. This typically requires more resources, effort and cost.

Care must be taken when setting risk appetite as lower risk appetites will generally introduce more control processes, which takes more resources and can slow down the organisation, while higher risk appetites increase the chances of things going wrong and the consequences associated with those incidents.

In StartRisk the risk appetite can be adjusted in the Risk Class Editor view.

The First 12 Months:

It's particularly important to monitor and review risk appetite closely in the first 12 months after setting it for the first time. During this period it is crucial to identify any misalignments between the risk appetite and the actual risk tolerance for the business.

When reviewing risk appetite during this period, consider the following internal indicators that risk appetite may be set too low:

• are critical risks (risks identified as being outside of appetite) able to be tolerated?
• are risks being identified as being critical too often?
• do additional control processes for critical risks appear to be excessive and not required?
• is there a disproportionate allocation of resources towards managing risks, diverting attention and resources from more significant risks or strategic initiatives?
• are existing controls either consistently failing or being bypassed because they are too onerous?
• is feedback being received that working with the business is too difficult or onerous indicating controls are too extensive?

And the following internal indicators that risk appetite may be set too high:

• are strategic and operational goals being achieved?
• are incidents occurring that are negatively impacting the business or its objectives?