Page 482 - COSO Guidance

10 | Risk Appetite — Critical to Success

Board and management perspectives Ideally, the board and management will choose to use an
on appetite approach that incorporates appetite into decision-making
Boards and management have choices on how appetite with more detailed indicators that help monitor
will be applied within the organization. The organization will accepted risks.
need clear direction from the board and management on the
following:
We suggest organizations determine
• Whether the organization will adopt an approach that whether the organization will apply a
views appetite through an objective-focused lens or monitoring approach or one that integrates
3
a risk lens, or an approach that integrates these two decision-making and monitoring practices.
approaches.

• The focus on monitoring performance and Risk requisite for performance
decision-making. Appetite often focuses largely on what to avoid and misses

the important factor: that every organization takes risks to be
• The focus not only on risks the organization wishes successful. For instance, appetite may focus on areas such
to avoid but also those it wishes to take on to as the following:
enhance value.

• Not exceeding a credit threshold.
• The extent of natural tensions needed for appetite to add
depth in discussions on analysis in support of decisions. • Managing to a staff turnover ratio.

• Stakeholder views the organization will incorporate • Maintaining a minimum number of sales opportunities in a
into appetite. sales pipeline.
Decision-making and monitoring • Meeting supply chain requirements.
There are two broad ways that apply appetite. One widely
used approach focuses on monitoring to provide feedback
on how the organization is performing. Organizations often
use appetite to form risk boundaries. A matrix showing a
statement of risk, key performance measures, target, actual
performance, and appetite boundaries allows management
to monitor whether current risks are within appetite. Such
monitoring can trigger conversations on when to revisit
decisions, and perhaps appetite or strategy.

A second—perhaps more important—approach is to apply
appetite in the context of decision-making. Using appetite
in this context can enhance the extent of analysis and
challenge of the chosen strategy and objectives as well
as the organization’s ability and capacity for managing
activities within the parameters of acceptable risk.

In essence, the decision-making approach is more
anticipatory (considering risks that may lie ahead). This
allows an organization to be more resilient to future changes
and disruption. Conversely, the monitoring approach is
often reactionary, responding only when the outcomes of
potential risks affectimpact performance. Such impacts can
be mitigated somewhat by using leading indicators, but, in
reality, most organizations rely mainly on lagging indicators.

. . . . . . . . .
3 Key tasks are summarized in Appendix B.

c oso . or g