Page 485 - COSO Guidance

Risk Appetite — Critical to Success | 13

The board and management may use these characteristics Culture
when setting appetite to ask questions such as the following: For many organizations, applying appetite requires a culture
that is aware of strategy, objectives, and risk. Management,
• Are we setting an appetite that needlessly hinders our by revisiting and reinforcing appetite, is in a position to
capacity for change? create a culture in which organizational goals are consistent
with the board’s goals, and to hold those responsible for
• Are our practices and culture aligned with our appetite managing risk within acceptable appetite.
with an emphasis on thriving in a changing world?
Many organizations are good at creating a risk-aware
• Would alternative strategies requiring a different appetite culture—one that emanates from senior management,
(higher or lower) significantly impact performance? cascades through the organization, and is supported by
the board. With an effective culture, each member of the
• Do we believe that our appetite will result in the desired organization is clear on what is acceptable and what is not,
risk profile? whether in relation to behaving unethically, pursuing the
wrong objectives, or encountering too much risk in pursuing
There may be other factors to consider as well. the right strategies and objectives.
Management should tailor those noted here, removing
considerations less relevant and augmenting those with Creating a risk-aware culture is important in reinforcing
other considerations. appetite to achieve the following:

• Consistency between appetite, strategy, objectives, and
We suggest organizations consider the relevant reward systems.
organization’s unique business context
when setting risk appetite.
• Consistent understanding of appetite and related
tolerances for each organizational unit.

• Consistent implementation across units.
EX AMPLE 4
Consideration of changing business conditions • Understanding of changes in appetite.
A newspaper decided that the risk of becoming
irrelevant in the news arena was so large that it We suggest organizations capture key
developed a strategy that essentially “bet the inputs and consider how to incorporate
company” on developing a new digital channel them into risk appetite (e.g., mission
for delivering news to its viewership. If the and vision, current strategic direction,
strategy had been unsuccessful in anticipating risk profile, and culture).
changes in readership habits, its subscription
base would likely fall to uneconomic levels.
The risk was high, but it was understood by all
involved in the process.
The board was well aware of the risks relating
to this strategy, having debated the issue
extensively, and it concurred with management’s
decision (an acknowledgment of the linkage of
strategy and appetite). The investing public was
also aware of them because both the strategy
and nature of the risks (the impact on stock
prices) had been communicated to them. It’s
notable that the strategy was carefully debated,
and the company was going to succeed or
die quickly—as opposed to an almost certain
slow death if it did not take on risk through an
aggressive strategy.

c oso . or g