Articulate your risk appetite to drive business growth

This is the first article for my new Managing Partner column on how law firms can use risk management to improve their business performance.

Which ‘r’ word do you associate with risk – reward or regulation? While regulation may be an important factor in your risk governance and management approach, it should not be the tail wagging the dog. At a strategic level, risk and reward go hand in hand: you cannot grow your business without taking risks.

Understanding your risk appetite is about determining the nature and extent of the risks your firm is willing to take to achieve its strategic objectives. It should be considered as part of the strategy development process.

Risk and reward will need to be balanced in a way that is consistent with your firm’s fundamental purpose and values. The key is to ensure that setting risk appetite is not a box-ticking exercise – a dull board agenda item to be endured to satisfy the regulator or the expectations of corporate clients.

As a minimum, the board and senior management should be able to articulate their risk appetite in a statement which is then embodied in the firm’s risk policy and effectively communicated to all business decision makers, setting the tone from
the top.

Making a statement

The complexity of your approach to risk appetite should be proportionate with the complexity of your business.

The question of what your risk appetite statement should look like will depend on the nature of your business, but it should include consideration of the firm’s willingness to accept risk against the following:

1.  earnings volatility;
2.  financial capital;
3.  reputation impact;
4.  regulatory standing; and
5.  human capital.

This is best brought to life with an example. The firm should be able to express its risk tolerance or appetite against each of these factors and then use this assessment as a yardstick against which to compare strategic opportunities. For example, a new market entrant might be willing to accept a high degree of earnings volatility, but be capital constrained and particularly sensitive to its regulatory standing. Or, an established firm might be willing to put more capital at risk to secure the firm’s future, but be very concerned to preserve the business’s reputation built up over a number of years.

Business opportunities should then be assessed in the context of the risk appetite. This should happen at the top of the organisation for strategic decision making:

• Shall we expand into China?

• Shall we switch to a product-led strategy?

• Shall we exit private client work?

It should also happen throughout
the organisation for operational
decision making:

• the firm is very sensitive to regulatory standing, so it will manage the regulatory impact of all decisions very closely; or

• the firm is focused on earnings volatility, so it will manage the short-term profitability impact of decisions, even
  at the expense of longer-term benefits.

Dynamic approach

As the external market environment and the firm’s strategic ambitions change, so too will its risk appetite. So, while it should be set alongside and aligned with the firm’s strategic planning period, your risk appetite should be a ‘live’ concept in the business (in the same way that your strategic plan is), not documented and filed away.

Risk appetite should be measurable,
but there is a balance to be achieved here: It is far better to invest time in discussing how your risk appetite impacts your objectives than to be endlessly debating how to measure it.

It may be you choose to quantify this in financial terms: What level of earnings volatility can your firm tolerate? How
much capital will it put at risk? What
level or regulatory fine could it take?
Or, alternatively, you may prefer to use a numeric scale assessing high, medium
and low risks using a rating of 1 to 5.

Enterprise-wide management

Your risk appetite must be integrated in your risk governance and management framework – it is not a standalone concept. The role of the board includes independent oversight and setting organisational culture, strategic objectives and risk appetite. Risk management includes the activities taken to:

• identify, prioritise and evaluate risk;

• assess controls and compliance; and

• monitor and report on performance in the context of the governance framework set by the board.

Risk appetite needs to run through both governance and management. It will shape decision making at a strategic level, at the same time as informing risk response at an operational level. With the right investment, you can define clear measurable parameters which will help to guide your board and senior management colleagues in achieving your firm’s strategic objectives.

Louise Fleming has 20 years’ experience working with professional and financial services firms in business and risk management. She will be presenting on risk appetite at Managing Partner’s Risk Management for Law Firms conference
on 3 December 2014.