How to define and implement a Risk Appetite Statement Concept | Methodology | Technology IOR Scottish Chapter 2 nd Annual Conference Glasgow Caledonian University October 26 th, 2012

Page  2 | © Manigent 2012 Setting the scene "People know risk appetite is important, and they think they've got it. But the industry is still falling short on how to think about it [Risk Appetite]..." "Our challenge as non-executives is there is no definition. We are dealing with words, not well-understood and agreed concepts. There's no 'hitchhikers' guide' to risk appetite and no agreement there should be one" Tapestry Networks, Inc - Bank Governance Leadership Network, Insights from the non-executive dinners, June 16, 2010

Page  3 | © Manigent 2012 Objectives 1.To provide a practical approach to define and deploying risk appetite as a strategic management tool 2.Explain the role of risk appetite within the overall strategy process 3.Outline the steps and process around building a robust Risk Appetite statement Provide a ‘Hitchhikers guide’ to Risk Appetite!

Page  4 | © Manigent 2012 The credit crunch and subsequent fall-out is rewriting the rules on strategy execution and risk management

Page  5 | © Manigent 2012 Corporate governance weaknesses related to Risk Appetite contributed to the credit crunch Supervisors see insufficient evidence of board involvement in setting and monitoring adherence to firms’ risk appetite. Risk appetite statements are generally not sufficiently robust; such statements rarely reflect a suitably wide range of measures and lack actionable elements that clearly articulate firms’ intended responses to losses of capital and breaches in limits. Supervisors see insufficient evidence of board involvement in setting and monitoring adherence to firms’ risk appetite. Risk appetite statements are generally not sufficiently robust; such statements rarely reflect a suitably wide range of measures and lack actionable elements that clearly articulate firms’ intended responses to losses of capital and breaches in limits. Board-level engagement in risk oversight should be materially increased, with particular attention to the monitoring of risk and discussion leading to decisions on the entity’s risk appetite and tolerance. Remuneration structures for all such “high end” employees are appropriately aligned with the medium and longer-term risk appetite and strategy of the entity. In essence, the obligation of the board in respect of risk should be to ensure that risks are promptly identified and assessed; that risks are effectively controlled; that strategy is informed by and aligned with the board’s risk appetite; and that a supportive risk culture is appropriately embedded so that all employees are alert to the wider impact on the whole organisation of their actions and decisions. Board-level engagement in risk oversight should be materially increased, with particular attention to the monitoring of risk and discussion leading to decisions on the entity’s risk appetite and tolerance. Remuneration structures for all such “high end” employees are appropriately aligned with the medium and longer-term risk appetite and strategy of the entity. In essence, the obligation of the board in respect of risk should be to ensure that risks are promptly identified and assessed; that risks are effectively controlled; that strategy is informed by and aligned with the board’s risk appetite; and that a supportive risk culture is appropriately embedded so that all employees are alert to the wider impact on the whole organisation of their actions and decisions.

Page  6 | © Manigent 2012 Post credit crunch, UK Corporate Governance Code was updated to be more specific about Risk Appetite The UK Corporate Governance Code issued in May 2010 states that ‚the Board is responsible for determining the nature and extent of the significant risks it is willing to take in achieving its strategic objectives…and should maintain sound risk management and internal control systems.

Page  7 | © Manigent 2012 Organisations are increasingly looking to ‘Risk Management’ as a source of competitive advantage Neither too cautious nor too reckless, the best companies use their risk management capabilities to adjust either their capacity or their appetite to make more prudent— and ultimately successful— investment decisions. Source: Accenture 2011 Global Risk Management Study 64% Almost two-thirds of Risk Masters 64% indicate that their risk management capabilities provide competitive advantage to “a great extent,” compared with only 42% of the peer set.

Page  8 | © Manigent 2012 Evidence suggests many corporate governance weaknesses and Board level challenges still exist “the Board is responsible for determining the nature and extent of the significant risks it is willing to take in achieving its strategic goals.” UK Corporate Governance Code, % “only 21% align their risks with their business strategy” – Grant Thornton Corporate Governance Review 2011 Where the Board need to spend more time… 70% Strategy 42% Execution 47% Performance Management 67% Risk Management 21% “Only 21% of directors surveyed claim a complete understanding of their companies’ current strategy” – Mckinsey Global Survey – Corporate Governance, 2011 “results indicate a need to better educate Boards on industry dynamics and how their companies create value...” Approx participants

Page  9 | © Manigent 2012 The definition of Risk Appetite is clear, but the application is less well understood  The COSO definition provides ‘What, Who, When and Why’ of risk appetite  What: the amount and type of risk  Who: an organisational entity  When: over a defined time horizon  Why: to achieve the objectives of the entity Risk appetite is the amount and type of risk that is acceptable to be taken by an organisational entity over a defined time period, to achieve the objectives of that entity – COSO Enterprise Risk Management Risk appetite sets the boundaries within which strategy is executed – Manigent Risk appetite sets the boundaries within which strategy is executed – Manigent

Page  10 | © Manigent 2012 Risk Appetite is a multidimensional construct, which changes depending on the organisational entity and its objectives Extreme High Moderate Low Overnight 90 days Annual CreditLiquidityOperationalMarketStrategic Investment Banking example We are willing to put £x million of risk to trade on our own account over the next 12 month period. We hold no more than x% of our capital in overnight positions. We will accept operational losses of £x million per month. Investment Banking example We are willing to put £x million of risk to trade on our own account over the next 12 month period. We hold no more than x% of our capital in overnight positions. We will accept operational losses of £x million per month. Water Industry example We have no appetite for causing customer illness by supplying poor quality water. We have no appetite for appearing in local press related to leaks or fines for more than 2 consecutive days. Water Industry example We have no appetite for causing customer illness by supplying poor quality water. We have no appetite for appearing in local press related to leaks or fines for more than 2 consecutive days.

Page  11 | © Manigent 2012 Risk Appetite Setting process 1. Joint Board / Executive appetite familiarisation workshop(s) 3. Joint risk dimension workshop(s) 4. Board appetite setting workshop(s) 4. Executive appetite setting workshop(s) follow- up meetings 5. Joint Appetite setting workshop (s) 6. Joint Board / Executive Appetite sign- off  This process is designed to quickly establish the organisational boundaries – risk appetite.  Step 3 can be combined with either step 2 or 4.  Splitting the workshops in step 4 is designed to bring out different views / perspectives, but these can be combined.

Page  12 | © Manigent 2012 Defining Risk Appetite in Seven Steps To design a robust risk appetite statement follow these steps: 1.Identify the Key Value Drivers for the Business 2.Define Risk ‘Buckets’ based on Key Value Drivers 3.Define a set of Strategic Objectives 4.Define and Assess a set of Key Risks 5.Align Risk-taking to Strategy 6.Define the Risk Appetite statement 7.Monitor the Alignment of Risk-taking to Appetite

Page  13 | © Manigent Identify the Key Value Drivers for the Business Business Goals Business Drivers Business Model Internal AnalysisExternal Analysis Business Objectives Strategy Appetite Appetite Alignment Risk Management Performance Management Appetite Identify strengths & weaknesses Identify threats & opportunities Is our business model fit for purpose? Are we operating within appetite? Manage threats & opportunities Are we on-track to deliver? Manage strengths & weaknesses Appetite Setting Execution Formulation Develop the strategic plan Distil strategy into actionable objectives with defined appetites Continuously align and monitor risk taking to business strategy

Page  14 | © Manigent Identify the Key Value Drivers for the Business cont. Performance Management Risk Management Strategy Management Appetite What are we trying to achieve? Are we on track? What is our Risk Appetite? Are we operating within appetite? Governance & Communications Culture

Page  15 | © Manigent Identify the Key Value Drivers for the Business cont. Business drivers Capital Income Reputation Shareholder value Share price Economic value add Profit Strategy Align Risk-taking to Strategy Manage Risk Manage Performance Appetite Governance Communication Culture Appetite

Page  16 | © Manigent Define Risk ‘Buckets’ based on Key Value Drivers Business Drivers Low Moderate High Extreme Capacity Limit Income X% X% X% X% Capital Up to X £M X £M to Y £M X £M to Y £M X £M to Y £M Above X £M Reputation Up to X vol. Bad coverage

Page  17 | © Manigent Define Risk ‘Buckets’ based on Key Value Drivers cont. Business Drivers Low Moderate High Extreme Capacity Limit Income X% X% X% X% Capital Up to X £M X £M to Y £M X £M to Y £M X £M to Y £M Above X £M Reputation Up to X vol. Bad coverage

Page  18 | © Manigent Define a set of Strategic Objectives

Page  19 | © Manigent Define and Assess a set of Key Risks The risk of (what, where, when)….. caused by (how) ……resulting in..…(impact/consequences) Examples  The risk of financial deficit at end of year caused by decreased in-patient activity and revenue, resulting in rationalisation of service offerings.  The risk of exceeding A&E waiting times, caused by increased demand and staff vacancies, resulting in not meeting community expectations and adverse patient outcomes

Page  20 | © Manigent Define and Assess a set of Key Risks cont. The risk of (what, where, when)….. caused by (how) ……resulting in..…(impact/consequences) Examples  The risk of financial deficit at end of year caused by decreased in-patient activity and revenue, resulting in rationalisation of service offerings.  The risk of exceeding A&E waiting times, caused by increased demand and staff vacancies, resulting in not meeting community expectations and adverse patient outcomes

Page  21 | © Manigent Define and Assess a set of Key Risks cont.

Page  22 | © Manigent Align Risk-taking to Strategy

Page  23 | © Manigent Define the Risk Appetite statement Business Drivers Low Moderate High Extreme Capacity Limit Income X% X% X% X% Capital Up to X £M X £M to Y £M X £M to Y £M X £M to Y £M Above X £M Reputation Up to X vol. Bad coverage

Page  24 | © Manigent Define the Risk Appetite statement cont.

Page  25 | © Manigent Monitor the Alignment of Risk-taking to Appetite Impact x Likelihood (over a time horizon) Appetite sets the boundaries for the business within which they execute strategy and create value. Therefore the Appetite Alignment Matrix provides a method of visually monitoring and managing our risk taking according to the strategy, identifying where too much or not enough risk is being taken. Appetite sets the boundaries for the business within which they execute strategy and create value. Therefore the Appetite Alignment Matrix provides a method of visually monitoring and managing our risk taking according to the strategy, identifying where too much or not enough risk is being taken.

Page  26 | © Manigent Monitor the Alignment of Risk-taking to Appetite Strategy MapRisk Map Appetite Alignment Matrix

Page  27 | © Manigent 2012 Q & A