Академический Документы
Профессиональный Документы
Культура Документы
IRM does not accept any liability to any party for any loss, damage or costs howsoever arising, whether directly or
indirectly, whether in contract, tort or otherwise from any action or decision taken (or not taken) as a result of any
person relying on or otherwise using this document or arising from any omission from it.
Appendix A:
Risk appetite statement from Berkeley Group
Appendix B:
Risk appetite context and statement from Network Rail
Appendix C:
Abridged risk appetite statements from Worldpay Group
Appendix D:
Extracts from the FRC report ‘Boards and Risk’ (2011)
Appendix E:
Extract from the IRM report ‘Risk Appetite and Tolerance’ (2011)
Appendix F:
List of sources of risk appetite disclosures used in this report
1
https://www.frc.org.uk/Our-Work/Publications/Corporate-Governance/Guidance-on-Risk-Management,-Internal-Control-and.pdf
Examples of detailed risk appetite statements are included in An important consideration regarding the development
this report as Appendices A, B and C. The approach of boards of risk appetite statements is decisions about the format
to producing risk appetite statements is discussed in the FRC for the statements. Many companies only produce and
report ‘Boards and Risk’ (2011) and relevant extracts of that publish limited information about the contents of their risk
FRC report are included as Appendix D. An extract from the appetite statements, whereas other companies provide good
executive summary of the IRM publication on Risk Appetite information into how the statements are structured. It seems
(2011) is included as Appendix E. Finally, a list of the sources of logical that risk appetite statements should be structured to
risk appetite reports used as examples throughout this report is align with the risk classification system used in the organization.
included as Appendix F.
Risk appetite statements may be structured in line with risk
The methodology for developing a risk appetite statement(s) sources, components of the organisation that may be impacted
will vary from company-to-company, although some insight is by the risk event and/or impact or consequences categories.
provided in the report and accounts published by the selected Risk appetite information is often based on analysis of risks
companies. It appears that most companies adopt the as (1) financial; (2) infrastructure; (3) reputational; and (4)
following steps when developing their approach to risk appetite marketplace. The risk appetite statement of the Network Rail
and the production of associated risk appetite statements. is provided in Appendix B is an example of a risk appetite
statement that is structured using these categories of risk.
The board is ultimately responsible for group risk management The board attitude to and appetite for risk are communicated
process and internal control systems. It has considered the to group businesses through the strategy planning process.
nature and extent of risks it is willing to take in pursuit of strategic In determining its risk appetite, the board recognises that
objectives. The board has assessed the group risk appetite, a prudent and robust approach to risk mitigation must be
which is set to balance opportunities for business development carefully balanced with a degree of flexibility so that the
and growth in areas of potentially higher risk, whilst maintaining entrepreneurial spirit which has greatly contributed to the
reputation and high levels of customer satisfaction. success of the company is not inhibited.
Ibstock Compass Group
The board and the executive management team use a Big Yellow Group provides information on their hedging
combination of different and complementary skills to assess strategy for interest rates and this provides a clear indication
the risks facing the business. In determining its risk appetite, of their risk appetite for this type of market risk. BP extends
the board considers: the information on risk appetite for market risks, by providing
• updates provided by senior management on key strategic information on specific types of risks, including commodity
and operational matters; prices, foreign currency exchange and interest rates, as well, as
• the group three-year strategic plan, budget and credit risk and liquidity risk.
viability statement;
• significant matters that have been reserved for the board;
• group risk assessments facilitated by the group risk function; The group is exposed to interest rate risk as entities in the group
• the reports of the internal and external auditors; and borrow funds at both fixed and floating interest rates. The risk
• risk appetite guidelines relating to the group principal risks. is managed by the group by maintaining an appropriate mix
Burberry Group between fixed and floating rate borrowings, and by the use of
interest rate swap contracts. Hedging activities are evaluated
regularly to align with interest rate views and defined risk
Serco Group provides information on the structure of their risk appetite; ensuring optimal hedging strategies.
appetite statements and how they are related to the principal Big Yellow Group
risks faced by the company. The approach of linking individual
risk appetite statements to risk categories leads to adopting
the same structure of risk appetite statements, as shown by The group is exposed to a number of different financial
Network Rail in Appendix B and Worldpay Group in Appendix risks arising from natural business exposures as well as its
C. ITV describe how operational risk appetite measures are use of financial instruments, including market risks relating
embedded into the board discussions as a means of validating to commodity prices, foreign currency exchange rates and
the content of risk appetite statements. interest rates; credit risk; and liquidity risk. The group financial
risk committee advises on financial risks and the appropriate
financial risk governance framework. It provides assurance that
Executive committee will assess the risk appetite for each financial risks are in accordance with group policies and group
of the principal risks. Risk appetite statements are being risk appetite.
developed that will be reviewed and endorsed by the corporate BP
responsibility and risk committee. These statements will be used
to define the risk tolerance levels throughout the business, and
along with our values, code of conduct and mandatory ethics
training will provide clarity on the group risk culture.
Serco Group
The board has set out strategic risk appetite objectives, aligned
The corporate risk management process continues to be with the strategic plan, to provide boundaries for setting
effectively embedded and robust discussion on risk, mitigations risk appetite for all material risks. The strategic risk appetite
and risk appetite occurs at both the operating board and objectives are:
divisional leadership team levels. The risk management process • Maintain capital adequacy.
is supported by the principle that the board is focused on those • Deliver stable earnings growth.
risks capable of undermining the strategy or long-term viability • Designed to ensure stable and efficient access to
of the company and damaging its reputation, and business funding and liquidity.
as usual risks are assessed and managed by the divisional • Maintain stakeholder confidence.
leadership teams.
J Sainsbury Strategic risk objectives are the bridge between the RBS wide
business strategy and frameworks, limits and tolerances that
are used to set risk appetite and manage risk in business
During the year, the risk committee reviewed the principal risks, franchises on a day-to-day basis.
the associated risk appetites and metrics, and challenged and Royal Bank of Scotland
confirmed their alignment to the achievement of strategic
objectives. At each meeting, the committee considered the
ongoing overall assessment of each risk and management The IHG risk appetite is reflective of the nature and extent of
actions and mitigations in place and planned. This review was risk that the board and IHG are willing to take and manage in
supported through consideration of quarterly risk dashboards pursuit of our strategic and other objectives. This is cascaded
outlining both principal and any escalated local risks. through the goals we set, the strategy we choose, the decisions
Sage Group we make and how we allocate resources. Specific limits and
guidelines for risk-taking are reflected in our governance
committees and structures, our policies (eg Delegation of
Authority policy), and the targets we select.
InterContinental Hotels (IHG)
The company reports used to produce this report are listed in • Monitoring impact of risk appetite statements
Appendix F and examples have been extracted that provide The monitoring of each principal risk is required and
useful lessons for risk professions, in relation to the following: successful financial performance is achieved by managing
risks through intelligent decision-making and an effective
control environment. Likewise, there are benefits in
• Context for risk appetite statements integrating risk management and risk appetite activities, so
Context needs to be established prior to identifying risk that validation of risk appetite becomes an integral part of
appetite. The first component of context is the external risk management processes.
business environment for the company. The next
component is the internal context, including the risk culture
of the company. Finally, the third component of context is • Governance of risk appetite statements
the risk management context, including board responsibility There needs to be an integrated approach to the
for overall risk appetite, tolerance and strategy. development, implementation and governance of risk
appetite. The role of the risk committee should be specified
and the role of the board in relation to risk appetite
• Design and content of risk appetite statements should be emphasised across all defined categories of risk,
The approach of linking individual risk appetite statements including strategic, tactical, operational and compliance.
to risk categories leads to adopting the same structure of
risk appetite statements. Some risk appetite statements
need to be very specific, such as hedging strategy for
interest rates or other market risks, including commodity
prices, foreign currency exchange and interest rates, as well,
as credit risk and liquidity risk.
For each risk, we identify current controls and their effectiveness The company will only tolerate low-to-moderate gross exposure
to manage underlying causes and minimise consequences. to delivery of operational performance targets including
All principal risks are mapped to performance reporting and network reliability and capacity and asset condition, disaster
strategic objectives. The assessment of risk is informed by the recovery and succession planning, breakdown in information
performance targets and the company risk appetite statements. systems or information integrity.
Principal risks and uncertainties 5. Data Security Risk: Financial loss and reputational
damage due to breach of data or technology disruption
caused by internal/external attack. Risk appetite:
Eight principal risk categories have been identified and each
Worldpay has no tolerance for the loss of, or otherwise
has been assigned a qualitative risk appetite statement
unauthorised or accidental disclosure of, customer or other
supplemented by various principal risk metrics.
sensitive information.
1. Industry Risk: The payments industry is constantly changing
6. Technology Risk: Unscheduled system downtime impacts
and sector developments, mandatory industry changes that
our service to merchants causing reputational damage
are not correctly implemented. Risk appetite: Worldpay will
and financial loss. Risk appetite: Worldpay is not willing
always seek to remain current and adhere to all regulations
to accept risks that compromise our ability to process
unless prevented by our system infrastructure.
merchant transactions.
2. Legal and Regulatory Risk: Failure to adhere to legal,
7. Scale of Change Risk: The risk of loss of profit, opportunity,
regulatory and financial crime requirements leads to
reputation or disruption to business activities as a result
financial and reputational damage. Risk appetite: Worldpay
of inability to manage magnitude of change being
will obey the spirit and the letter of the laws and regulations
undertaken. Risk appetite: Worldpay has no appetite for
that apply to us.
failure to deliver high-priority projects on time, to budget
and expected quality.
3. Settlement Risk: Failure to settle with merchants due to
lack of availability of funds as a result of scheme or systemic
8. Third Parties Risk: The risk of loss from reliance on third
bank failure. Risk appetite: Worldpay has no appetite for the
parties carrying out core business activities. Risk appetite;
failure to settle with merchants.
Worldpay is willing to accept the risk of working with
contracted third parties for core business activities.
4. Credit Risk: Potential loss arising from failure of a merchant
or partner bank or payments provider to meet its obligations.
Worldpay Group plc
Risk appetite: Worldpay budgets for credit loss, however our
Annual Report and Accounts 2015
risk appetite seeks to optimise a high level of return whilst
achieving appropriate risk versus reward performance.
Edited extracts from the Financial Reporting Council (FRC) Where boards had set their risk appetite or tolerance for
report ‘Boards and Risk: A summary of discussions with individual risks, some companies also compared the net and
companies, investors and advisers’ published by the FRC in gross risks to the ‘target risk’, so that the Board could judge
September 2011. how close the company’s current exposure was to that which it
considered acceptable.
There were differing views about whether it was either
necessary or possible for the board to apply a single, aggregate The importance of ensuring that incentives were aligned with
risk appetite for the company as a whole, as opposed to having company strategy and risk appetite or tolerance to promote an
a clear view on its appetite or tolerance for individual risks. appropriate culture was widely recognised. There were different
Many participants felt this was difficult, not least because views on the extent to which companies had succeeded in
of the difficulty of quantifying many of these risks and the achieving this alignment.
company’s limited ability to mitigate a number of them,
including external risks. A view was expressed that it was even Participants from companies said that in their experience most
more difficult for non-financial companies than for financial investors rarely asked questions about risk or internal control.
companies, particularly companies or groups operating across There was a general wariness about disclosing commercially
different sectors and markets, given the diverse nature of the sensitive information or information that, if disclosed, might
risks they were dealing with. It was also noted that risk appetite bring about the very risks the company was seeking to avoid.
can vary over time. Reporting on the company risk appetite was felt to be difficult
as risk appetite was not constant but varied over time and
Some participants felt that all that could realistically be depending on market conditions, if it could be defined at all.
expected of the board was to have a clear understanding of The same could be said about the overall exposure to risk.
the company’s overall exposure to risk, and how this might However, some directors and risk managers accepted there was
change as a result of changes in the strategy and operating a need to find ways of conveying more useful information.
environment. When developing the strategy, however, it was
important for boards to agree their appetite or tolerance for
individual key risks. At its simplest, it was suggested this could
be done by articulating what types of risk were acceptable and
what were not.
2
https://www.frc.org.uk/FRC-Documents/FRC/Boards-and-Risk-A-Summary-of-Discussions-with-Comp.aspx
The following key principles have underpinned our work 4. Risk appetite should be developed in the context of an
on risk appetite: organisation’s risk management capability, which is a
function of risk capacity and risk management maturity.
1. Risk appetite can be complex. Excessive simplicity, while Risk management remains an emerging discipline and
superficially attractive, leads to dangerous waters: far better some organisations, irrespective of size or complexity,
to acknowledge the complexity and deal with it, rather than do it much better than others. This is in part due to their
ignoring it. risk management culture (a subset of the overall culture),
partly due to their systems and processes, and partly
2. Risk appetite needs to be measurable. Otherwise there is a due to the nature of their business. However, until an
risk that any statements become empty and vacuous. We organisation has a clear view of both its risk capacity and
are not promoting any individual measurement approach its risk management maturity it cannot be clear as to what
but fundamentally it is important that directors should approach would work or how it should be implemented.
understand how their performance drivers are impacted
by risk. Shareholder value may be an appropriate starting 5. Risk appetite must take into account differing views at a
point for some private organisations, stakeholder value or strategic, tactical and operational level. In other words,
‘Economic Value Added’ may be appropriate for others. while the UK Corporate Governance Code envisages a
We also anticipate more use of key risk indicators and key strategic view of risk appetite, in fact risk appetite needs to
control indicators which should be readily available inside be addressed throughout the organisation for it to make
or from outside the organisation. Relevant and accurate any practical sense.
data is vital for this process and we urge directors to ensure
that there is the same level of data governance over these 6. Risk appetite must be integrated with the control culture of
indicators as there would be over routine accounting data. the organisation. Our framework explores this by looking
at both the propensity to take risk and the propensity to
3. Risk appetite is not a single, fixed concept. There will be a exercise control. The framework promotes the idea that
range of appetites for different risks which need to align and the strategic level is proportionately more about risk taking
these appetites may well vary over time: the temporal aspect than exercising control, while at the operational level
of risk appetite is a key attribute to this whole development. the proportions are broadly reversed. Clearly the relative
proportions will depend on the organisation itself, the
nature of the risks it faces and the regulatory environment
within which it operates.
3
https://www.theirm.org/media/464809/IRMRiskAppetiteFullweb.pdf
COMPANY REPORT
The British Land Company PLC Annual Report and Accounts 2016
InterContinental Hotels Group PLC Annual Report and Form 20-F 2015
Marks and Spencer Group PLC Annual Report and Financial Statements 2016
The Royal Bank of Scotland Group plc Annual Report and Accounts 2015