VIEWPOINT

2023

D O YO U K N OW YO U RRISK APPETITE?
An effective risk appetite framework
to drive decision-making
AUTHORS
Today’s business environment is evolving at a fastpace, driven by rapidly emerging technologies,
geopolitical upheaval, and other unpredictable

Tom Teixeira
Marcus Beard

events, making it increasingly difficult for leaders

Stephen Watson

to navigate risks effectively. Organizations need

Ben Hansen

to make risk-related decisions within a clearly
defined risk appetite that is well understoodacross both strategic and operational levels. In thisViewpoint, we share how leaders can ensure they
are well positioned to seize opportunities and takecontrolled, informed risks to increase the chancesof meeting their business objectives.

Dominic Thompson

ARTHUR D. LITTLE

VIEWPOINT

THE ROLE OF RISK APPE TITE
IN CORP OR ATE S TR ATEGY
An organization’s risk appetite is the amountof risk it is willing to take in pursuit of its- Risk target — sets an organization’s desiredrisk level, ideally striking a balance between
risk and reward- Risk limits — provide clear boundaries thatspecify the upper extent of risk exposure,objectives. It is a key component in a proactive

ensuring that it remains within acceptable

and adaptable corporate strategy, especially intimes of global turbulence. Organizations cannavigate uncertainty more effectively by using
risk appetite as a guiding set of principles as they
make strategic decisions that position them forsuccess in today’s unpredictable world.
Clearly defining risk appetite enables anorganization’s leaders to identify and prioritize
potential risks, establish limits and thresholds,
and allocate resources effectively. Risk
appetite is closely related to other concepts
and components within an organization’s risk

parameters
When taken together, these elements alignstrategic aspirations with risk-taking capabilities
to create a comprehensive framework that guides
an organization’s approach to risk management.
Figure 1 shows how the above considerations
interact within a large organization.
The rise of emerging technologies such as
ChatGPT and other artificial intelligence (AI)tools has rapidly accelerated the pace of changearound the world, triggering continuous anduniverse:

significant disruptions across social, political,- Risk capacity — quantifies the maximum

appetite frameworks, organizations can betteramount of risk an organization can prudently
handle, given its resources and financial
capabilities- Risk tolerance — reflects the organization’s
threshold for bearing risk and its capacity toendure potential losses

and economic landscapes. By incorporating risk
grasp the significance of their risk profile andmake informed decisions about which risks totake and which to avoid in a constantly changing
global environment.
Incorporating risk appetite into corporate strategy
is an ongoing process that requires collaboration
between multiple departments, from finance andoperations to marketing and legal.

Figure 1. Risk universe of a large organization
Figure 1. Risk universe of a large organization

Risk capacity
Amount/type of risk
an organization can accept
in pursuit of strategic objectives,balancing both threats& opportunities

Risk appetite

Amount/type of risk anorganization can support
in pursuit of business objectives

Risk tolerance
Risk target

Optimal level of risk anorganization wants to takein pursuit of business goal

Risk limit

Maximum risk anorganization can takeregarding each relevant risk

A threshold to monitor so exposure
doesn’t deviate much from risktarget & stays within organization’srisk tolerance & appetite; exceeding
limits will typically trigger
management action

Source: Arthur D. Little

DO YOU KNOW YOUR RISK APPETITE?

Source: Arthur D. Little

2

ARTHUR D. LITTLE

VIEWPOINT

THE P OWER OF A RISKAPPE TITE FR AME WORKWHY RISK APPE TITEFR AME WORKS FAIL

Implementing a risk appetite framework supports

While the benefits of establishing andan organization by aligning risk taking with

implementing a risk appetite framework are clear,

the organization’s objectives and goals, which

many organizations struggle to do so effectively. It

enables leaders to make better decisions while

is relatively easy to create a risk appetite statement

ensuring resources are effectively allocated.

to meet a short-term need or to tick a box for a

A risk appetite is agreed upon by leadershipparticular stock exchange listing, a corporate

and decision makers and is more than any one

governance requirement, or regulatory compliance.

individual’s subjective judgment.

Organizations face four common challenges when

The risk appetite statement is a key component

trying to design and implement a risk appetiteof an effective framework. However, on its own,

framework:a simple statement fails to link to businessobjectives or cover the entire risk universeof an organization. It cannot provide leaderswith something tangible to use at the board or
executive level, and it cannot be used in isolation
to cascade down the organization to drive action.

1. The organization has cultural barriers toeffective risk management. Organizations
can promote a culture that rewards risk taking
and innovation, but this often leads to a lackof discipline and oversight around risk andreveals a lack of clarity about how much risk

A well-balanced risk appetite framework isshould be taken in different situations. Here,supported by both qualitative and quantitativea risk appetite statement would likely be

information. By establishing limits andseen as an obstacle that impedes the desired

thresholds, organizations can see when they

entrepreneurial culture that is important

are approaching the upper limits of their risk

to the organization’s success. Overcoming

tolerance. They can reduce their exposure tothese barriers requires effective alignment

risk and operate within agreed-upon limits byof risk appetite mechanisms with strategic

distributing resources more effectively. In aobjectives, while rewarding corporate behavior

complex business, one risk appetite statementthat emphasizes informed, risk-conscious

will not be sufficient — indeed, the frameworkdecision-making. Defining a risk appetite

in which risk appetite is defined will haveframework should be seen by leaders as

many dimensions (e.g., political, geographical,

similar to putting high-performance brakes

operational, financial, legal) requiring appropriate

on a car, allowing the car to go faster whenstatements and tolerances to make themroad conditions permit.

meaningful.

2. The organization fears documenting the

In an ever-changing business landscape, anrisk appetite framework. Organizations

effective risk appetite framework that uses aunder extreme levels of external stakeholder

dynamic approach can help companies stayscrutiny sometimes have concerns aboutahead of the curve. By embracing this concept

documenting their risk appetite framework.

and building a supportive digital platform,

They fear that the level of scrutiny imposedorganizations can better manage their risks,on the framework by external stakeholders

improve the chances of achieving their goals,

could cause reputational damage or obstruct

and take risks from a controlled and informed

effective decision-making.

perspective.

DO YOU KNOW YOUR RISK APPETITE?

3

ARTHUR D. LITTLE

VIEWPOINTREQUIREMENTS WILLVA R Y D E P E N D I N G
O N T H E N AT U R E O F
T H E O R G A N I Z AT I O N ,T H E I N D U S T R Y, A N D
THE COMPLEXIT Y OFT H E R I S K S I N V O LV E D

4. The rapid pace of change and evolution in thebusiness environment makes it difficult tomaintain a relevant appetite framework. Risk
appetite statements have, rightly, come underheavy criticism in the past for being generic,boilerplate mechanisms with limited impact
and value. As such, leaders need to ensure risk
appetite reflects the reality of the businessenvironment and characteristics of theirorganization, which can be achieved through3. A coordinated effort is required toensure that risk appetite is meaningful
to everyone throughout the organization
and adopted at all levels. This will result in
effective communication and collaborationin relation to risk taking; in particular, the risk
appetite statement must be well understoodand applicable at operational and projectlevels. Arthur D. Little (ADL) recently worked
with a global construction organizationthat successfully integrated corporate risk
appetite for commercial risk into its day-today activities. The integration was achieved
through setting group minimum commercial
expectations, which covered topics such ascontingencies and liquidated damages. All
the teams involved in negotiating contracts

the proactive monitoring and horizon scanningof changes in their operating environmentand revising the risk appetite as needed. Thisrequires ongoing risk evaluation as well as
agile reviews of the framework to ensure it
remains relevant and effective, as opposed toa document that is dusted off once a year.
To overcome the above challenges, organizations
need to balance qualitative and quantitative
information and incorporate the findings intoa framework that facilitates clear decisionmaking and does not create a barrier to getting
things done. The framework must include athorough assessment of the type of risks facing
the company and access to an extensive setof underlying data. When complete, it shouldbe implemented using a comprehensive andclearly understood these expectations (and bysystematic approach.

extension, the commercial risk appetite) but

Underpinned data needs to be accurate, up to date,were unlikely to think of it as risk appetite. Thisand relevant to create a meaningful, effective risk

level of integration should be the goal for all

appetite statement. Specific requirements will vary

types of risk. If risk appetite awareness is still

depending on the nature of the organization, thelacking, it can be built through regular training

industry, and the complexity of the risks involved

and education. Merging risk appetite into

but are likely to include:

key strategic decision-making mechanisms- Strategic and organizational data
- Risk data
- Financial data
- Regulatory and legal data
- Scenario-analysis data
- Benchmarking dataand processes, such as scenario analysis andstress testing, can also make a difference.
In another example, ADL worked with amultinational transport operator whose CEO
set a clear appetite for no fatalities and to
make a positive and measurable difference tosafety in every country it operated. This drove
behaviors throughout the entire corporation
down to drivers and mechanics.

DO YOU KNOW YOUR RISK APPETITE?

4

ARTHUR D. LITTLE

VIEWPOINT

Of course, in most organizations, substantial

Case study 1 — Major Middle Easterndata will already be available, with existing

real estate company

dashboards for measuring performance, so little
will need to be invented or started from scratch.

A regional major real estate organization

However, it is necessary to use this data within awanted to make a substantial long-more structured framework, so that it functions
within the context of risk appetite, risk tolerance,and risk targets to better drive decision-making.
Finally, organizations must commit to maintaining
effective communication and collaboration acrossall levels; as the business model changes, it will callfor ongoing dynamic monitoring and adapting therisk appetite framework.

term investment in a major commercial
development. The executive leadershipteam developed their risk appetitestatement with quantified thresholds
based on business objectives and targets.
However, the supervisory board thoughtthat the quantified thresholds were tooconstraining in several key risk appetite

DESIGNING A SUCCES SFULRISK APPE TITE FR AME WORK

categories and did not encourage risktaking or opportunity seizing that the board
was keen on. The risk appetite statement
supported a challenging set of interactions

There is no one universally defined templatethat will work for all. We have identified typicalfeatures of risk appetite frameworks (see Figure 2)
from best practices across different sectors andfrom organizations of different scales to illustratepossible formats:- A set of key risk categories that encompass

between the supervisory board and theexecutive leadership team, reflecting theambidextrous nature of organizational
leadership and the need to show a strong
quarterly performance balanced against
the need to support substantial growth bytaking controlled risks.

an organization’s entire risk universe — what
it is facing today and what may occur in the
short to medium term.

- A clear link to business objectives.
Figure 2. Typical corporate risk appetite
Figure 2. Typical corporate risk appetite
Risk appetite scale
Key risk
category

Business
objectives

Key area ofrisk underconsideration

Impacted
corporate
value/
strategic
objective

To align risk appetite
to organization's corporate
strategy, risk areas should
be mapped against relevantbusiness objectives &corporate values

Zero

AverseModerate Tolerant

Verytolerant

Risk appetitestatement

KRIs & threshold values

Risk appetite statement
provides qualitative and,
where necessary,quantitative description
and justification of risk
appetite scale position

A sliding scale allows
easy comparison &understanding; this scale
should align with risk
assessment criteria

Risk appetite statements
will provide justification
for risk appetite rating
scale; statements
designed at a level thatcan be understoodacross organization

KRIs give a quantitative
measure of risk appetitewith quantitative limits& threshold values definedfor each key risk area; these
KRIs support qualitative
statements

Impactedstakeholders

List ofstakeholders
impacted

To supplement risk appetitestatement, internal &external impacted
stakeholders should
be highlighted foreach risk area

Source: Arthur D. Little

DO YOU KNOW YOUR RISK APPETITE?

Source: Arthur D. Little

5

ARTHUR D. LITTLE

VIEWPOINT- Scales used are the same as the

A value-adding risk appetite framework must beorganization’s risk matrix and are clear

kept up to date. For example, it needs to addresson the impact categories (e.g., financial,both the threats and opportunities that AI

reputational, or regulatory).

technology can bring to the corporate context.

- Quantification of risk appetite per key risk
category, when possible.

- A description of the risk appetite, per key risk
category, which explains the quantificationand the broader organizational context.

- Identification of key risk indicators, threshold

Three years ago, few outside the domain of AI
could have imagined how ChatGPT could havebecome an everyday item of casual discussion.
The speedy development and widespread
application of ChatGPT necessitate a clear
understanding of how risk is affected and what
limits need to be set. The Italian government

warnings, and action limits to support

recently demonstrated zero tolerance for AI

proactive monitoring.

technologies and banned their use due to- Stakeholders who understand how the key risk
category fits into the organizational context;
the number of stakeholders impacted by risk
determines the amount of focus required.
It is important to note that many organizations

negative implications for maintaining data
privacy. Surprisingly, even in late 2023, we havespoken with many organizations that have notyet defined their appetite or enacted appropriate
controls to address AI or considered the business
opportunities it presents.

will often have several of these features inplace already, such as a set of KPIs to allow
them to react to adverse trends, and nearly allorganizations have an implicit risk appetite,even if it is not recorded in a formal framework.
Usually, the process of designing and building
a successful risk appetite framework involves
consolidating and formalizing the elements
and thinking that already exist across theorganization and capturing them systematically,as opposed to starting from nothing.

CONSIDER ATIONSFOR L ARGE , DIVERSE
ORGANIZ ATIONS
A large, diverse organization is an entitythat operates in various sectors, industries,
markets, or geographical locations and exhibits
significant variety in terms of its operations,products, and services. These organizations are
typically characterized by multiple business

So how can organizations create a robust risk

units (BUs), a global supply chain, a complex

appetite framework that serves as a practicalorganizational structure, and regulatory

tool? The above content and structure, which

complexity. A single risk appetite statement forinclude key risk categories that accurately cover

this type of organization may be insufficient. Its

the current, short-, medium-, and long-term

scope is more complex, with multiple BUs and arisks, offer an approach to developing a specificwide range of risk exposures; this necessitatescomprehensive framework.

extensive stakeholder engagements, granular

Keeping the risk appetite framework as a boardlevel document and embedding its content into
policies, standards, and specifications usedthroughout the organization is another approachorganizations have used successfully. This strategy
can support widespread decision-making thataligns with the risk appetite framework; however,any updates to the framework are much harder torisk assessments, and accommodation forvariations across units or markets. Separate risk
appetite statements for different BUs often need
to be considered, provided they align with theoverall corporate risk appetite. Communication,
governance, and resource-allocation structures
are more elaborate, and regulatory considerations
are often more complex.

implement because of the need to update multiple
related documents across the organization.

DO YOU KNOW YOUR RISK APPETITE?

6

VIEWPOINT

DO YOU KNOW YOUR RISK APPETITE?

ARTHUR D. LITTLE

7

ARTHUR D. LITTLE

VIEWPOINTS E PA R AT E R I S K A P P E T I T E
S TAT E M E N T S F O RDIFFERENT BUs OFTENNEED TO BE CONSIDERED

objectives. The organization’s overall attitude
toward risk (the concepts discussed earlier
and shown in Figure 1) and any recent or
historical loss history are also relevant. In
addition, organizations must consider the
emergence of a volatile environment andattempt to predict the risks and results that

Certain large organizations strategically embrace

could arise. A comprehensive understanding

higher risks in specific BUs to foster innovationof the organization’s risk exposure, as well as

and spur growth while maintaining a clear

the effectiveness of existing risk mitigation

separation from core business activities. By doing

strategies, is vital.

so, they create a controlled environment whereexperimentation and creativity can thrive. These
specialized units often operate with a greater
degree of flexibility and autonomy, enablingthem to explore emerging markets, disruptive
technologies, and unconventional business models.
While the core business maintains a conservativerisk appetite to ensure stability and meet regulatory
obligations, these dedicated BUs can have a moretolerant risk appetite and serve as innovation hubs.

- Cascading risk appetite throughout anorganization. To be effective, risk appetite
frameworks must be shared throughout theorganization through effective communicationand training. If the organization is relatively
homogeneous, this flow of information canfollow the approach used for any businessobjectives or metrics. However, a more tailoredapproach is required when the organization is
not homogenous, which could result from levels

The following principles for risk appetite frameworkof risk that fluctuate among BUs. The cascade

development are relevant to any organization

requires a comprehensive understanding ofregardless of size but are of particular importancethe organization’s risk culture and the barriers

for large, diverse organizations:to effective risk management. Organizations- Connecting risk appetite to corporate

must ensure that all employees understand thestrategy. Once potential risks have been
identified and analyzed, organizations must
develop clear risk appetite statements andsupporting metrics that align with their goals

importance of effective risk management andthat they are provided with the necessary tools
and training to implement the risk appetite
framework effectively.

and objectives. This requires a comprehensive

Revisiting the earlier example of the global

understanding of risk tolerance and appetite,

construction organization also shows that one

as well as an understanding of the impact thatcountry was home to a mix of BUs organized into

different risks can have on the organization’s

one multi-billion-euro-per-annum strategic BU,

ability to achieve its objectives. Risk appetite

containing:statements should be in place for each major- Civil engineering and infrastructurerisk category and communicated clearlythroughout the organization.

- Establishing measurable and actionablerisk appetite limits and thresholds.

Once risk appetite statements have been
finalized, organizations must establish
risk appetite limits and thresholds. Theselimits and thresholds should be based on
a comprehensive assessment of different
risks and their impacts on the organization’s

DO YOU KNOW YOUR RISK APPETITE?

maintenance BUs (typically governmentreimbursable contracts with known
engineering risks).

- BUs working on complex building projects

in the capital city. Commercial agreements
were complicated by aggressive private sector
clients, and operations were complicated by
the use of high-risk, cutting-edge engineering
technology.

8

ARTHUR D. LITTLE

VIEWPOINT- A BU focused on home building.
- An equipment-hire BU supporting other BUs.
- An infrastructure-investment business.
Each BU had different attitudes toward risk,
as well as different business models andexternal market drivers. The challenge was torepresent the risk appetite in one framework,
which recognized similarities and differences
and aligned with the group risk appetite. We
developed a separate risk appetite for each
BU, which reflected the different businessmodels and external market drivers and showed
differences from the group risk appetite. Thisapproach informed which specific risks were
escalated to senior management and allowed

AI, ML, and NLP can:- Pinpoint emerging risks.
- Predict potential outcomes of different risks.
- Inform senior management when a specificrisk theme is in or out of tolerance.

- Identify a new risk theme with an undefinedrisk appetite position.

In addition, these technologies can be used
to build predictive models that can informrisk appetite decisions and automate the risk
management process, reducing the risk of humanerror and increasing the speed and accuracyof risk assessments by developing a proactive,
forward-looking capability.

BU–specific thresholds to determine key risk
indicators, giving deeper insight to strategic BU
leaders when and where they were operating out
of tolerance.

Case study 2 — South American
national oil company

A national oil company had recently updated

AI & THE RISK APPE TITES TATEMENT OF THE FUTURE

its strategy to make it future-ready andTraditional risk management approaches struggle

was a lack of clarity at the executive levelto handle the complexity of risk exposure forover the existing corporate risk appetite

large, complex organizations in an uncertain

and which risks should be accepted,

business environment. AI and associatedtransferred, avoided, or mitigated, resulting

technologies may improve risk management,in misaligned decisions. An updated risk

but they also pose a threat.

appetite statement was developed that

The size and complexity of underlying risk
registers mean emerging technologies,
including machine learning (ML) and AI models
such as natural language processing (NLP),
can be leveraged to enhance the value of risk
appetite statements. These added resources
can carry out risk identification, quantification,
and aggregation in real or near real time andensure that the registers constantly reflect anorganization’s position with respect to its definedrisk appetite.

DO YOU KNOW YOUR RISK APPETITE?

was seeking a risk appetite to help achievethese revised strategic objectives. There

clearly articulated the strategic themes andobjectives likely to be impacted by each risk
category. Furthermore, key risk indicators
were attached to each risk category to enable
clear awareness of whether the organization
was within or outside its appetite. Validationof the risk appetite statement by both theexecutive team and the board of directors
clarified the organization’s stance against
key risks, thus facilitating enhanced,
risk-based decision-making across theorganization.

9

ARTHUR D. LITTLE

VIEWPOINT

CONCLUSIONF O R M U L AT I N G A N
INTER AC TIVE RISKAPPETITE FR AMEWORKE XECUTIVES SHOULD CONSIDERA C T I O N S T H AT C O N T R I B U T E
T O A R O B U S T, VA L U E - A D D I N G
R I S K A P P E T I T E S TAT E M E N T

Our experience shows that risk appetite frameworks
often exist in isolation. Executives should consider
actions that contribute to a robust, value-adding
risk appetite statement:
1

Recognize that risk appetite assists strategy
setting, understanding future scenarios, andmanaging priorities.

2

Translate risk appetite for the people making
day-to-day decisions by encoding it into
procedures, policies, and processes.

3

Remember that no template fits all; theframework reflects the business model.

4Choose an approach to drive corporate
culture that can be properly cascaded acrossthe organization and help people understandrisk within their own domains.

DO YOU KNOW YOUR RISK APPETITE?

10

ARTHUR D. LITTLE

VIEWPOINT

5

Deliver regular updates about emerging risks
at the board and executive levels. Links to horizonscanning processes keep statements timely.

6Consider the opportunity offered by AI to assess
risk appetite tolerances and set limits based on
analysis of internal and external contexts.

7

Use AI and digital platforms to monitor an
organization’s operations within the set limits andtolerances; provide proactive warnings as needed.

By establishing a risk appetite framework,organizations can get a wider view of their risk profileand make informed decisions in a rapidly changing
global environment.

DO YOU KNOW YOUR RISK APPETITE?

11

Arthur D. Little has been at the forefront of innovation since1886. We are an acknowledged thought leader in linking
strategy, innovation and transformation in technologyintensive and converging industries. We navigate our clients
through changing business ecosystems to uncover new growth
opportunities. We enable our clients to build innovation
capabilities and transform their organizations.
Our consultants have strong practical industry experience
combined with excellent knowledge of key trends and dynamics.
ADL is present in the most important business centers around theworld. We are proud to serve most of the Fortune 1000 companies, inaddition to other leading firms and public sector organizations.
For further information, please visit www.adlittle.com.
Copyright © Arthur D. Little – 2023. All rights reserved.