RISK GOVERNANCE THROUGH RISK DIRECTION

A "risk" is an activity or function that has an uncertain outcome. These risks include both traditional downside risks (potential costs or losses to the company) and upside opportunities (potential benefits or revenues to the company.)

The board's role in risk governance begins with risk direction. The board needs to ask how the potential risks identified and presented by management affect its approval of the strategic plan and which objectives are likely to be more challenging to reach.

This process involves a journey of exploration, typically beginning with risk inventory and assessment reports from management and continuing with a dialogue about these risks until the board reaches a satisfactory level of confidence that it understands the risk environment facing the organisation. 

Risk direction typically does not occur separately from the strategic planning process. If you have ever done a SWOT analysis during your strategic planning sessions (SWOT stands for strengths, weakness, opportunities, and threats), risk direction is a significant part of a SWOT analysis.

You are looking at the uncertainties related to your internal and external environment and incorporating these into your strategy to decide which objectives you will pursue and what ranges and targets should be associated with those objectives.

RISK TOLERANCE AND RISK APPETITE

When boards think of risk direction for the organisation, they also consider the company’s risk tolerance and risk appetite. Risk tolerance means that the board and the management team have had a dialogue and have agreed on a range of tolerable possible outcomes for each objective. 

Achieving outcomes within this range is mutually acceptable to the board and management. For example, the board may have an objective to fill all vacant positions in ninety days, but what if it took one hundred and twenty days to fill some of the vacancies?

The board and management may agree that the late filling of vacancies would be an acceptable and tolerable risk which would not significantly impact the company's operations.

Alternatively, the board could have a zero-tolerance level for running out of cash to cover its payroll and trade payables because of the negative impact of such a liquidity crisis on its staff and the company's reputation.

A risk appetite determines the level or amount of risk the company is willing to take to achieve its strategic objectives. The level of risk appetite can have a significant impact on a company's business strategy and operations.

For example, a company with a high-risk appetite might be willing to take on more financial risk to gain a larger market share. On the other hand, a company with a low-risk appetite might be more conservative in its approach and focus on preserving its cash reserves. 

Therefore, consider your organisation's overall objectives and strategies when setting the risk appetite and tolerance. Review the organisation's risk profile, including its history of managing risk, current risk management practices, and ability to withstand losses.

The risk tolerances and appetites your board has approved from the strategic plan will inform management which risks they will focus on, abandon or attempt to mitigate and reduce, and finally, the opportunities to pursue to generate extra revenue.

By taking healthy amounts of risk in your organisation, you produce returns. The perception that risk management and risk governance are about minimising risk is why organisations fail to generate healthy, sustainable, efficient returns for their shareholders and other stakeholders.

Risks and opportunities should be an ongoing board conversation and a strategic board agenda item.

Happy Governing!