Risk Appetite

GRC Academy in Oman

Global Risk Clinic GRC News global trends, Governance, GRC News, Risk Appetite, Risk management, Risk Mitigation, risk trends

The GRC Academy and OBA organized a 3-day CERMP certification course in Muscat, Oman.

The program was delivered by Global Risk Clinic with the support of the Oman Banks Association at the OBA’s offices in Muscat, Oman. The course was designed to deliver the fundamentals of Enterprise Risk Management (ERM) and an understanding of advanced ERM topics. A number of bankers participated in this course that was held at the OBA office located in Muscat, Oman.

OBA Academy is part of the Oman Banks Association. It focuses on educating the Omani banking community on global trends, recent developments, and best practices by working closely with international and reputable resources such as the Global Risk Clinic, to share their knowledge and expertise with senior banking executives and decision-makers. Over the last couple of years, OBA and GRC Academy delivered about 12 courses together in Muscat, around Enterprise Risk Management. The OBA itself has also delivered other courses such as Environment Social Governance (ESG), commercial law, data protection, consumer protection, cybersecurity, customer service, and value added tax.

The Global Risk Clinic and OBA are planning a 1-day event around Cyber Security and Anti-Money Laundering in September 2023, in Muscat. The event will be followed by a panel discussion and live entertainment.

Oman Banks Association is a non-profit professional association created to represent the banking sector, promote Omani banking activities, coordinate with regulators on matters of policy and strategy, and support banking excellence in Oman.

This article was published in one of Oman’s biggest business news websites, Zawya. Find the article here.

Learn more about our CERMP in Oman course here.

Risk Mitigation

Global Risk Clinic GRC News Governance, Risk Appetite, Risk management, Risk Mitigation, risk trends

Risk mitigation means making the direct (money lost) or indirect (e.g., reputational) impact of a risk less severe.
Risk is not inherently bad and risk-taking leads to rewards and often has a potential of success for a business. Risks should be mitigated to a level, which aligns with the overall strategy of the organization.
The ”guiding light” for the amount of residual (risk left when mitigation has been applied) an organization should take on should be described in a risk appetite from the board of directors.

Click here for more information about risk appetite

Risks can be accepted as is if they are within the risk appetite or mitigated in the following ways:

Avoided: Do not conduct the activity associated with the risk. If the risk of doing business in, for instance, a certain country or industry does not outweigh the reward, get out of the country or industry and focus on areas where the reward outweighs the risks.

Transferred: Move the risk out of your organization. If the risk seems to outweigh the reward or if the risk involves activity outside of your core area of business, the activity can be outsourced to another organization or insurance can be purchased to transfer the impact of a risk.

Controlled: A control is any activity, guideline, or system that minimizes the risk from occurring. A control can either be preventive or detective and manual or automated.
Implementing controls can either lower the likelihood of a risk occurring or the impact if the risk does occur.

Note: A control costs money and a risk can be over controlled. When designing a control environment, it is essential to see controls in the context of the entire value chain, and not just in the context of a single business area or process. In mature organizations conducting holistic risk assessments will often lead to cost savings and opportunities to be more efficient as too many controls are in place. A focus should be on having few but good key controls in place across value chains.

The following provides a guideline for how to categorize and describe controls.

Preventive and Detective Controls: Does the control prevent the risk from happening or detect the risk if it does occur. If cash is kept on a table a locked door is a preventive control and a camera is a detective control.

Manual or Automated Controls: Does the control happen as a manual step in a process or is the control automated in a system. If too many zeros are added to an amount this can be caught manually by having someone else review the data input or it can be caught by a system by having tolerance levels programmed.

Key Controls: A key control is relied upon to prevent the risk from occurring, or detect the risk when it has occurred.

General Controls: General controls are not specifically relied upon to minimize the risk, but contribute to the prevention or detection of the risk. Hiring good and honest people and having a good risk culture are examples of general controls which are important but not key to any specific risk.

Control Description

When describing controls, it is essential to use a uniform way of writing, which can be applied across the entire organization. The following is an example of how to write a control:

1. Who – The employee/area or system performing the control

2. Which – The “control word” e.g. alerts, approves, automatically, confirms, monitors, reconciles, reviews, tests, validates, verifies

3. What – The information the control is performed on

4. When – The trigger, timing and/or frequency of performing the control

5. Why – The outcome/reason for performing the control

6. Action – the action taken if the control catches an issue

Example of a control written in the above format: A trader reviews the daily trade report at the end of the day to ensure trading data is accurate and alert the broker and the back office for corrective actions if the data is inaccurate.

Tips:

Focus on enterprise risk management.

Unfortunately, most organizations come up with different ways to assess risk and describe controls depending on the areas involved. This leads to inefficiencies and lost opportunities in leveraging and aggregating information across the organization. If, for example, the head of audit and the Chief Risk Officer have different ways of describing key controls opportunities to work together and add value to the organization will be lost. Each organization should only have one way to manage risk.

Develop a one-page dashboard to report on and monitor risk on an ongoing basis.

Combine process development and maintenance with risk assessment. Successful risk mitigation involves assessing and implementing processes and controls at the same time.

Our advisors have experience developing risk management frameworks across the globe and can help you tailor a risk management framework suited for your organization.

Get in contact

Risk Appetite Framework

Global Risk Clinic GRC News GRC News, Risk Appetite, Risk management

GRC advisors are receiving questions on an ongoing basis about risk appetite. Regulators across the globe and most recently in Asia, have started focusing on a clearly defined risk appetite framework. The following takes you through a simple explanation of an approach to risk appetite.

Risk Appetite is just one building block in the overall Enterprise Risk Management framework.

CLICK HERE to view a short video of GRC\’s CEO, Michael Jensen, presenting this framework.

What is risk appetite?

Risk appetite is the amount of risk an organization is willing to take on to achieve its strategy. The appetite framework should guide the organization in day to day decision making. Risk appetite should be linked directly to the overall strategy and cover all aspects of the business and all risk disciplines.

Who determines risk appetite?

The owner of any organization determines the amount of risk the organization is willing to take on board. In public companies the board of directors determines the amount of risk the organization is willing to take on board.

How is it established?

Typically, the person or area responsible for the risk framework (E.g.., the Chief Risk Officer) drafts a risk appetite proposal for the board of directors to discuss. Once the board of directors have established a clear appetite framework, the person or areas responsible for the implementation will report to the board (in larger organizations through a risk committee) on the risk profile and potential breaches to the established appetite levels on an ongoing basis. Depending on severity, the board of directors might have to be alerted immediately.
In GRC’s experience, successful implementation of a risk appetite framework is correlated to the amount of input received from the organization. The front line in the organization has an inherent view of appetite and are more likely to respond positively to tolerance levels if this view is incorporated into the draft appetite presented to the board. Subject matter experts are more likely to agree with breaches and escalation if they have been part of establishing tolerance levels.

When is it updated?

A risk appetite framework is dynamic and can be updated on an ongoing basis. At a minimum the board of directors should endorse their approach to risk appetite on an annual basis.

How is it used?

Risk appetite guides all employees in making day to day decisions and establishes clear guidelines for when mistakes should be escalated.

Level of detail

An organization should be able to express its view on risk taking at a very high level. This means writing an appetite framework on a couple of pages in a language understood by everybody. As the framework is utilized additional detail can be added to fit the area in question. Each area of an organization can develop an appetite framework which fits into the overall group wide framework.

Qualitative Statements and Clear Escalation Thresholds

In addition to qualitative risk appetite statements, quantitative escalation thresholds for breaches (for example operational losses) are incorporated in the framework to ensure that the Board of Directors are being notified before a critical level of loss is reached and ensures that action plans are being established on a timely basis. The below provides an example of a risk appetite framework for operational risk only.

$\"risk$

Top Down Approach coupled with bottom up information

As mentioned above, in addition to the risk appetite statements it is key that information on key risk indicators, loss data, mitigation actions and project, customer satisfaction and audit remarks are included in the discussion and assessment of local tolerance for operational risks.

$\"risk$

Monitoring

Loss data and other indicators should be monitored daily and on a rolling average basis. Loss data and other indications should be monitored on a dashboard or in a system.

Both Gross and net losses (total loss before and after mitigation factors such as insurance or refunding) as well as gains must be monitored and assessed, even when mitigation actions are deemed sufficient. Though no economic impact might arise each mistake presents a potential learning opportunity.

Reporting

Board of Directors is notified when losses exceed the individual thresholds for each category and/or for a single loss breaching the individual threshold. The board of directors might determine that some event types should be escalated regardless of amounts. For instance, intentional internal fraud might require immediate escalation though no financial impact occurred.

Though no breaches to accumulated or single loss thresholds have occurred risk committees and the board of directors will still receive reporting on an ongoing basis.

Thresholds could be lowered as you move from the board of directors to the risk committees and further down in the organization. The Chief Risk Officer might require immediate reporting of all losses above a certain lower threshold.

Additional Tips

Establish a group covering all main areas of the organization to establish a risk appetite proposal or vet a proposal to a framework with internal stakeholders.

Clear ownership: As with other aspects of a risk management framework clear ownership is key to the success. For example, it should be clear who reports on losses from each business area.

Pilot a framework: As the board of directors might be a bit gun-shy about establishing escalation thresholds a risk framework could be established in a test/pilot mode while the board of directors and the organization in general gets used to a new framework.

Use data already available: Typically, loss data and other indicators are already available in the organization and simply must be accumulated and simplified to prove a high-level overview.

Ask yourself: How often do I want to escalate? Look at historical data and establish initial thresholds based on the frequency of breaches.

Benchmark: Compare your risk appetite framework and loss data to like organizations.

Bring in a GRC advisor to establish a risk appetite framework. As we have developed multiple appetite frameworks we will be able to guide you through the process tailor a framework which suits your organization in an objective fashion.

Get in contact

EUR	EUR	€
USD	USD	$
DKK	DKK	kr.