GRC Risk Management - Risk appetite

[robertaz]

Hello, in order to show the risk appetite status in the risk record or risk assessment (i.e. inside appetite - green, outside appetite - amber, outside tolerance - red), we have to link our risk appetite scale to the Qualitative Rating Criteria under Risk Assessment Methodology. However, our risk appetite scale does not match with our risk rating criteria (please see it attached), so we have risks where the risk appetite status is showing as "outside appetite", where it should be "inside appetite" (for example, risks with risk appetite Averse 1-5 scored 5 and risks with risk appetite Cautious 6-10 scored 10 are reported as "outside appetite" where they are "inside appetite"). Please can you advise if there is another way to set this up, without linking the risk appetite scale to the risk rating? Thanks

[Community Alums]

Hi @robertaz ,

There are two properties, which contributes here:

Define risk appetite as sn_risk_advanced.risk_appetite_scale

Option to select the risk appetite type: Risk appetite only (1-point scale): Uses only the risk appetite. The risk appetite field is available on the risk statement, risk, and entity form. The risk appetite status is calculated based on this property selection. Risk appetite and risk tolerance (2-point scale):Uses both the risk appetite and tolerance. The risk appetite and risk tolerance fields are available on the risk statement, risk, and entity form. The risk appetite status is calculated based on this property selection. None: Don't want to use the risk appetite. Note: Only one property between the Define risk appetite as and Express risk appetite in can be configured at a time. Configure a property first, save it, and then configure the other property.

Express risk appetite limits in sn_risk_advanced.risk_appetite_analysis

Option to select risk appetite scale: Qualitative terms only: Defines the risk appetite in qualitative terms only. Your risk appetite is based on the appetite scale such as low, medium, or high. The risk ratings are compared with the qualitative appetite and tolerance to calculate the qualitative appetite status. Quantitative terms only: Defines the risk appetite in quantitative terms only. A quantitative risk appetite can be measured and expressed using numerical values. For example, an organization decides to have $1000 (US dollars) as a target non-performing asset (NPA) for this year. The organization can define $1000 (US dollars) as a quantitative risk appetite. The annual loss expectancy values are compared with the quantitative appetite and tolerance to calculate the quantitative appetite status. Both: Defines the risk appetite in both qualitative and quantitative terms. Note: Only one property between Define risk appetite as and Express risk appetite in can be configured at a time. Configure a property first, save it, and then configure the other property

[robertaz]

Hi Sandeep,

Thank you for your reply.

We have already set up properties for 

- sn_risk_advanced.risk_appetite_scale as Risk appetite and risk tolerance (2-point scale) 

- sn_risk_advanced.risk_appetite_analysis as qualitative term only. When you say "The risk ratings are compared with the qualitative appetite and tolerance to calculate the qualitative appetite status", we have to link the risk appetite scale to the risk rating scale under the risk assessment methodologies. But these two scales do not match, there is not 1 to 1 relationship as per screenshot attached above. For example a medium risk (risk score 5-9) in the risk rating is linked to 2 risk appetite scales (Adverse 1-5 and Cautious 6-10). Is there any other way to calculate the qualitative appetite status (without linking the risk appetite scale to the risk rating)?

Many Thanks.

Regards,

Roberta