Fundamentals of Risk Management

Risk management strategy
It is important for an organization to have a clearly established strategy in relation 
to risk management. The risk management strategy for the organization will be set 

---

Risk strategy
248
out in the risk management policy statement. The strategy needs to be based on the 
overall approach of the organization to risk and risk management. An important 
component of that risk strategy will be the requirement that there is risk management 
input into strategy, tactics, operations and compliance (STOC).
In order to establish the risk management strategy, important decisions will need 
to be made about the risk appetite of the organization. Risk appetite is discussed
in more detail in Chapter 25. The risk appetite will be based on the opportunity
investment, control acceptance and the hazard tolerance of the organization.
It is important that the risk appetite is within the total risk capacity of the organ-
ization. Decisions will need to be taken on how the risk capacity will be calculated. 
Also, thought will need to be given on how the total risk exposure of the organization 
will be recorded and used in decision-making processes. Measurement of the total risk 
exposure of an organization is an important feature of operational risk management, 
as discussed in Chapter 30.
There are important decisions to be made in relation to the risk processes that will 
be adopted by the organization, as well as decisions about the design and implemen-
tation of the risk management initiative that will be planned and implemented in order 
to fulfil the requirements of the risk strategy.
The risk management strategy will include details of what the organization is 
seeking to achieve with respect to risk management. The strategy may set out the 
details of the level of risk maturity that is desired, together with the information on 
the level of contribution that is expected from risk management. In effect, risk manage-
ment strategy will establish the way in which risk management activities are aligned 
with the other activities in the organization and the contribution that is expected 
from risk management activities.