[OR] [KWAP] [E2] [C6] Confirming Risk Appetite

Implementing Operational Resilience for KWAP

Chapter 6

Confirming Risk Appetite: Defining Boundaries for KWAP's Operational Resilience

For Kumpulan Wang Persaraan (Diperbadankan) (KWAP), or the Retirement Fund (Incorporated), operational resilience is not just about preparing for disruptions—it’s about making informed decisions on how much risk the organisation is willing to accept in pursuit of its objectives.

The Confirm Risk Appetite stage of KWAP's Operational Resilience Planning Methodology is a critical step that ensures the organisation’s resilience efforts are aligned with its risk tolerance and strategic priorities.

By clearly defining its risk appetite, KWAP can make balanced decisions, allocate resources effectively, and build a resilience framework that reflects its unique needs and goals.

The Role of Risk Appetite in Operational Resilience

Risk appetite refers to the level and type of risk that an organisation is willing to accept to achieve its objectives.

For KWAP, confirming its risk appetite is essential for ensuring that its operational resilience strategy is both realistic and aligned with its mission to safeguard retirement funds.

This stage helps the organisation answer key questions, such as:

• How much disruption can KWAP tolerate in its critical business services?
• What level of investment is justified to mitigate risks?
• Which risks are acceptable, and which must be avoided at all costs?

By confirming its risk appetite, KWAP can establish clear boundaries for decision-making, ensuring that its resilience efforts are proportionate to its risk tolerance and strategic priorities.

Key Steps in Confirming Risk Appetite

The Confirm Risk Appetite stage involves a structured process to define and communicate the organisation’s risk tolerance.

The key steps include:

1. Review Organisational Objectives

KWAP begins by reviewing its strategic objectives and mission to ensure that its risk appetite aligns with its broader goals.

For example, as a retirement fund manager, KWAP’s primary objective is to protect and grow retirement savings, which requires a low tolerance for risks that could disrupt critical services.

2. Engage Stakeholders

Confirming risk appetite requires input from key stakeholders, including senior management, board members, and risk management teams.

KWAP engages these stakeholders to gather diverse perspectives and ensure that the defined risk appetite reflects the organisation’s collective values and priorities.

3. Analyse Risk Scenarios

KWAP evaluates various risk scenarios to understand their potential impact on critical business services.

This analysis helps the organisation determine which risks are acceptable and which require mitigation.

For example, KWAP may decide that a short-term disruption in non-critical services is acceptable, but a prolonged outage in critical services is not.

4. Define Risk Tolerance Levels

Based on the analysis, KWAP defines its risk tolerance levels for different types of risks.

These levels are expressed in measurable terms, such as:

• Maximum acceptable downtime for critical services.
• Financial thresholds for potential losses.
• Acceptable levels of customer impact during disruptions.

5. Document and Communicate Risk Appetite

Once the risk appetite is defined, KWAP documents it in a clear and concise statement.

This statement is communicated across the organisation to ensure that all employees understand the boundaries within which they can operate.

It also serves as a reference point for decision-making and resource allocation.

Aligning Risk Appetite with Operational Resilience

Confirming risk appetite is not an isolated exercise—it is closely tied to KWAP’s operational resilience strategy.

By defining its risk appetite, KWAP can:

• Prioritise resilience efforts based on the most significant risks.
• Allocate resources effectively to address risks that exceed the organisation’s tolerance levels.
• Ensure that resilience initiatives are proportionate to the level of risk the organisation is willing to accept.
• Build a culture of risk awareness and accountability across the organisation.

For example, if KWAP’s risk appetite indicates a low tolerance for cyber risks, the organisation may invest heavily in cybersecurity measures and incident response capabilities.

Conversely, if the risk appetite allows for higher tolerance in non-critical areas, resources can be allocated elsewhere.

Tools and Frameworks for Defining Risk Appetite

To ensure a robust and objective process, KWAP leverages established tools and frameworks, such as:

• Risk Appetite Statements: Clear, concise statements that define the organisation’s tolerance for different types of risks.
• Risk Registers: Tools for documenting and assessing risks, including their potential impact and likelihood.
• Scenario Analysis: Techniques for evaluating the impact of different risk scenarios on critical business services.
• Stakeholder Workshops: Collaborative sessions to gather input and build consensus on risk appetite.

Outcomes of Confirming Risk Appetite

The Confirm Risk Appetite stage produces several key outcomes that guide KWAP’s operational resilience efforts:

1. Clear Risk Boundaries

KWAP establishes clear boundaries for risk-taking, ensuring that all decisions are aligned with its risk tolerance.

2. Informed Decision-Making

By understanding its risk appetite, KWAP can make informed decisions about resource allocation, resilience initiatives, and risk mitigation strategies.

3. Stakeholder Alignment

The process of confirming risk appetite fosters alignment among stakeholders, ensuring that everyone is on the same page regarding the organisation’s risk tolerance.

4. Proportional Resilience Efforts

KWAP’s resilience efforts are proportionate to its risk appetite, ensuring that resources are used efficiently and effectively.

Summing Up ...

The Confirm Risk Appetite stage is a critical component of KWAP’s Operational Resilience Planning Methodology.

By defining its risk appetite, KWAP establishes clear boundaries for decision-making, ensuring that its resilience efforts are aligned with its strategic priorities and risk tolerance.

This stage enables the organisation to make informed decisions, allocate resources effectively, and build a resilience framework that reflects its unique needs and goals.

With a well-defined risk appetite in place, KWAP is better equipped to navigate disruptions, protect critical business services, and maintain the trust of its stakeholders.

Operational Resilience in Pension Funds: The KWAP Case Study
Implementing Operational Resilience for KWAP

OR Planning Methodology Phases [Roadmap]		Plan [P1]	Implement [P2]	Sustain [P3]

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To further enhance your expertise, explore the OR-5000 Operational Resilience Expert Implementer course by BCM Institute. This expert-level certification program provides the skills and strategies to build and sustain a resilient organisation.

The course is also claimable by HRD Corp, making it an excellent opportunity for professionals looking to upskill with financial support.

To learn more about the course and schedule, click the buttons below for the [OR-3] OR-300 Operational Resilience Implementer course and the [OR-5] OR-5000 Operational Resilience Expert Implementer course.

	If you have any questions, click to contact us.