This report shows which individual risks within an Entity have the potential to breach a predefined level of tolerance limit (value); it has been described earlier, when discussing how to set up an Entity, how an upper and lower limit of acceptable value can be defined in the Entity Screen; this will now be reflected as 2 horizontal lines in the Appetite for Risk graph:
The graph will show the individual risk numbers on the horizontal axis and the maximum impact values for each risk at the “peak” of each line. The impact values are based on those set up in the Entity Screen; the attributes to be considered when producing the graph are set up when the system is first installed, this is done via the “Asset” chart in the “Administration” section discussed earlier.
Minimum and Maximum impact values for each risk to be measured are graphed; the system does this by first selecting only those risks identified as being applicable to this measurement (having a measurable monetary impact value say “cash”) and then identifying how much of this attribute is at risk (as shown in the risk screen), the likelihood of it happening if there were no control and the degree of control in place (from the matrix). The predetermined Maximum and Minimum acceptable values for loss (as set out in the Entity Screen) are then plotted as horizontal lines on the graph.
In the above graph, 4 risks have the potential to breach the predetermined appetite levels, if these levels were approved by the board, Risk Management will need to make sure that these 4 Risks are better mitigated either by adding additional control or by insuring them.