Old Mutual Group Policy Suite
1. Details
Title Group Policy for Risk Appetite
Policy Specialist Jason Baker, Operational Risk Manager
Date Produced / Version 27 August 2009 / Version 2.0
Audience Old Mutual Group and Business Units
2. Summary
The objective of this document is to provide the mandatory minimum standards for the management of Risk
Exposure against Risk Appetite across the Old Mutual Group.
Ownership of the policy rests with the Group Risk and Capital Committee (“GRCC”) on behalf of the Old
Mutual plc Board. The policy should be reviewed annually by Group Risk to ensure it reflects the current
practice within the Old Mutual Group, and to benchmark against international best practice.
3. Scope
In Scope: This policy is applicable to the management of Risk Appetite within the Old Mutual Group
and Business Units. The policy covers all risk types as stated in the Group Risk
Categorisation Model
Out of Scope: N/A
4. Risks controlled by this Policy
The Risk Appetite framework is based on the following metrics – Economic Capital at Risk, Financial Groups
Directive Surplus Capital at Risk, Earnings at Risk, Cashflow at Risk and Operational Risk. The first four
metrics cover all risk types already included in the Economic Capital framework (ALM, Market, Credit,
Business, Liability, Currency and Operational). These risk categories have been mapped back to the Group
Risk Categorisation Model.
5. Mandatory requirements
a) Governance
The Risk Appetite Framework for Old Mutual Group will be owned by the GRCC, and ratified by the Old
Mutual plc Board.
Risk Appetite limits for each of the metrics will be allocated and cascaded to the Group and Business Units by
the GRCC, and ratified by the Group Board. These limits will be reviewed at least annually by the GRCC.
Risk Appetite Limits for the Group in each risk category (as defined in the Risk Appetite Methodology Papers)
will be set by the GRCC, as required, and cascaded to the Business Units. Limits for risk categories for each
-1-
Business Unit will be allocated as appropriate, although it is anticipated this will be on an exception basis.
In exceptional circumstances, the GRCC can amend the Risk Appetite Limits at any time outside the annual
review process to align with a change in strategy.
b) Monitoring
The Risk Appetite Limits are outer boundary limits and Business Units should operate within the limits
allocated to them. Performance against these limits should be regularly monitored and if they are exceeded
Business Units should inform Group Risk immediately, including detailing the potential and appropriate
management actions that could be put into place to reduce their operational risk exposure.
The GRCC will monitor the exposure of the Group against the limits for the Risk Appetite metrics and risk
categories.
The CRO of each Business Unit is responsible for ensuring the framework is embedded in each Business Unit
and the Risk Exposure is accurately reported.
As appropriate, Business Units should allocate Risk Appetite Limits to their own divisions and to risk
categories both within divisions and the Business Unit as a whole.
Business Units should consider the appropriate management actions when their Risk Exposure against Risk
Appetite changes from blue or green to amber to prevent Risk Appetite Limits being exceeded. Business
Units should also consider whether appropriate management actions should be taken when their Risk
Exposure against Risk Appetite (for all Risk Appetite metrics other than operational risk) changes from green
to blue.
c) Risk Appetite Metrics
The Risk Exposure calculated by Business Units should be in line with the Methodology Papers issued by
Group Risk. If Business Units are unable to calculate the exposures in line with this methodology they should
discuss and agree an approach with Group Risk.
The metrics should be applied to manage risk to an optimal level and not necessarily eliminate it. For
Earnings at Risk and Cashflow at Risk the Group and Business Units should aim to be within reasonable
proximity below the Risk Appetite Limit. For the Economic Capital at Risk metric the Group and Business
Units should be above the limit set by the GRCC. For FGD Surplus CaR the Group should be in the target
range set. No limits have been set for BUs as most manage to local solvency requirements. The Group and
Business Units should minimise operational risk with the exact level taking into account the cost of controls
against the Risk Exposure.
Business Units should ensure that the Risk Exposure calculated reflects the actual controls that are in place.
Business Units should ensure that they document their methodology, including assumptions, for the
calculation of their Risk Exposure. This information should be made available to Group Risk, on request.
d) Risk Appetite Reporting
Business Units should provide to Group Risk, at least quarterly, information on their Risk Exposure. The
exact requirements, including the format of the report, will be communicated to Business Units by Group Risk
before each submission. A consolidated report for the Group should be reviewed by the GRCC.
Business Units should develop a Risk Appetite dashboard that is reviewed by their Risk Committee and/or
Executive Team. The dashboard should be aligned to the Group Risk Appetite dashboard.
e) Business Planning
All Business Units should consider the effect on their Risk Exposure before making any strategic decisions,
-2-
including the launching of new products, mergers, acquisitions or divestitures. If the assessment indicates
that implementing this strategic decision will lead to the Business Unit breaching their Risk Appetite Limits
they must gain approval for the strategy from the GRCC.
Business Units should include in their annual Business Plan, from 2010, an assessment of the effect of their
plans on Risk Exposure.
6. Policy Breaches
Breaches of this policy must be reported to Group Risk in accordance with Group risk reporting requirements
and the Group Escalation Policy.
8. Supporting Materials
Materials Where located
Risk Appetite Methodology papers Sharepoint (link to be confirmed)
9. Contact point for queries or guidance
Jason Baker (Group Risk) [Link]@[Link] +44 207 002 7261
Appendix A – Definitions
Risk Appetite
Risk appetite defines the boundary of acceptable risk and hence losses. It will not prevent losses.
Risk Appetite Metrics
The quantitative measures that Old Mutual uses to express its Risk Appetite limits and exposure, namely
Economic Capital at Risk (ECaR), FGD Surplus Capital at Risk (FCaR), Earnings at Risk (EaR), Cashflow at
Risk (CFaR) and Operational Risk.
Risk Appetite Limits
The maximum amount of risk that Old Mutual is willing to take against each of the Metrics, possibly expressed
at risk type level. These will be set by the GRCC and ratified by the Old Mutual plc Board.
Risk Exposure
The amount of risk that Old Mutual is currently taking. This is measured for each risk type and then
aggregated.
Risk types
The Risk Appetite framework uses the same risk types already used within the Economic Capital framework.
The major ones are ALM, Market, Credit, Business, Liability, Currency and Operational. Some of these can be
further sub-divided.
Risk Exposure against Risk Appetite Thresholds
The following thresholds apply to the risk exposure against risk appetite:
Red – Risk Exposure is greater than 100% of Risk Appetite
Amber – Risk Exposure is between 90% and 100% of Risk Appetite
Green – Risk Exposure is between 50% and 90% of Risk Appetite
Blue – Risk Exposure is less than 50% of Risk Appetite
-3-
