Zen and the Art of Defence          Machine Maintenance         When and How to Update Your BRA

When clients ask me, “When should I be updating my BRA?” I have to really bite my tongue and not answer “I have no idea, you tell me!”.  

I’m a professional, so I generally try and be helpful and nuanced, but the fact that I have that knee jerk reaction is pointing to the main issue here: clients get bogged down seeing regulatory obligations as actions to “get done”. In doing so, they’ve missed a fundamental indicator amongst the rules; if the FSA is telling you to review something regularly, they are not giving you a prescriptive date schedule for a reason. Don’t treat it as needing a diary reminder.

It helps if you think about your risk framework the same way you think about commercial management.

Your Risk Appetite Statement works like your annual strategy paper; know where you are and where you want to be. Your BRA functions in the same way as your MI; live reporting data that tracks progress.  These are the tools that keep your business running smoothly. One works the financial engine, the other works your defence machine. If you leave either unattended for too long, they might explode.  

With that in mind, instead of answering that initial client query with snark, I advise clients to programme in regular “defence machine maintenance” during board meetings. Adding standing BRA items to each board meeting works as a good trigger mechanism for this, but only where it doesn’t devolve into a "BRA discussed, no changes noted" tick box.

Boards should be receiving all sorts of useful MI in meetings, from all areas of the business that should be viewed commercially and then from a risk perspective. New client information, changes to industry or jurisdictional environments, contracts and outsourcing decisions, marketing, performance, billing and reporting are all areas that might impact appetite and the BRA.

Incorporating the habit of switching gears at the end of a consideration or discussion to think about risk impact is simple and effective. Are we still comfortable that our risk appetite statement reflects where the business is today? Has that agenda item impacted our risk, or would it need inclusion or amendment in the BRA?

Most meetings, the answer to those questions might not be material and that's fine. “Machine maintenance” is all about checking in to prevent explosions, not needing to constantly fix and tweak. Give the questions due consideration and minute your thoughts properly and in detail. Where you need to make changes to your appetite statement or your BRA, remember to keep a detailed version control.

If you can get into the habit, you’ll be able to tell me when your BRA needs updating without breaking a sweat. If you manage to do it and document it, you’ll be able to demonstrate to the regulator that your risk framework really lives and breathes.