Understanding Risk Appetite and Tolerance

________________________________________________________________________________________________

Problem: in order to mange risks well organisations must put their risks into some sort of context. Otherwise they may find it hard to prioritise risks for action and decide the right risk approach to take

Solution: effective risk management is much more likely if organisations and the people in them understand their appetite for and tolerance of risk.

Background to Risk Management

Risk appetite and risk tolerance are both important concepts in managing risk. While they are related, they have distinct meanings and implications within an organisation’s risk management framework.

When we discuss risk in the post we are referring to enterprise risk management (ERM). ERM is the process of identifying, assessing, and managing risks across an organisation. It involves establishing a risk management framework that integrates risk management into all levels and functions of the organisation. ERM considers the organisation’s both as key elements in decision-making processes.

The concepts and definitions we discuss here also relate to the management of risk in projects and programmes.

Risk taking is an important part of what any organisation does. If you do not take risks then it is unlikely that goals and objectives will be achieved. The management of risk to deliver your strategy means thinking about the risks you are willing to take, and those that you wish to avoid. The terms we discuss below are a key part of defining your risk attitude.

Risk Appetite

The term risk appetite refers to the amount and type of risk that an organisation is willing to accept or pursue in order to achieve its objectives. It reflects the organisation’s willingness to take on risk in pursuit of its strategic goals. Risk appetite is often expressed through a formal statement or document known as the risk appetite statement. This statement outlines the organisation’s overall attitude towards risk, the level of risk it considers acceptable, and the types of risks it is willing to take.

The definition of risk appetite is in essence the minimum amount of risk you should be taking. If your risks are below your risk appetite you are not taking enough risk.

Tolerance of Risk

This term refers to the organisation’s ability to withstand or bear the impact of risks. It represents the level of risk that the organisation is prepared to tolerate without jeopardising its objectives or survival. It is influenced by various factors such as the organisation’s financial resources, industry regulations, stakeholder expectations, and the overall risk management culture within the organisation.

The definition of risk tolerance is that it sets the ceiling over your risk appetite. If you are taking risks higher than your risk tolerance then you should be reducing your exposure to risk.

Other resources

• Risk Management and the Three Lines of Defence

________________________________________________________________________________________________

________________________________________________________________________________________________

Risk Appetite and Tolerance: Understanding the Difference

To better understand the difference, let’s consider some examples.

1. A tech startup wishes to increase its market share rapidly. It has a lot of funding, so even though it is not yet making a profit it can afford to invest in gaining more clients and customers. However, getting and retaining them means delivering an excellent services and demonstrating better value than market incumbents. The startup therefore has a high appetite for financial risk but a low appetite for operational and reputational risk. Risks around excess spending are likely to be well tolerated, so most financial risks will be accepted (except for those round regulatory compliance and statutory duties). Risks around product failure will have a low tolerance however, and the ceiling over those risks at which point risk avoidance activity will begin is much lower. In this scenario the startup wants to spend money, so has an appetite to do something that could generate risk; but it wants to deliver a great service, so is intolerant of anything that could jeopardise that. This example is useful because the startup has different attitudes toward appetite and tolerance depending on different risk criteria.
2. An NHS body always includes risks around child safeguarding on its corporate risk register regardless of the level of risk that there is. This is because it wants to put child safeguarding at the core of what it does, and assure the Board and the public that it is always on top of risks to vulnerable people. This means whatever the level of risk, the risk always gets scrutiny and the organisation holds itself to account for effective risk management in this area. In this example the organisation has no appetite for risk and very low tolerance. – it is always looking for ways to reduce risks further. In this example we can see that both the appetite for and tolerance of risk can be very low, but tolerance is always higher than appetite. This is because the Board is assured risk is being managed even if there is no appetite for the risk in the first place. Also, the NHS body clearly defined its risk attitude as well.
3. A construction company is delivering a project that has a number of stakeholders and must be built following ISO standards. The stakeholders have a number of perspectives about how the work should be done – financial, time, environmental, and relating to health and safety. That means the construction company must work within a range of appetites, and interpretations of data and data analysis. This could cause a lot of confusion. Therefore the company looks at risks bearing in mind the range of risk appetite held by others, but sets its own terms for risk tolerance. It will not, for example, tolerate health and safety risks even if they reduce the risk of the construction work being finished late. In this example it is informed by the risk appetite of those stakeholder people and organisations, but works under the risk tolerance it itself defines.

What to Do with Risks Outside your Appetite or Tolerance for Risk

There are four measures you can take to approach risks. The action you choose will fall into the following categories.

1. Accept: this is where you do nothing. This is appropriate for low level risks at or close to your risk appetite but well below your risk tolerance. You can also take this approach if your risk is below your risk appetite but your analysis is the risk will grow if left alone.
2. Mitigate: this is where you want to reduce your risk. This is the best approach where your risk is at or just over your level of risk tolerance and there are more actions you can put in place to bring the risk within your levels for tolerance and appetite.
3. Share: you can work with partners to bring your risk into line with your risk attitude. The sharing process can involve working with others to take greater risks, or to make your risks more tolerable. Insurance is an example of this.
4. Avoid: if the pursuit of an objective creates much greater risk than you can tolerate then you should stop the activity that generates the risk altogether.

Putting Your Risk Appetite and Tolerance to Work

Risk criteria are the specific parameters or thresholds that an organisation uses to evaluate risks. These criteria can include financial measures, such as the amount of potential loss the organisation is willing to accept, as well as non-financial factors, such as reputational impact or environmental concerns.

The board of directors has a critical role in setting the organisation’s risk attitude and ensuring that it aligns with the strategic objectives and values of the company. The board is responsible for overseeing the risk management process, reviewing the risk appetite statement, and providing guidance and direction to management on risk-related matters.

Depending on your industry and whatever external guidance and perspectives you are bound by – legal, regulatory, or other, then Board oversight will also be crucial to meeting their definitions of effective risk management too.

Conclusion

In summary, risk appetite represents the organisation’s willingness to take on risk. Risk tolerance reflects its ability to handle and recover from risks. The risk appetite statement provides a formal document that outlines the organisation’s overall attitude towards risk. Enterprise risk management, and project risk management, both consider risk appetite and risk tolerance as integral components of its framework. The board of directors plays a crucial role in setting the risk appetite and overseeing the risk management process within the organisation. Risk taking is a key part of proactively delivering and your strategy but it must be managed within a clear risk attitude and risk criteria.

________________________________________________________________________________________________