Risk Appetite that Makes Sense
The traditional definition of risk appetite is:
The amount of risk an organization is willing to take in pursuit of objectives.
This is a mouthful that makes little sense, especially when you try to come up with “an amount of risk”.
Is that a bushel, a pound, a gallon, a million dollars, or what?
Some would argue with me (without success) that it makes sense to add up the level of risk (given that there is a range of effects from each source of risk, each with its own likelihood) from disparate and unconnected sources such as:
- Cybersecurity
- Exchange rates
- Commodity prices
- Supply chain
- Competitors
- Loss of key personnel
- Regulation
- Safety
- Compliance
- , etc., etc.
I can’t see where that makes sense for anybody. (See ** below.)
So…
Let’s rethink what we are trying to achieve.
I think there’s a better way to frame any discussion.
Let’s replace the traditional, useless definition with a question:
What risks should we take to achieve success (achievement of objectives)?
I believe a discussion around this question will be productive and should lead to more informed and intelligent decisions – and they, in turn, should increase the likelihood of success.
In my books, I have suggested another replacement, which I still like and advocate. Instead of focusing on a level of risk, let’s talk about whether is an acceptable likelihood of achieving each of our objectives.
I continue to believe this is a great way to run any organization. It requires an understanding of where we are today (too often overlooked), what might happen (both risks and opportunities), and what that all means. Are we 50% likely, 70% likely, or 90% likely? Is that OK? Can and should we do better, and how?
**There may be some situations where individual sources of risk are being considered, maybe even one or two sources that need to be considered. In those situations, a defined level of risk (if properly calculated and balanced against the opportunity) can make sense. Some refer to this as risk appetite, but that doesn’t seem consistent with the COSO definition. I prefer to think of these as risk limits that may be specified in policies, etc.
I am suggesting that we stop talking about something that has next to no value in running the business and leading it to success. (Avoiding harm is not the path to success.)
So let’s have a discussion about what it will take to be successful – and what risks we should take.
I welcome your thoughts.
Leave a comment
Norman Marks on Governance, Risk Management, and Internal Audit 
M
My suggestion is to consider “performance appetite” I can think of an airline client who had a target of X% of arrivals within +/_x minutes of schedule. An oil and gas company with a target finding and development cost of +/- $X per barrel. Lower costs were associated with low quality crude and higher costs associated with expensive to find but higher quality crude. THEN assess the likelihood of achieving.
Yes, every objective should have some form of metric.
I couldn’t agree more. If you’re assessing your ‘appetite’ against a threat, or the possible impacts of that threat, I just cant see what value that is adding (other than keeping people tied up with ‘busy-work’). If you’re not examining appetite directly connected to achieving something, then the context is general – not specific – so how do you decide whether the risk is worth it? Continuing to love how you frame things Norman 🙂
Thanks, Jane
This is so true, risk limits make sense in financial risk where we can say “we don’t take a position in a given market/asset class larger than X” but this doesn’t actually define the COSO “how much risk we are willing to take” because there are so many sources of uncertainty in returns from a given position. The majority of risk appetite statements I have seen for other non financial risk areas say something like “we have no appetite for losses from X” or “we have limited appetite for losses from X” , doesn’t seem particularly useful or insightful to me.
Exactly
If you don’t know what your risks are (a favorite position of financial risk managers acting as Chief Risk Executives) you are so far behind the 8-ball that any definition of risk appetite produces a hopeless mess.
Enthusiastically agree Norman. Your suggestion moves risk management from a ‘product’ towards a set of activities applied to establish whether management are ‘confident enough’ that business goals and targets can be achieved.
Well said
Let us (risk practitioners) help businesses by avoiding the use of risk jargon. Hence – do not talk about risk appetite or -tolerance, -capacity etc. These terms are for our internal communication (parallel to the type of discussions doctors may have between each other, but would never use to patients).
So – let us switch to performance. You have a set of objectives (if not, how do you know whether or not you are successful). These are measurable (again, if not how do you know…).
The next element is “how certain do you wish to be, you will meet these objectives?. This may vary a lot. For some decisions/projects, a 50/50 chance may be great – the extreme is buying a lottery ticket where the cost is low, but so is the likelihood of success/winning. for others, you wish to be “dead certain” you meet objectives (e.g. various types of safety objectives).
What is risk management in our jargon then becomes the business topic of “What do I need to do, to be satisfactorily certain, I will meet this or that objective” and as/when you have multiple targets “How do I balance my effort?”