This question has set the ball rolling in an informal group of risk professionals. Everyone has a view on the same. Some views were borrowed from financial industry, some view were created/ adapted for non-financial industries.
One of the reason of confusion is analogy of appetite with hunger. You need minimum subsistence to survive, however your hunger can be and will be more than minimum subsistence. If you define appetite as satisfaction of your stomach then definition as given by various institute, standards, frameworks and common understanding are at odds. e.g. Food on the left side may be sufficient to satiate your hunger, but you want to eat the right hand side food plate.
Definition provided by institutes, standards, frameworks have created their own share of confusion. Let’s look at some of them:
Risk appetite is the amount of risk, on a broad level, an organization is willing to accept in pursuit of value.
Risk appetite is the level of risk that an organization is prepared to accept in pursuit of its objectives, and before action is deemed necessary to reduce the risk.
Risk appetite is the amount and type of risk that an organization is prepared to pursue, retain or take.
Risk appetite can be defined as the amount and type of risk that an organisation is willing to take in order to meet their strategic objectives.
Risk appetite is the total exposed amount that an organization wishes to undertake on the basis of risk-return trade-offs for one or more desired and expected outcomes.
These definition provides clue to Risk appetite as “Amount”, “Type” and “Level” of risk as the component of Risk Appetite. Many organisation has approached Risk Appetite differently. Lets consider the approaches:
Approach 1
Risk Appetite as minimum risk that an organization must carry.
Approach 2
I am not comfortable doing something , hence we are not going to do it.
Approach 3
Define a limit. If the exposure calculated (based on risk register) reaches certain limit, we will intervene.
Approach 4
Instead of setting one limit, multiple limits are being set. In can be a part of Risk rating matrix, which gives criteria treating something a high risk or low risk. e.g. having certain level of inventory, where to deploy surplus cash, what level of debtors are fine, what is minimum level of customer satisfaction is required
Approach 5
Contextualized Risk Appetite: Where Risk appetite is different based on context. E.g. In a remote plant where labor is scarce, attrition of labor is a big risk as compared to plant management. Similarly, in case of corporate office where a specific talent is scarce, attrition of management is risk as compared to support staff.
What is your approach ?
Some useful references:
- Utilize your risk appetite and -tolerance
- Exploring Risk Appetite and Risk Tolerance – RIMS
- Risk Appetite – The Institute of Risk Management
- Understanding and Communicating Risk Appetite – COSO
- Risk appetite and criteria compared, considered and developed
Call for action:
Inputs/ comments/ suggestion: I welcome inputs/ comments / suggestions from readers on how to approach this issue. Feel free to correct me, educate me.
Share the Article: If you like it, share it. If you share it with others, and they comment, we all will get more learned.
(Disclaimer: The views expressed constitute the opinion of the author and the author alone; they do not represent the views and opinions of the author ’s employers, supervisors, nor do they represent the view of organizations, businesses or institutions the author is, or has been a part of.)