What kind of risk appetite does your organisation have? Does it have different risk appetites for different circumstances? And is that even useful?
Matthew Leitch contends that the term “risk appetite” is unhelpful. He conducted a survey which revealed that the kind of people who might typically encounter this phrase find it less helpful than “maximum tolerated risk level” or other terms. Andy Garlick sets out a few reasons why he finds it “misleading and unhelpful”.
But here I want to tackle it from another angle: that the idea of having different “risk appetites” for different circumstances is at best unnecessary and at worst wrong.
The Institute of Risk Management (IRM) says
Organisations will have different risk appetites depending on their sector, culture and objectives. A range of appetites exist for different risks and these may change over time.
So what does “risk appetite” mean here? We can use any of Matthew’s improved phrases: “overall risk limit”, “risk attitude” or “maximum tolerated risk level”. We could then perhaps define that in more concrete terms by saying something like “we don’t ever want more than a 5% chance of losing £1m”.[*]
But the IRM goes further than wanting an organisation to have a single risk appetite. It suggests that different risk appetites (or maximum tolerated risk levels) might exist for different risks. Aside from the problem that “risks” aren’t concrete objects, and therefore it doesn’t make sense to talk about “risks” plural, let’s talk about this idea of different risk appetites for different areas.
A construction company seeking to get out of a cultural rut might say “we have a small risk appetite for health and safety, but a large risk appetite for innovation”. Intuitively it makes some sense, but there are real problems here.
First, we don’t need to distinguish different risk appetites. Serious or fatal accidents have a serious impact on the business. Though it’s not tasteful to do so, this can be expressed in financial terms by means of compensation payments, damaged reputation (and hence lost business) and so on. In contrast, an innovative idea such as putting building site activity on a live internet video stream might lose us a bit of money if it doesn’t have any discernible impact, but that’s much less significant. We don’t need to have different “risk appetites” for these two things—the numbers speak for themselves.
Second, different “appetites” can be so obviously misleading that we’ll ignore them. Take two more examples. In the health and safety domain not being quick at drying up spilt liquids in the canteen might lead to a minor injury. In the innovation domain constructing a new housing estate with a revolutionary and totally untried eco-material could well render that whole project wasted. Would we really be less tolerant of the canteen spillage than the untested building material? Of course not. Our two “risk appetites” are clearly wrong.
Finally, the concept of different “appetites” is limiting. Consider the idea that to boost company finances, once a month the Chief Financial Officer will take one tenth of the company’s cash down to the local casino and put it all on black. Our “innovation risk appetite” might tell us this is okay. And if we don’t have a “financial risk appetite” then strictly there’s no counter-argument. By limiting ourselves to different domains our proposal has fallen through the cracks.
Perhaps that last example is a bit silly, but if so that’s only because all this points to the same thing. We don’t need different “risk appetites” for different domains when it is easier and more helpful to look at issues in the round and judge them by common criteria. Usually this criteria will be financial impact. Even if it’s another measure then we’re still comparing like with like. “Risk appetites” (plural) is an unnecessary, and potentially misleading and limiting concept. We can operate better without it.
[*] You may also have noticed that even a statement like “we don’t ever want more than a 5% chance of losing £1m” is limited. It may be specific, but as I discussed before, it doesn’t tell us about our acceptance of a 2% chance of losing £2m or a 7% chance of losing £0.5m, to pick just two random data points.
niksilver.com 