I’ve long been bothered by the concept of “risk appetite”. It’s always seemed one of those things that is both intellectually alluring and impossible to grasp practically.

But recently I came across a paper from Halex Consulting [pdf] that sought to take a more practical view of risk management, and this included a more practical definition of risk appetite.

The authors start by stating that the goal of risk management “is not to manage risks per se. The purpose of risk management is actually to help the business deliver its strategy through focusing on achievement of its strategic business objectives.” They go on to say that success is not guaranteed, and therefore we can give a percentage likelihood that any particular objective will be achieved.

But we can also give a percentage likelihood that we would like to see. For example, we might say our objective of achieving £10m in sales by the end of the quarter should have a likelihood of 85%. That means we accept a 15% chance of not achieving this. That 85% / 15% balance is an expression of our risk appetite. If we have the opportunity to do something exciting, but that makes our sales objective only 80% likely, then that exciting opportunity is beyond our risk appetite.

This definition of risk appetite is most certainly not the definintion, but it is a very practical one. And now we can start to have some fairly detailed conversations. For example, we shouldn’t really talk about risks as points, so while we might accept our £10m target as 85% achievable, what is acceptable for achieving £8m? What if our exciting opportunity adversely affects our higher target but aids our lower target? Clearly we need to talk about this, but now we’ve got a practical basis for that discussion.

In the end things become much more tangible, and much less esoteric, when we start to talk about risk management as being about achieving objectives rather than as something that’s treated separately from our other activities.

Photo by Petros K.