In the “Risk, risk everywhere and not an appetite for it” post I proposed the following spur-of-the-moment-inspiration-through-significant-dose-of-caffeine definitions for risk appetite and risk tolerance:
“Risk appetite: This is your general, high level expression of what you are, or aren’t willing to risk in order to reach your goal. Get your goodies. Join the dark side to get your hot little hands on their cookies. Whatever it is that your long term goal is. An example of a risk appetite would be: I’m happy to risk 10% of everything I have in order to get at least 20% profit. Otherwise I’m not willing to play.”
“Risk tolerance: Now this is where things get interesting. This is what people are often understanding under risk appetite. Let’s say that you come across this once in a lifetime opportunity to win big. If you succeed, you will be the ruler of the world, the big cookie monster, the one, the only, blah blah blah. Price if you fail? Nothing huge, just your first born. Seeing the massive payout if you win (and let’s say that the odds are 80:20 in your favour) the risk seems manageable. And your firstborn just won’t let you sleep at night, so it sounds like a win-win situation. Many organisations usually take big risks on certain projects, hoping to strike big. (And employees cynically know they can at least pad their resume with something large in case it fails.)”
And now, after studying the issue, the milieu, the environment, the path less taken, the well-trodden road of best intentions, etc. I want to say that they’re OK, but not quite. As far as the risk appetite statement goes, it’s on par with what the regulators: “The amount and type of risk an organisation is willing to accept in pursuit of its business objectives.” – APRA; “The broad-based amount of risk an organization or other entity is willing to accept in pursuit of its mission or vision.” – Basel II; and the professional associations: “The amount of risk that an organisation is willing to seek or accept in the pursuit of its long-term objectives” – The Institute of Risk Management say.
Of course the Institute of Operational Risk goes further, as you’d expect from OpRisk people. In ‘Operational Risk Sound Practice Guidance’ they define risk appetite and risk tolerances as:
“The operational risk an organisation is prepared to tolerate”, expressed by “deciding, for each type of risk, what is acceptable, what is unacceptable, and the parameters of the area between those two, that is, what is tolerable.”
Then I took what I said, and the artificial limitation that I introduced in the risk appetite and risk tolerance and pulled it apart until I was satisfied with the results. I spoke of “once in a lifetime opportunity”. So there’s the situation that will whet your appetite. There’s the talk of downside if you lose, and hint at the attitude towards taking risk: “Many organisations usually take big risks on certain projects, hoping to strike big. (And employees cynically know they can at least pad their resume with something large in case it fails.)”
So I had the ingredients there, they just weren’t properly separated first. I was looking at a half-baked dish and tried to figure what the steps are that got it to the state it is in and what the steps are that will make it edible (bad puns of the world, rejoice!).
I’ll make a proper post about what I learnt later, suffice to say that talk of risk appetite is the wrong way to go about it. Risk appetite is internal to the person or to the organisation and cannot be influenced. It’s a given, it’s there. There’s something else that can be influenced.