Risk appetite and tolerance continue to be vexing challenges, even for risk leaders in financial institutions where their use is typically more common and advanced. However, those in non-financial organizations face tougher challenges, beginning with management skepticism of the benefit of these tools.

For financial institution risk leaders, motivation is significantly driven by rating agencies and regulators, where risk quantification, correlation and aggregation are all very strong, helpful risk appetite initiatives.

For risk leaders outside the financial realm, some form of risk appetite strategy can and should be used to better manage risks for their organizations. Put simply: how can you decide how much risk to take if you don’t know how much you’re taking?

Different organizations have different levels of sophistication and quantification when measuring risk. Every organization will differ and be a function of the forces, both internal and external, that drive the demand for risk quantification and for understanding risk-taking behaviors. Without the pressure from regulators, the demand for a risk appetite strategy tends to be much less. Regardless, it seems implausible that risk can be effectively managed without some rudimentary understanding of risk-taking in an organization.

The key questions that all risk leaders contend with, but must ultimately answer are:

• How much risk are we currently taking (appetite)?
• How much risk can we take (capacity)?
• How much risk do we prefer to take (tolerance)?
• How much risk do we need to take (adjusted appetite) to reach our strategic goals?
• Which risks do we want to take and which risks are unacceptable to take and why?
• What is the gap between capacity and need?
• If the gap is large between need and capacity, which strategies need to be modified and how?
• What is the cost/benefit of key gap-closing activities?

Without extensive risk quantification, getting useful answers to these questions can be challenging. The starting point, however, is understanding the fundamentals of risk appetite and its purpose, and then taking a look at which risks your organization should set tolerances for in order to better manage them.

In addition, risk appetite frameworks can be used in the risk assessment process to guide better decision making, the ultimate goal of the risk management function. Risk profiles are unique to each business unit. Aggregation of these profiles is necessary to get to an enterprise view in support of bigger operational and strategic decisions. Without disciplined quantification, aggregation is difficult. Thus, it’s necessary to understand the relationship between risk capacity, tolerance and appetite.

If rigorous quantification is feasible, it’s critical to be able to articulate risk appetite in a clear, concise way that helps others understand the value of this more robust use of risk information. In doing so, alignment with the strategic plan becomes critical in inspiring the tool’s usefulness. Another aspect of this work is leveraging risk technology and risk modeling to inform the assessment of more difficult and often critical risks. The level of investment required for these tools may hinder the likelihood of their use.

Remember these important truths about risk appetite:

• Understanding risk capacity, appetite and tolerance is a crucial starting point
• Risk capacity with regard to financial risk is ultimately defined by the balance sheet
• Risk capacity for non-financial risks is defined by the maximum impact the business can sustain
• Risk appetite and active risk-seeking by businesses can vary depending on how aggressive or conservative the risk tolerance
• Defining risk appetite is a key starting point

Please join Soubhagya Parija, Chief Risk Officer of New York Power, and myself as we cover these topics and more at the upcoming Risk and Insurance Management Society (RIMS) Annual Conference. Our focus will be on tackling risk appetite for non-financial companies and the challenges and opportunities it presents. We will address the challenges in dealing with multiple business units and the diversity of appetite and tolerances among decision-makers. We will assess the role of risk appetite in decision-making and risk assessments in support of those decisions. Finally, we’ll explore the value and intricacy of operationalizing risk appetite in environments where the term may be an unfamiliar concept, yet risk decisions are the goal.

We look forward to seeing you on Wednesday, April 18 – 9:30-10:30 in room 301AC of the San Antonio Convention Center.

Chris Mandel,  SVP and Director, Sedgwick Institute