A Short Guide to Risk Appetite

David Hillson, Ruth Murray-Webster

• Publisher: Routledge
• Year: 2017
• ISBN:
  9781351961547
• Edition: 1
• Topic: Betriebswirtschaft
• Subtopic: Unternehmensführung

How much risk should we take? A Short Guide to Risk Appetite sets out to help all those who need to decide how much risk can be taken in a particular risky and important situation. David Hillson and Ruth Murray-Webster introduce the RARA Model to explain the complementary and central roles of Risk Appetite and Risk Attitude, and along the way they show how other risk-related concepts fit in. Risk thresholds are the external expression of inherent risk appetite, and the challenge is how to set the right thresholds. By progressively deconstructing the RARA Model, the authors show that the essential control step is our ability to choose an appropriate risk attitude. The book contains practical guidance to setting risk thresholds that take proper account of the influences of organisational risk culture and the individual risk preferences of key stakeholders. Alongside this, individuals and organisations need to choose the risk attitude that will optimise their chances of achieving the desired objectives.

1    Why is Risk Appetite Important?

The world is faced with levels of uncertainty that fundamentally matter if countries, organisations, projects and people are to reach their objectives. Leaders and managers of organisations, from the biggest government to the smallest family unit, have no choice but to make decisions about how to respond to uncertainty all around them. Shall we lend this money – to another country, or to a friend? Shall we borrow this money – from this bank, or from a relative? Shall we indulge ourselves today and decide what to do tomorrow when it comes, or shall we restrain ourselves today and hope we can convince those influenced directly by our ‘austerity measures’ or ‘cuts’ that this is in their best interests? Shall we look after our shareholders/ourselves following the old adage ‘charity begins at home’, or shall we reach out to help our ‘neighbours’ in the world as much as we can?

These are important questions to get right. If you are too cautious it is likely to be difficult to comply with your some of your values and standards and to achieve your objectives. The opposite is also true – it is likely to be difficult to align with values and standards and reach objectives if you just ‘go with your gut’ and pursue what you want in the short term. As with so many things in life, we need to find a way of achieving some sort of balance – not a mediocre midpoint, but a way of understanding the trade-offs we are making when we decide on a course of action.

Decision-makers probably only ask themselves these types of question explicitly on an infrequent basis. More routinely they play out their ‘strategy’ on these topics through a series of day-to-day decisions. That’s why strategy is often referred to as a ‘pattern of decisions’. If decisions are random, ad hoc or conflicting with earlier decisions, they are unlikely to take the organisation to where it wants to be long term. So establishing a way of making strategically consistent decisions is vital.

One way to achieve this consistency is by establishing control mechanisms. Controls are established by countries, organisations and people, to try to make sure that the decisions they take are not reckless, irresponsible or working against the agreed philosophy, principles or strategy that the decision-maker wants to uphold.

An aspect of control that has recently emerged is referred to as ‘risk appetite’. Unfortunately there is currently no accepted definition of this term, as we’ll discuss in the next chapter. However, this lack of consensus has not stopped risk appetite from quickly becoming a hot topic, with many conferences, journal articles and discussions about the subject. The media also increasingly talks about risk appetite as it reports on failures that are judged to have been caused by decision-makers failing to understand how much risk they should take in a particular scenario.

Anyone who uses risk management and understands its benefits will recognise that the risk process provides risk-based data to inform decision-making. But an explicit link between risk management and decision-making is not always made in practice. The interest shown in risk appetite by regulatory bodies and others has changed this. It is important that we understand risk appetite if we are to make good decisions in uncertain, important situations.

WHY WRITE THIS BOOK?

If risk appetite is a hot topic with lots already written, why did we decide to write a Short Guide on the subject? We have noticed as we carry out our consulting work with organisations large and small across the world that decision-makers are confused about what risk appetite really means and what they need to do.

For example, at a professional meeting early in 2011, we listened to a speaker from a major consultancy talk about risk appetite and give the company’s sales pitch to the audience. Throughout the 15-minute talk, the presenter constantly switched between talking about risk appetite and risk attitude, completely mixing up these two things that we believe are significantly different. In a consulting assignment in mid 2011 we were working with senior decision-makers in a major company who want to manage risk responsibly and creatively to deliver value to shareholders and wider society. We discovered that they could not engage with the current definitions of risk appetite as published and they didn’t know how to apply the concept sensibly. We talked, and this book was born.

WHO IS THIS BOOK FOR?

This book is written for decision-makers in a whole range of organisations.

Certainly it is for senior managers and directors responsible for corporate governance, investment decisions and the social responsibility agenda in their organisation, and it applies equally to public, private and ‘third’ or charitable sectors of all sizes.

Many organisations have risk professionals to help them navigate the complexities of making decisions in risky and important situations, and this book is equally written for risk managers, risk practitioners, risk advisers, risk analysts, risk facilitators and risk champions (or any other risk-related role).

It will also be of interest to HR professionals and others interested in organisational or behavioural psychology who need to know how to influence organisational outcomes.

Students, researchers and practitioners interested in decision-making under uncertainty will also find that we cover the topic from a wide-ranging perspective – although the book is written as practical guide for decision-makers rather than as an academic text.

We write for an international audience, since the principles are generic and apply to all situations and industries where people are managing risk. Although we often work in supporting managed change through programmes and projects, the principles in the book are equally applicable to making risk management work at strategic or operational levels as well as in project/change-based settings. The subject matter of this book should be particularly attractive to people working in business or public service in countries facing the economic challenges arising from the global financial crisis, where the imperative to be seen to be managing risk responsibly is critical at this time.

Finally, we write in the hope that people who use our ideas in their work situation will also think about how it might apply to their family or the social organisations they interact with, such as local churches, sports clubs, musical societies and so on.

WHAT PRIOR KNOWLEDGE ARE WE ASSUMING?

We assume no prior knowledge of risk appetite or any other risk-related terms other than a basic knowledge of the part risk management plays in an organisation. For those who are thinking about risk management for the first time, we’d recommend that you read some of our other work, for example Exploiting Future Uncertainty: Creating Value from Risk (Hillson, 2010) or A Short Guide to Facilitating Risk Management: Engaging Others to Identify, Own and Manage Risk (Pullan and Murray-Webster, 2011). We expect it may be easier for people with no knowledge of risk appetite to engage with the ideas in our book as they will not have been influenced by other texts. We recognise, though, that most of our readers will be interested in the subject because they have heard about and thought about risk appetite before and want to find out more about the subject. Recognising this, Chapter 2 provides a detailed summary of the risk appetite ‘story so far’, referencing specifically what regulators, standards bodies, professional associations and consultants have already published. You’ll find there isn’t much agreement. We take the topic, dissect it, then put it back together in a way that is intended to be totally practical and implementable in a variety of situations.

WHAT COMES NEXT?

Chapter 2 grounds this Short Guide in the context of the story so far and shows where the problems arise. One immediately obvious problem is confusion between risk appetite and other risk-related terms, especially risk attitude. To address this problem, in Chapter 3 we explore the roots of the two concepts to help us understand what risk appetite is and isn’t. In the light of the current terminology war, we aim to bring the conflict to a peaceful and stable conclusion.

Chapter 4 extends the argument to build a full taxonomy of risk-related terms and a holistic model that shows how they all relate when making risky and important decisions. We call this the Risk Appetite-Risk Attitude Model, or RARA Model and in Chapter 5 we build four worked examples to show how to apply the model in three stages. We start where decision-making is unmanaged, without an understanding of ‘how much risk is too much risk’. The next step is where decision-makers are knowingly constrained by risk appetite but they don’t know how to act if they find that they need to overcome this restriction. Finally we show how to move to an informed approach that takes full account of all relevant factors and produces an optimal outcome.

Because risk appetite as an idea is fundamentally linked to matters of decision-making and controls, Chapter 6 picks up the theme of measurement, exploring what can be measured, rationally and objectively, and what can’t. Establishing measures is crucial to success, so we aim to provide clarity about what is useful to measure and where it would be futile to try.

Chapter 7 then takes the RARA Model, our insights on measurement from Chapter 6, and the three scenarios of unmanaged, constrained and informed decision-making from Chapter 5 and suggest a simple step-wise process for determining the appropriate amount of risk to take in a situation. We show how you can apply the ideas in practice to inform your decision-making in risky and important situations. In this way you’ll be best able to protect your objectives from the threats posed by today’s challenges, as well as taking advantage of the myriad opportunities offered by uncertainty.

The final Chapter 8 provides the business case for applying the RARA Model in practice. It reiterates that the current confusion between terms and practice is damaging our society and economy, and that sorting out how to determine ‘how much risk should we take’ is a vital decision-making capability.

SUMMARY

We believe that it is important for people who are charged with making decisions on behalf of others to do the best they can to safeguard the world, its resources and its impact on the current and future generations.

All decisions are made in the face of risk – uncertainties that would matter to objectives if they occurred.

We argue that it’s impossible to make good decisions in risky and important situations if you haven’t considered how much risk would be too much risk to take in the situation, and if you’ve not put in place mechanisms and controls to ensure that you stay on track as time passes. Our aim through this book is help people know how to do this – in practice, not just in principle.

References

Hillson D. A. 2010. Exploiting Future Uncertainty: Creating Value From Risk. Farnham, UK: Gower.

Pullan P. and Murray-Webster R. 2011. A Short Guide To Facilitating Risk Management: Engaging People To Identify, Own and Manage Risk. Farnham, UK: Gower.

2 The Risk Appetite Story So Far

We’ve seen in Chapter 1 that decision-makers at all levels need to understand their own risk appetite as well as the risk appetite of other stakeholders. Without that understanding it’s not possible to make appropriate decisions about how much risk to take. That’s why risk appetite has become a hot topic recently. It seems everyone is talking about it, thinking about it, writing about it. This chapter summarises what they’re saying, to give a sense of the current debate and state of play. Unfortunately, as we’ll see, there’s not a lot of agreement.

So who is currently talking about risk appetite? We’ve identified four groups of people:

1. Regulators
2. Standards bodies
3. Professional associations
4. Consultants.

Let’s see what they have to say on the subject.

REGULATORS

Across the globe, corporate governance regulators have woken up to the importance of risk appetite. Recent guidelines from some of the most important regulators now refer to the need for organisations to define and communicate their risk appetite, although they don’t always use that term explicitly. Many boards of major organisations have recognised that they need to comply with these guidelines, so they have tried to express their risk appetite in corporate policies or annual reports. Unfortunately, without knowing precisely what is required, it’s hard for senior executives to know whether they are actually complying or not.

The problem arises because the various regulatory bodies do not use consistent terms. We can illustrate this by looking at corporate governance guidelines from the USA, South Africa, Australia, UK and Europe.

• In the USA, the National Association of Corporate Directors (NACD) Blue Ribbon Commission issued their ‘Report on Risk Governance: Balancing Risk and Reward’ in October 2009. This states that ‘The Board of Directors need to understand the organization’s risk appetite and level of risk tolerance. The assessment of the company’s risk appetite should be an ongoing process, considering that risks facing the company are constantly changing.’ Setting risk appetite is described as ‘a strategic decision’ for which directors are responsible. Elsewhere the report says that directors need to agree on ‘the appropriate level of risk that is acceptable given the company’s strategy – the risk appetite’. The report summary says ‘An important role ...