There is a growing recognition that a proper understanding of risk appetite is a vital influence on organisational performance. This is supported by regulators who expect boards to understand and express their risk appetite, and some senior executives in a range of public and private sector organisations are already taking a lead in this area.
This is a good start, but there is still confusion about how to define risk appetite and then use it to ensure that the organisation doesn’t take on too much risk (or too little). Our book “A Short Guide to Risk Appetite” (Hillson & Murray-Webster, 2012) attempts to dispel that confusion and provide clear advice on the topic.
There are four important factors to consider when defining risk appetite:
1. Conversation. This must be two-way, listening as well as talking, building respect for alternative perspectives. Different views on risk appetite are inevitable, driven by people’s inherent propensities for taking risk, and by their previous experiences of risk-taking that influence their perceptions of risk. This diversity is valuable, and open and honest conversation will enable differing perspectives to be aired and discussed.
2. Challenge. Diversity of views on risk appetite is normal, unless group dynamics such as groupthink are affecting the way people perceive risk, or if the group has worked together for so long that they have unconsciously adopted a cohesive approach. Challenge from a neutral facilitator will help decision-makers to consider alternative scenarios, and support open discussion of how much risk would be too much in the situation.
3. Cascade. Once senior decision-makers have a shared understanding of risk appetite for the whole organisation, this can be translated into measurable risk thresholds at the level of strategic objectives, as well as for operations, programmes and projects. Some advisors think that risk thresholds at lower levels in an organisation can be derived automatically using a formula, but this is rarely the right approach. Open conversation and neutral challenge will still be needed during the cascade process.
4. Controls. Finally, leading indicators are needed, not just lagging ones, to enable managers to know when current levels of risk exposure might breach risk thresholds. This might occur if risk exposure reaches a level where the outcome could not be tolerated, or risk exposure might get to a point where investing additional resources is no longer warranted. Where upper or lower risk thresholds are in danger of being breached, senior decision-makers will need to adopt a different risk attitude to ensure that risk exposure remains within acceptable limits. This will require the same level of conversation, challenge and cascade as the initial definition of risk appetite.
Implementing this approach is not easy because it requires behavioural change, led from the top and embraced at all levels. Risk is inherently subjective, but many leaders talk as if it were objective. This leads to a tension which can only be addressed through strong influencing skills, coupled with a deep understanding of the factors affecting risk perception and risk-taking behaviour. Risk practitioners must be committed to engaging leaders and encouraging improved self-awareness, supporting them as they explore various influences on risk perception and decision quality before deciding on a course of action. Only then will organisations be able to understand and express their risk appetite in a way that supports appropriate risk-taking at all levels.
[© Copyright August 2016, Ruth Murray-Webster/The Risk Doctor Partnership]
