Risk Appetite and Tolerance – Insights from the Institute of Risk Management

A 2011 guidance paper commissioned by the Institute of Risk Management gives some useful
detail on what risk appetite is and how to manage it – either in a corporate governance sense or to
inform how the organisation is run. The report notes the term risk appetite is similar to risk attitude
or risk capacity, but it suggests risk appetite is the most commonly used term in practice. For
example, ISO 31000 defines it as the “amount and type of risk that an organisation is willing to
pursue or retain”. The appetite for risk is typically determined by management and/or the board of
directors.

The level of risk appetite in an organisation depends on its context, but the paper suggests the
capacity for risk depends on four board items: the business context, people and knowledge,
reputation and infrastructure of the organisation. It gives an example of GEC, who in the 1990s
came under new management and with a change of name to Marconi, moved away from a
traditional manufacturing and defence business towards telecoms and internet businesses. Given
the subsequent failure of the group, they may have lacked the risk capacity to move into new areas
that the management team had little knowledge of.

Although all organisations may have a particular risk appetite, banks are a good example of
organisations who often publish risk appetite statements. For example, the Reserve Bank of
Australia notes:

“In terms of operational issues, the Bank has a low appetite for risk. The Bank makes resources
available to control operational risks to acceptable levels. The Bank recognises that it is not
possible or necessarily desirable to eliminate some of the risks inherent in its activities. Acceptance
of some risk is often necessary to foster innovation and efficiencies within business practices.”

The above shows even central banks must accept some levels of risk, but it does not in general
engage in anything other than low risk courses of action.

Think about:

(1) What do you think would be the risk appetite of a high-technology company?
(2) What role might management accountants have in preparing a risk appetite statement?

Note: Perform an in-depth case study based on the questions above and present your group findings
during the case class.