Risk appetite is how much and what kind of risk an organization is willing to seek or hold on to in the pursuit of its strategic goals. It's vital to know about risk appetite as a way to determine the overall risk-taking direction of a company. In simple language, it asks: "How much risk do we want to take in order to achieve our objectives?"
Risk appetite is usually influenced by a firm's mission, vision, values, corporate culture, industry environment, regulatory framework, and stakeholders' expectations. A startup technology firm, for instance, might have more risk appetite than a government-owned pension fund due to its desire to innovate and shake up markets.
While risk appetite establishes the overall limit of risk-taking, risk tolerance establishes the exact limits of risk that an organization is capable and willing to absorb at a specific point in time. In short, risk tolerance responds to the question: "What is the tolerable level of variation or deviation from our goals that we can manage without putting our operations or existence at risk?"
Risk tolerance is infinitely more detailed and operational than risk appetite. It entails definitive measurements, boundaries, and metrics like financial losses, project delay, safety accidents, or regulatory violations. For example, a bank may have a general risk appetite for market risk but a very low tolerance for credit losses over some level or funding shortfalls over some horizon.
The two terms capture a firm's attitude towards risk, but they look at different things. Let us outline their differences:
Risk Appetite is the broad view — it is the general willingness to take risks for value. It is usually described in qualitative terms and represents strategic objectives.
Risk Tolerance, on the other hand, addresses the operational limits — the precise band within which risks can vary without activating serious issues. It is usually quantitatively defined by the use of measurable parameters.
Risk appetite is generally established at the board or executive level and held across the organization as a whole.
Risk tolerance is implemented at the departmental or divisional level, deciding how much risk is acceptable for specific activities or projects.
Risk appetite is usually expressed in terms of broad descriptors like "high," "medium," or "low," while risk tolerance is linked with certain quantifiable metrics, such as "no more than 5% budget deviation" or "no safety incidents leading to injury in a quarter."
Risk appetite doesn't change much over time, except for when there has been a significant change in strategy or external environment (such as a pandemic or market collapse).
Risk tolerance is changed more often in response to changing conditions, project phases, or regulatory changes.
Risk appetite sets strategic guidance — it informs the organization just how daring or prudent it should be.
Risk tolerance imposes operational discipline — it keeps day-to-day behavior within acceptable and safe parameters.
Most organizations fall into the trap of mixing up risk appetite and risk tolerance, and this leads to uncertainty and bad decisions. By separating these concepts properly and knowing them well, organizations can gain the following advantages:
Improved Strategic Alignment: Risk appetite enables top management to align risks with business strategy. For instance, an expansion company can have a high appetite for market expansion risks.
Operational Control: Risk tolerance has the effect of ensuring that risky activities don't get out of hand. Even a risk-taking firm will establish tight tolerances to stop unacceptable losses.
Increased Communication: By defining risk appetite and tolerance clearly, firms are able to communicate risk expectations to stakeholders, ranging from board members to frontline staff.
Regulatory Compliance: In sectors such as finance and healthcare, regulators demand explicit documentation of risk appetite and tolerance.
Suppose an investment firm:
Risk Appetite: The board of the firm announces that it has a high risk appetite for equity market risk as it wants to achieve higher returns on behalf of its clients through aggressive growth portfolios.
Risk Tolerance: Nevertheless, the portfolio managers are told not to have more than a maximum of 15% of exposure in any one stock and need to keep potential quarterly losses to no more than 8% of the total portfolio value.
Here, risk appetite is the company's total strategic drive, while risk tolerance establishes specific, quantifiable bounds so losses stay within acceptable limits.
Companies can characterize these concepts of risk through defined processes:
What are the business goals? How much risk can the company tolerate to meet them?
Shareholders, customers, regulators, and employees have varied perceptions of risk.
Does the company possess financial power, experience, and resources to manage risk?
Risk tolerance must be specified through quantitative thresholds, such as revenue loss limits, cost overrun percentages, downtime allowances, etc.
Business conditions evolve. Both appetite and tolerance need to be re-examined from time to time to remain applicable.
Despite these being crucial concepts, businesses tend to experience challenges when defining them:
Vague Language: Using only broad terms like "high" or "low" without specifics can cause misinterpretation.
Lack of Data: Some organizations struggle to quantify tolerances due to insufficient risk data.
Cultural Resistance: Teams may resist clear risk limits if they feel these constraints limit creativity or flexibility.
In short, risk appetite and risk tolerance play distinct yet complementary roles within any company's risk management process. Appetite establishes the outer limit of risk the business is prepared to take on to meet its objectives, whereas tolerance provides the day-to-day boundaries that hold risks in tolerable, manageable levels.
Overlooking these concepts' distinction may result in inefficient risk management choices, regulatory violations, and strategic failure. Master the practical risk assessment strategies offered by the London Crown Institute of Training's expert-led Risk Management course to enhance your decision-making skills and safeguard your organization's success.
