Risky business: how much risk is right for your organisation?

Knowing how much risk is right for your organisation is an important way of taking control. A clear statement of the risks the business is prepared to accept, known as a risk appetite statement, provides the boundaries that can help an organisation to grow and prosper.

A risk appetite statement should be short, sharp and well worded so that people can understand it easily. It should also be closely linked to strategy so it serves as a reference point to guide the organisation.

The important elements in any risk appetite statement, according to a white paper by global consulting firm Protiviti, are those risks that are acceptable and those that are not, as well as assertions for strategic, financial and operational elements. Some examples of risk assertions include:

  • Self-sustaining growth: As we seek new business, we will maintain our working capital ratio of 1 to 1.5 per cent.
  • Loss exposure: We will manage our operational activities and exposures to avoid an event resulting in a loss to our pre-tax operating margin of more than $40 million.
  • Customer dependence: A single customer will not account for more than 10 per cent of total sales.

Specific yet flexible

Creating a risk appetite statement is often a task that, once completed, people are thankful to leave alone for a while. But Mike Purvis, managing director of Protiviti’s Sydney office, stresses that it shouldn’t be seen as a static document.

“Instead of setting a threshold that can never be breached,” says Purvis, “a risk appetite statement should provide an opening for the board to challenge, change and refine it on an ongoing basis, allowing the organisation to adjust its appetite according to appropriate risks and rewards.”

A risk appetite statement should be sufficiently directional, with quantitative and qualitative measurements defining the amount and type of risks you’re willing to take (or avoid).

“For example, if you’re willing to do business in high-risk countries, you’ve got to put some parameters around that, define the countries and confirm how much money you’re willing to put at stake or lose, and the types of activities you’re prepared to do in some countries but not others.”

A well-articulated risk appetite statement can also influence and direct the culture of the organisation.

“That’s critical. It’s not just the physical controls that exist regarding what you can and cannot do. It gives people the information, resources and, therefore, incentive to make the right decisions.”

All things considered

It starts with management corralling information on competitors, market conditions and developments, economic projections and other organisational challenges. Then, add a historical perspective: risks that have paid off, and those that didn’t, to help determine the risks you’re prepared to take in the future.

Purvis says there will be members on the board who are uncomfortable taking risks the organisation needs to take in order to be successful, be there in the long term or beat their competitors. The aim, however, isn’t to reach a compromise, but rather to explore aspects of the risk appetite that may be outside an individual’s comfort zones but not outside the appetite of the organisation as a whole.

“That’s the strength of a good board, and that’s why if you present well-structured, robust information, then the dialogue will allow a set of short, sharp statements to be articulated that everybody accepts.

“They may not all be personally comfortable with every aspect of it, but they’ll believe it’s right for the organisation. Then if you want to take more or less risk, the statement provides a foundation for that and for driving and influencing operational activities and behaviours.”

Share This Page