In follow up to our recent article on handling risks that exceed the company’s appetite, we would like to share this perspective from our friend Hans Læssøe on this complex and controversial topic.
Hans’ article below describes how the world’s leading risk management standards, COSO and ISO 31000, have differing definitions on risk appetite and tolerance.
COSO defines risk appetite as “…the amount of risk you are prepared to take…” whereas risk tolerance is “…the amount of risk you are willing to take.” ISO’s definition are the opposite where appetite is what the organization is willing to take and tolerance is what it’s prepared to take.
Since English is Hans’ second language, he says he prefers ISO’s definition, which is the one I generally prefer and operate from.
To put it slightly different, risk appetite is a baseline of sorts while risk tolerance is the amount you are willing to exceed this baseline in pursuit of objectives.
As this illustration shows, trying to mitigate anything under the appetite is a waste of time and mitigating anything that’s between the appetite and tolerance will need to be justified through cost/benefit analysis.
Throughout the risk management world, there’s intense debate as to how useful these concepts are. Opinions range from the absolute necessity of both to that they’re a waste of time and should be abandoned.
I would say I fall somewhere in the middle; risk appetite and tolerance can be useful for decision-making when done properly.
Further down the article, Hans provides some example risk tolerance statements and illustrates how linking them with actual performance metrics is how they can be transformed from something generic and insignificant into something very helpful for decision-making.
Hans closes out with an appeal to ISO and COSO to agree on terminology. Having these two separate definitions can be confusing to even veteran risk professionals, not to mention the organization at-large where actual risk management takes place. This fact demonstrates the importance of using the language of the business as much as possible.
Thank you to Hans for an informative, engaging article that includes some witty quotes. Click the link below for the full version…
Risk appetite and risk tolerance
Featured image courtesy of Oliver Roos via Unsplash.com
