In follow up to our recent article on handling risks that exceed the company’s appetite, we would like to share this perspective from our friend Hans Læssøe on this complex and controversial topic.
Hans’ article below describes how the world’s leading risk management standards, COSO and ISO 31000, have differing definitions on risk appetite and tolerance.
COSO defines risk appetite as “…the amount of risk you are prepared to take…” whereas risk tolerance is “…the amount of risk you are willing to take.” ISO’s definition are the opposite where appetite is what the organization is willing to take and tolerance is what it’s prepared to take.
Since English is Hans’ second language, he says he prefers ISO’s definition, which is the one I generally prefer and operate from.
To put it slightly different, risk appetite is a baseline of sorts while risk tolerance is the amount you are willing to exceed this baseline in pursuit of objectives.
As this illustration shows, trying to mitigate anything under the appetite is a waste of time and mitigating anything that’s between the appetite and tolerance will need to be justified through cost/benefit analysis.
Throughout the risk management world, there’s intense debate as to how useful these concepts are. Opinions range from the absolute necessity of both to that they’re a waste of time and should be abandoned.
I would say I fall somewhere in the middle; risk appetite and tolerance can be useful for decision-making when done properly.
Further down the article, Hans provides some example risk tolerance statements and illustrates how linking them with actual performance metrics is how they can be transformed from something generic and insignificant into something very helpful for decision-making.
Hans closes out with an appeal to ISO and COSO to agree on terminology. Having these two separate definitions can be confusing to even veteran risk professionals, not to mention the organization at-large where actual risk management takes place. This fact demonstrates the importance of using the language of the business as much as possible.
Thank you to Hans for an informative, engaging article that includes some witty quotes. Click the link below for the full version…
Featured image courtesy of Oliver Roos via Unsplash.com
Sign Up For Our Newsletter
Sign Up For Our Newsletter
Helping companies achieve their vision and strategy, and succeeding in today's turbulent world, is something I'm honored to be a part of. Whether you're an occasional blog visitor or a long-term client, thank you for letting us be a part of your journey.
Most Recent Posts
Without a doubt, one of my family’s favorite holidays is Christmas. Part of the fun, especially for our son, is seeing what “Santa” brought, but most importantly, we treasure the spirit of peace and goodwill the season brings. And after what seemed to be a never-ending warm spell, the weather is expected to be good…Read More
As the end of the year draws near, I think we’d all agree that while it wasn’t without its challenges, this year also wasn’t quite as turbulent as the previous two. While a lot of people are juggling company parties, shopping for friends and family, and special activities for the kids, most companies are putting…Read More
Strategic planning is a challenge – of all people, I understand… After all the meetings, risk and data analysis, and brainstorming of the preceding months, it’s tempting to think this is the end of the road and you can relax. Contrary to this common perception though, this is exactly not the time to relax, but…Read More
Be honest – have you ever done something that you soon realized was a real rookie mistake? Me raising my hand… Considering the nature of ERM’s role to ask questions and challenge assumptions (often during conversations with executives), it can be argued that, in at least some cases, the expectations bar for risk professionals is…Read More
On occasion, I like to take some of the concepts we risk professionals think about in our jobs and apply them to different personal situations…take some of the same concepts we use when working with executives to develop corporate strategy and manage risks or uncertainty around that strategy. It’s Thanksgiving week in the U.S. –…Read More
Periodically, I have the pleasure of speaking one-on-one with Hans Læssøe on a variety of topics around ERM, strategic risk, and other issues and trends. As you know from my previous conversations (here, here) and posts featuring his work, Hans was formerly a practitioner at the iconic LEGO Company, but even more notably, is a…Read More
Everyone likes a clear-cut template that offers an easy way to create or manage something…I mean what’s not to like about a step-by-step process for accomplishing what you want? Sometimes this can work without any issues, such as the case with the Project Management Book of Knowledge (PMBOK), ISO 9001 standard, or a new cooking…Read More
One thing I was taught to appreciate from a young age was the value of education and knowledge. It didn’t necessarily matter what the subject was, just that I always maintain a learning or growth mindset regardless of my current status in life. This mindset has served me well over the years, and it’s a…Read More
It’s amazing how technology has developed and changed our working world over time. Imagine trying to run my risk and strategy consulting firm without tools like Zoom, Box, Slack, and other ERM-specific technology tools. There is no way we would be able to serve our clients the way that we do. Just consider how the…Read More
If you’ve been handed the task of creating an ERM program for your organization, let me first offer my congratulations quickly followed by my empathy for the task ahead of you. I don’t say that to scare you but to provide a small dose of reality. Building, launching, and refining an ERM program that is…Read More