A 2011 guidance paper commissioned by the Institute of Risk Management gives some useful detail on what risk appetite is and how to manage it – either in a corporate governance sense or to inform how the organization is run. The report notes the term risk appetite is similar to risk attitude or risk capacity, but it suggests risk appetite is the most commonly used term in practice. For example, ISO 31000 defines it as the ‘amount and type of risk that an organization is willing to pursue or retain’. The appetite for risk is typically determined by management and/or the board of directors. The level of risk appetite in an organization depends on its context, but the paper suggests the capacity for risk depends on four board items: the business context, people and knowledge, reputation and infrastructure of the organization. It gives an example of GEC, who in the 1990s came under new management and with a change of name to Marconi, moved away from a traditional manufacturing and defence business towards telecoms and internet businesses. Given the subsequent failure of the group, they may have lacked the risk capacity to move into new areas that the management team had little knowledge of.
Although all organizations may have a particular risk appetite, banks are a good example of organizations who often publish risk appetite statements.
For example, the Reserve Bank of Australia notes: In terms of operational issues, the Bank has a low appetite for risk. The Bank makes resources available to control operational risks to acceptable levels. The Bank recognizes that it is not possible or necessarily desirable to eliminate some of the risks inherent in its activities. Acceptance of some risk is often necessary to foster innovation and efficiencies within business practices.
The above shows even central banks must accept some levels of risk, but it does not in general engage in anything other than low risk courses of action.
Questions:
1 What do you think would be the risk appetite of a high-technology company?
2 What role might management accountants have in preparing a risk appetite statement?