Risk Appetite: What Is It and How Much Should You Have?

By Samantha Beavers

Market fluctuations. Data breaches. Unexpected negative product placements… Peloton and Sex and the City, anyone? All are risks faced by businesses every day. The question is not whether or not companies are going to experience risk, but rather how to best respond to or even pursue risk.

Enter risk appetite.

Risk appetite captures the idea that while risk can hinder an organization’s success, risk aversion can, as well. It doesn’t simply acknowledge that organizations can tolerate a certain degree of risk without negatively impacting their bottom line, but also that organizations should embrace a certain degree of risk in order to prioritize their long-term success.

However, this is more than a “no risk, no reward” mindset. Rather, risk appetite is the understanding that embracing risk is a critical component of decision-making.

But how much risk appetite should an organization have? What level of risk is too much? How much is not enough? And how should a company articulate this risk appetite to its stakeholders?

According to Mark Beasley, Poole College KPMG Term Professor of Accounting and director of the college’s Enterprise Risk Management Initiative, it depends.

Tailored to fit

To start, management must recognize that the right-sized risk appetite isn’t only dependent on an organization’s greatest risks, but also its greatest priorities. This means, however counterintuitive it may seem, that determining the optimal level of risk for an organization involves turning away from a purely risk-centric approach.

Rather than thinking solely about the organization’s specific risks, leaders also need to think about the organization itself.

What industry is it in? What is its mission and vision? What values, like corporate social responsibility and sustainability, does it deem most important? What are its key objectives? What is the company culture?

“All of these different factors ought to shape a company’s risk appetite for different aspects of risk taking,” Beasley says. “An entity has different appetites for taking different types of risks. An organization with a strong culture of product innovation, for example, will likely invite more risk and see it as an important part of its growth, but it likely has very little appetite for ethical or compliance violations.”

Additionally, an organization must consider where it is. Is it in a financial position that is strong enough to have the capacity to take on more risk to prioritize its long-term success? What is its standing in relation to its competitors?

While taking on too much risk can be harmful for an organization in a financially fragile position, an organization with highly innovative competitors may find that it needs to take on additional risk to keep up.

Put simply, there is no one-size-fits-all approach to risk appetite. However, an organization can arrive at its ideal level of risk by considering factors such as its culture, its values, its strategic objectives and its financial position.

“At the end of the day, risk appetites have to be developed in the context of strategy. A company cannot determine how much risk and which risks to embrace without understanding why to embrace it,” Beasley says.

Knowing your audience

While determining the right level of risk is essential, it is equally important for organizations to articulate this risk appetite to decision-makers across the organization. Otherwise, risk appetite will never come to bear in a company’s day-to-day behavior.

To do this effectively, management must communicate in a way that is consistent with the overall company culture, using language that reflects its own values and goals. Additionally, companies might consider developing a variety of risk appetite statements, each tailored to different levels of the organization.

To convince the board and C-suite of the importance of risk appetite, for example, organizations ought to develop a statement that frames risk appetite in terms of an organization’s strategic objectives. 

When risk appetite becomes a matter of how much risk is necessary in order to perform – not just a matter of how much risk is acceptable before it needs to be monitored – it takes on relevance for these senior leaders. They can see why taking the right risks is in the organization’s best interests and how certain risk responses may even hamper their ability to pursue strategic objectives. 

In addition to a high-level statement, management must also flesh out its risk appetite for lower-level managers, incorporating more granular details and language that resonates with various teams in the organization.

“Each risk appetite statement must be practical and specific enough for the individuals working with it. If it’s not relevant enough, employees won’t know how to meaningfully put it into practice,” Beasley explains.

“Again, we have to remember that risk appetite is about decision-making. The most successful businesses are the ones that understand not only how to monitor and mitigate risks, but also how much and what types of risks to take on to achieve their goals,” he continues.