Empowered Enterprise Risk Management

CHAPTER 8Risk Appetite

FIRMS TODAY ARE EXPECTED to be able to identify their core risks and provide evidence of good risk governance. Often, this expectation has been met through the implementation of enterprise risk management (ERM) programmes, which has meant an upswing in the amount of information available about risk. Many managers are struggling, however, when it comes to how this risk information should be incorporated into decision‐making. Sooner or later, the question of how much risk is acceptable will be asked. Indeed, what is the right level of risk to take?

The rise of the concept of risk appetite can be viewed as an attempt to provide some guidance on this issue. Risk appetite is typically framed in terms of ‘a firm's willingness and ability to bear risk in pursuit of upside potential’. Most people find relating risk to the pursuit of upside potential in this way a straightforward and reasonable concept. To explain how risk appetite is supposed to work, Power (2009) likens it to a thermostat:

Firms seek to identify all material risks and to design controls for them, producing a residual risk consistent with a target risk appetite, akin to how a thermostat adjusts to changes in the environment subject to pre‐given target temperature.

If risk deviates too much from what management thinks it should be, according to this model, actions are promptly taken to bring it in line with the firm's risk appetite.

Taken at face value, risk appetite has significant intuitive ...