An enterprise need to establish its risk appetite. The risk appetite of an organization refers to the amount of risk and potential financial loss that enterprise is prepared to accept within a certain time period.

Determining risk appetite

In determining risk appetite, organizations need to consider internal constraints such as funding, investment requirements, potential risks, liability, various types of risks, strategy, competitive advantage and the external environment of the organization. Moreover, it needs to consider the preferences of shareholders towards risk taking.

In determining the risk appetite, as in any other business activity, an organization needs to be guided by the ultimate objective of the enterprise which is the maximization of the shareholders’ value.

An enterprise’s risk appetite should be aligned to the amount of risk necessary for a business to take to achieve its objectives.

Risk appetite is determined by aligning the risk management and the value proposition to business strategy. Risk appetite will determine the level and nature of risks that the organization can tolerate. There are more technical ways to determine the risk appetite.

The risk appetite should be clearly stated and measurable. The risk appetite should be incorporated into organizational policies and procedures. In this way employees of the organization are able to get a clear indication of the enterprise’s risk appetite by examining its policies and procedures. With the risk appetite effectively linked to business strategy, it allows to more effectively assess performance of the business units with the help of risk/return analysis and risk limit monitoring.

Risk appetite is largely based on competitive advantages that organizations possess. When organizations have competitive advantage in a certain area of business, then for this particular organization certain risk taking in this area may entail much larger expected returns than what another organization could expect. Consequently, the risk appetite of such an organization should reflect it.

For example, imagine that company X, which is a leading direct insurance services provider in country 1 (one of the emerging markets), has competitive advantages in know-how of direct marketing in the insurance industry as well as in other aspects relevant to running a leading direct insurance services provider. Company X will have much higher expected return with regards to taking certain risks compared to company Y which does not have competitive advantages of company X, but is trying to set up a direct insurance company in an emerging market.

For example, company X will have much higher expected return in undertaking a project of establishing direct insurance services provider in country 2 (another emerging market), compared to company Y which does not have competitive advantages of company X. Therefore, such risk taking for company X will make more sense vs for company Y.

Risk appetite should also be set below the limit that organization can actually handle. This will allow for a margin for error and prevents negative consequences from overestimation of the organization’s capacity to tolerate risk and serves as an allowance for unexpected catastrophic events. The limit of risk an organisation can handle is called the risk tolerance.

Once the risk appetite is established, a new risk culture should be created to reflect the risk appetite of organization. The structures, managerial and employees’ level of knowledge, and resources should be aligned with the type and extent of risks the organization is undertaking.