“It’s important that everyone in an organisation is reading off the same page when it comes to taking risks, not just at strategic and tactical levels, but at an operational level too. This will avoid costly incidents.” Pim Hagelstein recommends what he figuratively sees as a three-phase rocket to get employees to adhere to an organisation’s risk appetite.
It was about 10 years ago that I first became acquainted with the concept of “risk appetite”. But what exactly is it, I wondered, and what does it bring to the party? I realised though that you define your own risk appetite every day, often subconsciously. And that you can apply it to realise your objectives, by increasing or decreasing the risk that you are prepared to take. It’s hardly surprising that we all have different degrees of risk appetite. I even see it with my two children, who are completely different natured. The eldest is a risk taker, very adventurous, while the younger is risk-averse and much more likely to test the water before jumping in. And it’s no different in an organisation, so how can you ensure that your employees act in accordance with the organisation’s risk appetite?
Risk appetite in organisations often exists at strategic and tactical levels. At operational level this can often make the consequences of certain choices very unclear, which can lead to costly and damaging incidents. This is why it’s very important to have a clear and common understanding of what the risk appetite is for the entire organisation. Everyone in the organisation must have the same interpretation of the whole concept of risk appetite and it must be made a demonstrable part of the decision-making process, at all levels.
Risk appetite can be defined as an organisation’s willingness to take risks to achieve its strategic goals. If you want to know whether everyone in the organisation has the same understanding of this appetite, ask them these questions: Which risks are you exposed to? Which risks are you prepared to take? And what is the biggest risk you can afford to take? Their responses will speak volumes about whether the perception of risk appetite is mature, or not.
Defining risk appetite and making people in the organisation aware of it seems difficult. And that’s because it is. There’s something abstract about it, something indefinable. Just take the term itself, r-i-s-k a-p-p-e-t-i-t-e, and try explaining it. Yet, if you can comprehend risk appetite and communicate its importance, then in an abstract sense it would be worth its weight in gold, for both employees and the organisation as a whole. Start by stimulating awareness about what “risk appetite” entails and why it’s necessary. Examples from the real world will help. In regular business – at work, on the road, and at home – people are embracing risk appetite on a daily basis.
Supposing you are looking forward to a fun party, themed on the “Love Boat”, and it’s going to be held just 200 meters from your home. There’s just one problem: the Amsterdam-Rhine Canal is between your home and the party. What to do? Should you borrow your neighbour’s boat, take the shortest route and arrive in style? Or cycle for 20 minutes in the rain? Your choice will say much about your risk appetite and the boundaries that you set for yourself or that are set for you. In my case it was the latter. I was kindly, but firmly, requested by my better half to go by bike – like everyone else. Incidentally, whether such a dictated approach would be accepted on the work floor remains to be seen.
But back to the reality of the work floor. As an organisation how can you ensure that your employees adhere to the accepted risk appetite? The answer is top-down and bottom-up, via the equivalent of a three-stage rocket. (1) You explain the concept of risk appetite, based on practical examples of the relationships between strategy, risk profile and risk tolerances. (2) You enter into and remain in dialogue with your people about the desired risk tolerances and you define the limit values. (3) You make sure that the appropriate (visual) monitoring and control of the risk appetite are in place.
Finally, while the risk appetite can be part of the decision-making process at strategic and tactical levels, this does not necessarily mean that the whole organisation will act accordingly. If an organisation wants to be able to steer on risk appetite information, it must collectively flag up the risks, of which the tolerances will be clear. Only then will it be able to know where it could have gone wrong and what the impact would have been. That’s when an organisation can confidently claim to have a good grasp of the limits of its risk appetite, as well as a clear insight into the extent to which different departments are acting inside and outside these established limits. This might, incidentally, be more difficult for one department than it is for another, but it’s all a question of upbringing. You have to set clear limits, listen properly and keep the dialogue going.