One of the essential components of any risk management strategy is to determine – from the outset – your ”appetite for risk.”
What is “Appetite for Risk”?
Appetite for risk is the extent to which you are prepared for your project, operation, or change to expose you or your organisation to risk. So, for example, an architecture firm with a contract for the first of a series of hospitals will be planning a project that will deliver predictably. Not just because getting a hospital right is a matter of health and safety but because, for the practice, there are huge commercial consequences to the success of the project… or not.
On the other hand, that same practice may be invited to prepare proposals for an innovative bridge that will become a major landmark. This is not core business, but the chance to do something truly different is attractive and could leap the practice up a few tiers. A dull but worthy proposal will not win. If they produce too radical a solution, then the only consequence is not getting selected. The practice chooses to take chances – not with the safety of their design, but with style and inventiveness.
How to determine Appetite for Risk
There are three steps to this process. The first is to recognise that all areas of the project or change are not equal. If you are looking to change the service perceptions of your customers, then you may be interested in changing staff behaviours, standards of service and pricing policy. You may well be prepared to take big risks to get an exceptional standard of service and innovative staff behaviours, but want to limit the risk on pricing.
Step 1: Segment your Risks
Look at all of the areas of your endeavour. You will need to determine your appetite for risk in each. Ways to find these areas include using the top level of your Work Breakdown Structure (WBS) or categorizing the sources of risk on your project.
Step 2: Determine the Relevant Risk Measures
What measures of risk will you use to determine your appetite? Commonly, we use a combination of impact and likelihood to give us some form of risk score. We then set a threshold score beyond which we will not tolerate a risk.
I have already discussed the problems of estimating probability (see my earlier blog, The Problems of Probability). Maybe you only need to look at impacts (which are much easier to estimate) – “how severe a risk will we take?” Mostly, we do weigh the likelihood but, in life, for most of us there are some risks we are each unprepared to take, no matter how remote the chances.
The other thing we weigh is proximity. We are often prepared to risk severe consequences if they will fall in some remote future. What are the ethics of taking a commercial risk when any consequences can only bite long after you are gone? (It is kind of worrying that politicians typically get a few years in power, yet need to deal with global issues that span decades or even centuries.) See my recent blog, Emotional Proximity.
Step 3: Assess the Level of Risk you are Prepared to Accept
For each area of your project, change or initiative, consider what level of impact, probability and proximity of risk you are prepared to accept. These levels now place a real burden upon you. By determining a level of risk is not acceptable, you must now be prepared to terminate the activity if you find a risk that you cannot mitigate sufficiently to remove it from that zone.
The “so what?”
Are you prepared to stop a project because of a risk? If not, then don’t bother with thinking about risk appetite: it’s a meaningless concept for you. However, if you want to protect yourself and your organisation from disaster, then, in the earliest definition stages of whatever you are doing, you must think about risk appetite, and consult others too.