Risk – Appetite vs Tolerance

Over the last year, we’ve all been faced with risks in our personal and professional lives that we probably couldn’t have imagined. This global pandemic has caused us all not just to reflect on our attitude to risk, but to make decisions for ourselves, our families and our businesses based on our understanding of these risks.  It may have caused debate or disagreement between friends, families or work colleagues, which highlights how personal our attitude to risk is.

In these situations, it can be helpful to distinguish between risk appetite and risk tolerance. The latter is around where are our personal or corporate boundaries – for example, we won’t put our families or employees at significant risk of contracting COVID. We might dispute what that exactly means or how it might be achieved, but it is a statement limiting our tolerance for risk. Risk appetite on the other hand starts to venture into the tricky area of what trade-offs am I/we prepared to make and what risks are therefore taken – for example, in balancing the need for economic recovery by re-opening businesses, or meeting up with friends if I am 20 years old rather than 60.

In business or projects, risk appetite and tolerance are closely linked to performance over time. All businesses have to take risks, but also avoid those that can negatively impact performance.  During our training on risk management, I find it helpful to use these simple illustrations to initiate discussions about the risks that we face in our projects. As you can see though it’s an equally useful concept for any situation involving decisions needing to be made on risk.

Extract from IRM Risk Appetite and Tolerance Paper

Diagram 1 shows the expected direction of performance over the project period

Diagram 2 illustrates the range of performance depending on whether risks (or opportunities) materialise

The remaining diagrams demonstrate the difference between:

• all the risks that the project might face (the “risk universe”- diagram 3)
• those that, if push comes to shove, they might just be able to put up with (the “risk tolerance” – diagram 4), and
• those risks that they actively wish to engage with (the “risk appetite” – diagram 5).

Risk tolerance can be expressed in terms of absolutes, for example, “we will not expose more than x% of our margin to project losses” or “we are not in the lump sum EPC business; we’ll only take reimbursable jobs”. Risk appetite, by contrast, is about what the organisation does want to do in its projects and how it goes about it, for example, knowingly taking risks inherent in first of a kind technologies or moving into new geographical markets. It therefore becomes the management’s responsibility to define this all-important part of the risk management system and to ensure that the exercise of risk management throughout the organisation/project is consistent with that appetite, which needs to remain within the outer boundaries of the risk tolerance.

It may be interesting to think about your organisation/project and reflect on whether proactive discussions and decisions have been made around these risk boundaries. And with regard to the pandemic, and our gradual opening up of the economy and our lives, it’s also a useful way to think about our approach to this risk universe – which we might conclude is rather larger than we may have thought a year ago.

Applied Risk Management is a Kingsfield Academy, ECITB approved course about the inherent risks in engineering and construction projects, and how to confront these.

Karen Cherrill – Partner Kingsfield Academy