A colleague recently wrote an article for Business Reporter on risk management and shellfish. Not things you would obviously link you might think, but the mention of food started me thinking about a connection to risk management: risk appetite.

We recently surveyed a group of non-executives on risk management and noted that a significant proportion sat on boards that had not established their risk appetite; some weren't even sure what "risk appetite" was. Yet another buzzword bandied around by consultants and risk management professionals to create nervousness among board members that they are just not doing enough when it comes to identifying, understanding and managing risk? I hope to convince you otherwise.

I personally agree with the notion that risk management is, in essence, good management, and that risk-taking is an essential part of doing business, without which business opportunities will be lost and equity returns will be reduced. But in increasingly complex business environments where risks, and opportunities, need to be identified and assessed quickly, and where plans are executed across departmental, geographical, inter-company boundaries and through partnerships and joint ventures, contractors and other means outside a business' span of control, there has to be some structure and process around the management of risk.

But structure and process are no good if you haven't set the right risk culture, and haven't communicated what risk-taking is acceptable, or within the business' risk appetite. Broadly defined, risk appetite is the amount of risk a business is willing to take in pursuit of its strategic objectives. If we put it in the context of good practice governance requirements, the UK Corporate Governance Code states that "the board is responsible for determining the nature and extent of the significant risks it is willing to take in achieving its strategic objectives." Logically, then, setting the business' risk appetite is part of this determination.

I sat in a board meeting recently where a business initiative to move into a new, high-tech market failed, with significant consequences for the company. The share price had taken a nose-dive, down 8 per cent, sales had been minimal and its share in its core market was being eroded. Rather than discussing whether it had got the strategy wrong, perhaps misunderstood the market or not executed its plans well, the main focus of the conversation between executive and non-executive management was whether the initiative was something the board should have even signed up to in the first place.

The argument seemed to be that the board would never have signed up to it if they had known the consequences should it go wrong. While what the company was doing was entirely in line with their overall strategy, they failed to grasp the full consequences or risks of failure to deliver. They had not considered the aggregate risk to the core business, or determined whether the consequences were acceptable.

We can speculate on whether the business had the right strategy, where accountability for strategy sits, that better risk evaluation may have prevented them reaching this point, but what it did lead to was a meaningful discussion as to what the risk appetite of those sitting round the table was. A few months on, the board has a shared view of risk appetite, and the executive and staff within the business have a mandate to go and take appropriate risks in line with that appetite.

On an individual basis it is easy to make decisions about risk appetite (although we perhaps over-estimate our risk tolerance until something goes wrong); for organisations it is a complex business and requires considered debate between those at the senior level. Some thoughts on how to get it right:

  • Spend time understanding the nature of risks you face as a business
  • Take time as a board and executive team to debate your appetite for risk taking; without a shared view, how can you communicate it effectively?
  • Make any statement of risk appetite measurable and specific to your business
  • Use scenario planning – the 'what if?' and 'so what?' factors to test whether your risk appetite holds true when put to the test
  • Communication is essential; members of staff need to understand it, and be able to operate in an environment where they know that risk taking is supported within the framework you have set
  • Re-visit it – the business risk appetite will change over time (and you are unlikely to get it completely right first time).

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.