A new edition of this article - why?

Welcome to a new edition of this article on 'risk appetite', 'risk tolerance', and related ideas and practices. The first edition focused on resolving the confusion created by the chaotic and misleading terminology used in this area of risk management. That article received considerable praise and has even been described as a 'classic'. However, things have moved on and three events have been particularly important in prompting this major update:

• The terminology problem and its solution were clearly established. The survey research reported here has confirmed the findings from reviewing published definitions, reported here, showing that the terminology really is a problem but it can be solved by simply preferring to use plainer, more self explanatory language than 'risk appetite'.

• The new UK Corporate Governance Code introduced a relevant new requirement. This applies to companies listed in the UK and the revised edition in 2010 contains a new sentence stating that "The board is responsible for determining the nature and extent of the significant risks it is willing to take in achieving its strategic objectives." This wording replaced the wording in the draft, which referred to 'risk appetite and tolerance' (a small but welcome victory for clear thinking). However, it also created a new challenge for companies, which is to comply in a way that is beneficial to them. The new edition of my article provides specific suggestions on how to do that.

• A route to value from these initiatives has emerged. From the many discussions on this topic and from studying attempts by companies, public sector organizations, and their various advisors to do something worthwhile in this area it has become clear to me that there is something much more important and potentially valuable going on than putting some kind of limit on overall risk taking. The new edition explains this exciting opportunity.

Introduction and key points

While the terminology and theory around 'risk appetite' may have been a mess, some of the practical initiatives attempted around it contain the seeds of greatness. The common factor in these initiatives is the attempt to influence directly by policies and their implementation important decisions taken inside organizations, in such a way that the limitations of knowledge are better handled. In other words, the aim is to get people to think effectively about 'risk' in some sense when they make important decisions. One option is to impose some overall limits on risk and overlay those on top of existing business planning and monitoring decisions, but this is only one option and not necessarily the easiest or most useful.

The decisions involved, the style of policy, and the approach to limited knowledge vary. Some techniques are better than others. However, the general desire is to reduce the incidence of decisions that are stupid, short term, narrow minded, or selfishly motivated. There is also a desire to give leaders new levers they can pull to influence people in their organizations. The general approach is to lay down some rules, or at least guidelines, focusing on 'risk' in some sense, and try to get people to follow those rules.

There is no one technique for making decisions, still less making them under uncertainty, that is theoretically perfect and practical in all situations in organizations. Nor is there one way to take 'risk' into account that is theoretically perfect and universally practical. However, there are several good approaches that can be used, ranging from computational to conversational, and it is not hard to see that circumstances should at least influence which are used. (See here for an overview and some practical suggestions.)

Furthermore, the technique for taking 'risk' into account needs to work with the overall approach to taking a decision. For example, if a decision is primarily based on finding ways to stay on budget then asking for Net Present Value calculations using risk adjusted discount rates reflecting the betas of alternative courses of action is not appropriate! In most cases it is too much work, but more importantly the Net Present Value criterion is philosophically incompatible with trying to stay on a fixed budget.

With these fundamental insights in mind it is obvious that crucial steps in any initiative in this area will include the following:

• Identify the sets of decisions to be controlled, who makes them, and on what occasions. (This may be driven in part by how important those decisions are for risks of interest.)

• Identify how decisions are made in each case, and perhaps consider improvements or clarifications.

• Decide how to deal with 'risk' (or, more generally, limited knowledge) in each type of decision.

• Draft or revise policies covering decision making, including handling limited knowledge. (These may include parameters such as the value of limits, targets, or weights, that can be varied while keeping the form of the policy otherwise the same.)

• Implement the policies.

• Revise the policies (or at least the parameters within them) at appropriate times.

Through following this approach there is an opportunity for many organizations to refresh their management methods, improve their decision making, and get more from their investment in risk management.

In the remainder of this article I will illustrate the above ideas by describing some typical projects (pointing out some common problems), and then go into more detail on project planning and on different types of decision, techniques for decision making, and techniques for dealing with limited knowledge.

But before that, to deliver on the promise of the title of this article, here is a brief explanation of relavant terminology.