Fundamentals of Risk Management

Risk culture
314
appetite for such risks. For example, people are willing to smoke cigarettes, but also 
wish to develop a healthier lifestyle. This is an example where the appetite for risk 
may be less than the actual risk exposure.
There is a tendency for people to take a course of action when the outcome is
immediate, positive and certain. Therefore, a smoker will want a cigarette because 
the nicotine effect will be immediate, positive and certain. In contrast, giving up 
smoking will probably result in long-term benefit, but that benefit will be delayed 
and uncertain and there will also be negative feelings of being without nicotine.
The attitude of people to risk taking will vary considerably depending on the type 
of risk that is being considered. For example, individuals may be very risk-averse
in the way they drive their cars, but accept significant risk factors in relation to their 
health. Risk appetite statements related to the risks that individuals are willing
to take are, perhaps, just as difficult to construct as risk appetite statements for
organizations. In both cases, a clearly defined risk attitude would help define the
appetite for a range of risk factors.
The willingness of individuals to take risks will also depend on the nature of
the risk and the ability to put effective controls in place. Table 11.4 includes car 
ownership as one of the financial expenditure personal issues and Table 3.1 con-
siders the specific compliance requirements, hazards, uncertainties and opportunities 
associated with owning a car. Table 25.4 outlines some of the cost-effective controls 
that can be put in place to mitigate hazards, manage uncertainties and embrace
opportunities. Overall, the level of expenditure that an individual is willing to
allocate to funding a control will be an indication of the risk attitude and risk
appetite of that individual.
This practical example demonstrates part of the embrace, manage, mitigate and 
minimize (EM3) approach related to strategy, tactics, operations and compliance 
(STOC). The overall approach to personal and organizational issues should be to:
●
●
embrace opportunity risks (strategy);
●
●
manage uncertainty risks (tactics);
●
●
mitigate hazard risks (operations); and 
●
●
minimize compliance risks (compliance).

---