Fundamentals of Risk Management

104

---

Alternative approaches
105
It is undoubtedly the case that taking too much risk may be inappropriate and
can result in failure of the whole organization. However, the experience of many 
organizations is that they almost always get away with it, or (at the very least)
manage to survive. A detailed understanding of the level of risk embedded in the 
organization is not intended to put a stop to all bold strategic decisions. Risk aware-
ness should not prevent an organization embarking on a high-risk strategy, but the 
decisions will be taken with full awareness of the risks that are involved.
Organizations should continue to look for opportunities and, from time to time, 
acknowledge that there is a good opportunity that looks very risky. The organization 
may still have an appetite for embarking on that risky strategy, but the next stage of 
discussion should be about how to manage the risks so that they remain within the 
risk capacity of the organization, and how to measure the risks so that the board 
remains aware of the actual risk exposure.
The global financial crisis does not represent a failure of risk management. It
represents a failure to completely and correctly apply risk management procedures 
and protocols. Figure 25.3 illustrates the risk appetite of a risk-aggressive organ-
ization. When an organization is risk aggressive, it limits the range of risks that the 
board will consider, as there is limited scope for identifying risks as high likelihood/
high impact. In other words, the universe of risk for that organization is severely 
restricted and will exclude risks that should receive the board’s attention.
If the organization is risk aggressive and operates to a model in line with Figure 25.3 
then very few priority significant risks will be identified. This will result in the
organization creating a ‘closed universe of risk’ for the board that potentially
restricts broader discussion and analysis. However, there is nothing inherently
incorrect about an organization being risk aggressive. If an organization is risk
aggressive, there is an increased need to revisit risk assessments, challenge the scope 
and results of risk analysis activities, and ensure that a highly dynamic approach to 
risk management is maintained at all times and at all levels in the organization.
In addition to the concerns about risk management raised by the global financial 
crisis, certain other challenging issues for risk management exist. The concepts of 
risk appetite and the upside of risk are useful ideas, but more development work is 
required before the definitions and successful application of these concepts can bring 
guaranteed benefits.