Fundamentals of Risk Management

Risk exposure and risk capacity
Figure 25.3 represents a risk-aggressive organization with a much larger comfort 
zone for accepting risk than the organization represented in Figure 25.1. The cau-
tious and concerned zones are smaller and the darkest zone is an even smaller part 
of the overall matrix. This situation can be described as representing an approach 
that has a very limited universe of risk. The universe of risk for the organization is 
represented by the darkest squares and it is only in this area that the board of the 
organization will consider that the risks are significant.
The organization represented in Figure 25.3 has a greater risk appetite, simply
because it has a more aggressive attitude to risk. By adopting a more aggressive
attitude to risk, the organization will have fewer risks in the critical zone. In this 
case, the ‘universe of risk’ for the board of the organization will be very restricted. 
The ‘universe of risk’ shown in the diagram represents those risks that will be con-
sidered at board level. It can be seen in Figure 25.3 that a risk will have to be of very 
high likelihood and impact before it receives boardroom attention.
In Figure 25.3, the ultimate risk-bearing capacity of the organization is shown as 
within the lighter-shaded zones. This represents a situation where the organization 
may be taking risks that are beyond the ultimate risk capacity of the organization. 
To make circumstances worse, the actual risk exposure of the organization is shown 
as well within the darkest area. This makes the organization vulnerable to risk, because 
its actual risk exposure is shown to be well beyond its ultimate risk-bearing capacity.
The identification of the risk appetite for the organization requires judgement, and 
this judgement can be exercised at different levels within the organization. Considera-
tion of risk appetite will be a strategic driver at board level. Risk appetite is likely to be 
an operational constraint at line-manager level because line managers will be expected 
to operate within the risk appetite policy that has been established by the board.
At the individual level, it is likely that consideration of risk appetite will be a
behaviour regulator. This is because individual members of staff should only operate 
within the risk appetite framework that has been developed at board level and is 
implemented by line managers.
The definition and application of the concept of risk appetite remains a consider-
able difficulty for risk management practitioners. It is the case that many current

---