Fundamentals of Risk Management

Importance of risk appetite 
311
other constraints are often established in a Delegation of Authority within an organ-
ization. Levels of authority are a clear indication of the risk appetite of the organiza-
tion. In these circumstances, exposure to risk is a consequence of the size, nature
and complexity of the organization, and the organization will wish to set limits
that define risk appetite and thereafter mitigate or minimize the risk exposure and 
possible impact and consequences.
In simple terms, if risk management is about achieving the most favourable outcome 
and reducing uncertainty, then risk appetite is about identifying the optimum level of 
risk that will achieve the most favourable outcome. Risk appetite is a reflection of 
the risk attitude and the risk criteria that have been established by the organization 
and the risks that it is willing to take. Risk appetite can be a driver of strategy, plan-
ning guide for tactics or a set of operating constraints.
Many organizations have attempted to produce risk appetite statements, without 
clearly focusing on whether risk is a driver, planning guide or set of operating con-
straints. If all three approaches applied, the risk appetite statement will reflect the 
complexity of that approach. Table 25.2 provides a set of risk appetite statements 
that could be in place for a college or educational establishment.
TAbLE 
25.2
Risk appetite statements
assessment
Description
High risk appetite
The college accepts opportunities that have an inherently 
high risk that may result in reputation damage, financial 
loss or exposure, major breakdown in IT systems, 
significant incidents of regulatory non-compliance or
high potential risk of injury to staff and students.
Moderate risk 
appetite
The college is willing to accept risks that may result in 
reputation damage, financial loss or exposure, major 
breakdown in IT systems, significant incidents of 
regulatory non-compliance, potential risk of injury to
staff and students.
Modest risk appetite
The college is willing to accept some risks in certain 
circumstances that may result in reputation damage, 
financial loss or exposure, major breakdown in IT systems, 
significant incidents of regulatory non-compliance, 
potential risk of injury to staff and students.
Low risk appetite
The college is not willing to accept risks in circumstances 
that may result in reputation damage, financial loss or 
exposure, major breakdown in IT systems, significant 
incidents of regulatory non-compliance, potential risk of 
injury to staff and students.

---