Risk Tolerance, Appetite, and Culture

Risk culture, risk appetite, and risk tolerance are closely correlated in any business model for their important role in the development and management of business risks. Based on this research hypothesis, an enterprise that has a strong risk culture is efficient in the identification of the relevant risk opportunities and aligning them with the organizational objectives (Richter, 2014, p. 240). Doerig (2003) points that proper tailoring of these factors contributes to the creation and protection of business investment projects, internal values, and help address uncertainty in the markets. As economies become more globalized, enterprises face numerous risks arising from the ever-changing technology in communication and production, product innovation, and increased consumer control of market factors. This is because the markets are now more volatile than any other time and modern organizations need to adopt a risk-taking culture as a way of increasing resilience. A systematic and structured risk culture plays a major role in ensuring that there is efficiency in procedures and consistency in return on investments of risks assumed by an organization. The term ‘risk culture’ is a new concept that refers to the manner in which stakeholders in an organization understand risk. The definition of the phrase risk is not explicit, but has a distinct meaning in the sense that there is always a possibility of loss where gain is expected. However, the occurrence of a risk does not necessarily mean that a business will suffer losses. Materialization of risk may mean that an entity has lost a chance that would have contributed to the overall growth and performance over a long-term (Doerig, 2003). In retrospect, Yahoo lost the opportunity to Google to become the largest search engine in the world by taking conservative risks in investing in new technologies and markets.

Fewer definitions of risk culture have been developed so far, although the phrase has a general meaning derived from the constituent words. The Institute of Risk Management (2012) defines organizational risk culture as the beliefs, knowledge, values, and understanding of risks, shared by individuals of different ranks within an organization. The term ‘risk’ in business is associated with the factors, either internal or external, that may hinder the realization of an entity’s objectives. Denk and Exner-Merkelt (2005) define risk as the possibility of a negative impact on the economic position of an entity in the future dealings. According to the classical decision theory, a risk in business can be interpreted as the actions taken to distribute possibilities of outcomes and their subjective values. It is applied in the allocation of time, performance, costs, and services to influence the outcomes directly. In contrast, the meaning of the word business ‘culture’ originates from the anthropological and sociological definitions (Petrakis & Kostis, 2013, p. 151). Entrepreneurial culture, therefore, is a way of life adopted by a group of organized individuals (in this case, a business organization) that included values, behaviors, and procedures. An organization’s risk culture focuses on developing systems responsible for risk-taking and risk control. This includes activities such as expansion, introduction of new products, skills development, and marketing activities. Thus, culture is a variable that plays a crucial role in promoting the overall organizational success.

Figure 5: Organizational Culture as a Variable

There is a greater correlation between organization constructs and personal attributes in defining a parameter of a risk culture. Personal ethics, personal predisposition to risk, and behaviors are some of the individual employee characteristics that help establish organization risk culture (Richter, 2014). As employees work towards the realization of business goals, they must understand the purpose and mission of the enterprise so that they can align their risk behaviors in a manner that promotes the key objectives. In almost all industries, investment in employee skills and wellbeing is as important as developing a good risk culture of the enterprise. Doerig (2003) observes that risk culture is the second most important factor for successful risk management after human resource. This observation suggests that the human resource an important and integrated part of any risk culture.

Figure 6: The Core Values of a Good Organization Culture

Source: www.cass.city.ac.uk

A healthy risk culture encourages risk-reporting, whistle-blowing, and continuous learning from mistakes and successes realized in previous endeavors (IRM, 2012). However, these attributes cannot be cultivated in isolation of the organization’s ability to absorb the targeted risks, that is, risk tolerance. Kwak & Laplace (2005) define risk tolerance as an organization’s ability or preparedness to accept a certain amount of uncertainty of a specific risk category or initiative. To put it simply, various circumstances and individual inputs shape or prevent risks. These conditions and individual abilities determine the risk tolerance of a firm. In a reconsideration of the definition of risk culture, we understand that risk tolerance depends on the internal structures that have deliberately designed to address issues related to business risks (Kwak & LaPlace, 2005, p. 693). Assets such as employee skills, and financial muscle, market presence, and innovations determine the level of risk tolerance of a company.

An organization’s tolerance defines the limited level of risk that an organization is willing to absorb and the maximum unacceptable levels beyond which the management is obliged to abandon pursuit of the initiative. An organization takes risks based on its real ability to stomach the swings in the value of the investment without panicking. Crickette et al. (2013) point out that exceeding a certain level of risk may threaten the overall existence of an organization. Some cases have been recorded where major financial entities injected all their capital in risky investments that led to their bankruptcy. However, because risk includes the probability of both bad and good outcomes, firms that take biggers risk get the highest benefits because they are exposed to greater opportunities (Kwak & LaPlace, 2005). Organizations may take multiple unrelated projects as a strategy of increasing tolerance and reducing the level of risk. This approach works best for businesses that have various opportunities for investment that compete for the limited resources available. The management, therefore, strives to optimize resource by undertaking different unrelated projects at the same time hence minimizing the severity of risks. When a company focuses on one project, the level of risk tolerance reduces over time. This is because risk tolerance is fluid and dynamic in the sense that a persisting risk becomes detrimental over time (Daw, 1999). An organization, therefore, need not to dwell on traditional aspirations for too long. Instead, the management should develop policies that encourage continuous development of skills, innovations, and adaptation of new techniques in business activities.

Risk tolerance can be divided into three categories namely, aggressive, moderate and conservative. Aggressive risk taking tends to rely on the expertise of market-savvy individuals in organizations that deal that with highly liquid and volatile assets such as stocks. While maintaining a base of riskless investments, an aggressive risk taking might lead to maximum returns with the greatest risk. Gorter and Bikker (2011) points out those entities that take aggressive risks face the possibility of plummeting to zero. For this reason, many organizations may prefer to use the moderate risk tolerance model in making business and investment decisions. Moderate investors often pursue investment opportunities with intermediate terms of 5-10 years, are less volatile, and have a 50/50 return structure. However, some organizations are more suited to pursuing investment and business opportunities that have close to zero rates of risks (Gorter & Bikker, 2011, p. 42). They are usually long-term and have very low margins of returns when compared to aggressive and moderate risk tolerance models.

Crickette et al. (2013) define risk appetite as the amount of risk exposure that an organization wishes to pursue to satisfy the expected outcomes in risk-returns trade-offs. As such, risk appetite is directly linked to the expected returns in case a loss is not recorded. In other words, the risk appetite is manifested by the objectives and goals of an organization. A firm’s risk appetite should be measurable, temporal (to provide room for periodic review), and must have risk treatments (IRM, 2012, p. 72). When evaluating and determining risk appetite, organizations examine documents such as the board meetings minutes, customer contracts, strategic business plan, annual reports, annual financial statements, marketing materials, and regulatory requirements. It is often hard to quantify the risk appetite, but various strategies have developed to help create a general picture of an organization’s desire to commit to certain objectives. For example, it is easy to spot the risk appetite of firms facing severe conditions such as mounting debt, limited cash flow, and deteriorating market share (Kwak & LaPlace, 2005, p. 698). These organizations are more willing to gamble their resources with the hope getting business. They may even ignore obvious adverse conditions that are potential signs of sure losses. The amount of risk assumed reflects the entity’s culture and philosophy of resource allocation. As discussed earlier, an organization may choose to abandon some risks after sometimes and keeping others that shows a promise of future benefits.

The risk appetite guides in aligning organizational objectives with people and processes. These factors are important in the development of necessary infrastructures necessary to monitor and respond to risks. Rittenberg and Martens (2012, p. 31) indicate that risk appetite has four major influences on the overall activities of an organization. They include strategic objectives, integral allocation of resources, organizational attitudes, and response to risks. To identify how much an organization is willing to take, the risk must be measurable. It involves analysis of the risk profile in relation to the target marginal contribution to the total business risk. Hassani (2015, p. 12) suggests that both qualitative and quantitative assessment techniques must be employed in determining the statistical significance of the viability, liquidity, stability, and profitability of a target risk. Lack of articulation of the risk appetite is one of the major factors that led to the financial crisis of 2008 because objectives could not be linked to responsibility (Rittenberg & Martens, 2012, p 21). In this respect, without clear and uniform means of communicating and analysing risks, tolerance remains to be subjective notions. Wilemon and Ciero (1970, p. 52) introduce another category of risk appetite, the professional risk, which deals with the professional management. The management’s motivation relating to rewards and future job advancement that influences decision making and forecasting.