- Risk capacity, appetite, tolerance are related terms. Together, they deal with how much risk an entity is able to take on, how much it chooses to take on (willing to lose or willing to invest in the pursuit of opportunity), and (sometimes) how it gets allocated among different risks.
-
- In a given context, they are well-defined terms, but the definitions vary (and are even sometimes permuted); in this summary we use them interchangeably.
- The overall framing is that taking on "good" risk is generally rewarded (risk-return), i.e. risk taking is an enabler of opportunity. Entities should therefore try to maximize their risk taking within their capacity, whatever it is, to maximize their ability to pursue and meet their objectives, whatever those may be.
- Risk capacity is perceived as a useful concept especially in situations where external stakeholders impose requirements the entity must meet, e.g. covenants by lenders or expectations by rating agencies. Risk capacity then devolves from these requirements. More broadly, it is a useful framework where the amount of risk taken is a meaningful constraint to how aggressively/quickly the entity pursues its strategy/daily business. In all of these cases, often the risk capacity setting and monitoring process itself contributes to these stakeholders' confidence the entity is managing risk well.
- One participant spoke of the importance of the financial capacity of the entity as it enters due diligence events, with the importance of ensuring that purchase prices do not strain lender covenants (one example being the need to maintain overall bond issuance at below four times EBITA. This meant that financial forecasts across the group had a direct impact on the DD potential purchase price considerations.
- Risk capacity is perceived as not useful in situations where there are simple rules as to acceptable and unacceptable risks, and apart from those decisionmakers need to make ad hoc risk-return tradeoffs. This includes in particular cases where business activity is limited by available (stand-alone attractive) opportunity, rather than aggregate level of risk taken. In such cases, risk capacity discussions and risk appetite statements in particular have limited value, and are often window dressing which get modified or ignored all the time. "Risk capacity is always changing since the context is changing."
- One participant referenced specifically entrepreneurial organisations where constraints are built into the culture of the organisation and there are many checks and balances without the need for a set maximum, i.e. risk limits would be so soft/variable/nonbinding/ad hoc anyway that they are not worth it
- Sometimes the output of a risk appetite/capacity exercise (e.g. risk appetite statement) is of modest benefit, but the discussion of what are the actual business objectives and constraints that it stimulates is perceived as very useful by the participants.
- Risk capacity setting can be useful as a proactive alignment in advance of detailed evaluation of specific opportunities, i.e. a prior commitment how much we are willing to take on. The value then depends to what extent the culture is such that decisionmaking (e.g. M&A) will be bound by such prior commitments vs human factors.
-
- Hard vs soft limits provide an approach to at least stop and check if needed.
- To be meaningful, risk capacity needs to be accepted by all in the chain of command.
- In particular, it is a core role of the Board to set (or validate the setting of) overall risk capacity.
- Risk capacity can vary over different timeframes, though often this is not made explicit
- An example of using Risk Capacity in an M&A situation was the company that determined that while they had the financial capacity, they did not feel they had the management capacity to take people out of their jobs and insert them into the target company post acquisition. In this example, 'capacity' was as much about skills and existing people resources as it was about financial capacity.
- When meaningful, top-down financial risk capacity can be determined by codifying the specific financial requirements (e.g. covenants, other stakeholder expectations; insurance company solvency) and reverse-engineering the maximum amount of risk the entity can take "without drama", i.e. without putting those constraints at risk. This is often done using specific (stress) scenarios and/or probabilistic models of important risk factors. However, that can raise the challenge of whether the forward looking assumptions are correct. "I can never believe what someone shows on risk capacity, since it's likely showing smoke and mirrors". This is part of the usual challenge in risk management and planning under uncertainty of how much can be quantified and how.
- Risk capacity/appetite also relates to which risks an entity can and chooses to take on, in the sense of "on which risks / projects do we spend our overall risk capacity on". Generally speaking, "good" risks to spend more of the overall capacity on are those which are core to the business/strategic, and high-value. Other similar descriptions include risks of which the entity is "a natural owner", is competitively better positioned to accept or manage than others, and/or is learnable.
-
- Sometimes this is referred to as qualitative vs quantitative, but this applies only if the total capacity is a quant number but which risks to take is the qualitative part. In other instances, the risk choices are also quantitative.
- This point overall resonates more with mature entities with natural portfolio optimization and tradeoffs, where capital is the constraint. In less mature businesses, compliance typically exhausts the entity's risk attention span. And in extreme, moonshot "never done before" focused companies, resonates less
- Example from a space exploration entity - Tier A to D projects, which differ in the level of challenge, aspiration, and implicit risk capacity. Also, willingness to take major risk for a priorty effort changes over time. Ex. people were quizzed on willingness for a major, risky effort. Was around 7/10 initially; dropped to 4/10 in the aftermath of a major risk event; but increased again after postmortem and lessons learned.
Write a comment