RISK-ACADEMY’S GUIDE ON

RISK
APPETITE
Structure of the guide
Guide to risk appetite 3

What is risk appetite 3

Documenting risk appetite 3

Reviewing risk appetite 3

Examples and case studies 4

Action plan 6
Additional resources 7
Useful videos on the topic 8
Recommended reading 9
Contact the author 10
Legal disclaimer and copyright notice 11
Guide to risk appetite
What is risk appetite
Before beginning the conversation about risk appetite, it is important to remember that most
organizations have already documented their appetites for different common decisions or
business activities. Segregation of duties, financing and deal limits, vendor selection criteria,
credit limits, treasury limits on banks, investment criteria, zero tolerance to fraud or safety
risks – are all examples of how organizations set risk appetite.

What is risk appetite:

• 10% of the time risk appetite is imposed by laws and regulations, not set - Often
risk appetite is imposed by government, regulators, markets, not set by management.
Examples include zero-tolerances or limits on safety, bribery and corruption, AML,
pollution, sanctions, privacy.
• 10% of the time risk appetite is the gentlemen’s agreement between Board and
management - Boards have an important oversight role and help them set the
direction and boundaries for management decision making. Those management
decision making boundaries is risk appetite. Examples include deal approvals only by
Board above a certain limit, limits on holding percentage of cash in certain pre-
approved banks, market risk limits, credit risk limits, insurance thresholds, rules on
credit limits for certain types of customers, limits on investments in different countries,
etc.
• 80% of the time risk appetite is the risk reward trade-off for a specific decision -
The key is making uncertainty around decisions presented to the Board transparent to
allow decision makers choose the alternative which offers the most appropriate risk
reward balance according to their individual appetites. More on this in the module 3.

Documenting risk appetite

Instead of creating separate new risk appetite statements, Board should encourage risk
managers to review existing Board level policies and procedures to identify:

• significant business decisions that already have a certain risk appetite set. For
example:
• a company may have a Board level policy that prohibits any business ventures
with organizations that utilize child labor or fall under economic sanctions
• company may have a documented requirement not to invest in high-risk projects
above a certain limit
• company may have a finance policy not to keep more than 20% of cash in a
single bank
• company may have a policy not to give additional trade credit to bad debtors or
credit limits on existing clients
• company include similar statements into investment guidelines “Generate a
reasonable rate of return at the moderate level of risk (expected volatility 10-
20%) through a diversified portfolio of projects.”
• many more examples
 • for the risks where no appetite has been previously set by any of the existing policies or
procedures, the risk manager should work with the business owners to develop risk
limits and incorporate them into existing policies and procedures. For example:
• develop a risk model for various market risks and set limits for sales teams and
treasury
• setting VaR limits for decisions authorized at various levels of management and
Board, for example a new refinancing may be financially significant but unless
there is a risk associated with the decision it makes no sense to discuss at the
Board.

Reviewing risk appetite

In cases, where the risk appetite has already been set, risk managers should work with
internal auditors to test whether limits are realistic and are in fact adhered to. 80% of the time
the appetites for different business decisions have already been set and all the risk manager
has to do is to validate, monitor, report any unusual activity.
Examples and case studies
Additional examples of risk appetite include:
• Performance targets are set not as single values, rather as ranges, where performance
outside of range is escalated to the oversight body.
• Key decision criteria are calculated based on the risk levels, for example, NPV and IRR
for an investment project are calculated depending on the risk level (usually replacing
WACC with variable discount rate based on risk or running Monte-Carlo to calculate
NPV range)
• Some significant management assumptions and risks are constantly or periodically
monitored through manual or automated indicators.
• Risks are calculated for key decisions to see that they are within management authority
or need to be escalated to the oversight body.

One common application of the concept of risk appetite is showing alternative decisions
against the efficient frontier. When comparing alternatives, it can be helpful to use a risk/return
plot to visualize the relative risks and potential returns of each alternative.
This can help decision makers to understand the trade-offs involved and to select the
alternative that is most likely to achieve their goals at an acceptable level of risk. In this
example, Alternatives 3,7 and 10 could be considered the better alternatives because they
have a higher potential return for an acceptable level of risk.
Which alternative out of the 3 good ones the decision maker will select depends on the
specific goals and constraints of the decision-maker, their appetite for risk and other factors to
consider beyond just risk and return.
Another example is running simulations to calculate the probability of favorable outcomes or
show target using probabilistic ranges. Case study shared later in the guide.

Another example is to show how different alternatives have very different risk profiles.
Case study

Large aircraft engine manufacturer is developing a

new engine and has presented the board with
revenue and cash flow forecasts as part of the
strategic plan update. The plan projects profits to
start in 2024, with $3,013 billion in profits by the
end of 2025 and cash flow of around $4 billion.
​

Before approving the strategy, the board requested

additional stress testing and risk analysis to be
presented by the management.

Risk management team ran Monte Carlo ​

simulations by stressing the following
assumptions:
• Inflation
• FX rate
• State guarantee approval
• Market demand
• Production costs
​
• Raw materials costs
• New equipment installation and new
product line start risks etc.
​
The output of the risk analysis showed:
• Approximately 12% (100% - 87,7%) chance
of achieving planned Profit/Loss in amount
of $3Bln. As shown on the diagram on the
left. Risk appetite for the company is 80%
chance of achieving objectives, so 12% is
unacceptable and management plan needs
to be reviewed
• Almost 0% (100% - 99,9%) chance of
achieving planned CF in amount of $4Bln.
• Additional debt required up to $3,5Bln.
​
This analysis allowed management to significantly
update the strategy before presenting back to the
Board.
Action plan

This checklist is designed to help organizations identify and manage their risk appetites. By
reviewing existing policies, procedures, and Board minutes, organizations can gain a better
understanding of their current risk appetites. Through interviews with key stakeholders,
organizations can also identify any non-documented appetites for risk. By mapping existing
risk appetites against key risks, organizations can identify any gaps and develop new risk
appetite methodologies to fill those gaps. These new limits should then be documented in
existing policies and procedures, and reviewed periodically to determine their effectiveness.

​ Review existing policies, procedures, Board minutes to identify existing appetites

for risks
Identify non documented appetites for risk through interviews with key
​ stakeholders

Map existing risk appetites against key risks to identify gaps

​
Develop risk appetite methodologies for the gaps, agree new limits
​
Document new limits in existing policies and procedures
​
Review existing limits periodically to determine fit for purpose
​
Additional resources

Deep dive into advanced risk

management using this online
course
This course gives guidance, motivation, critical
information, and practical case studies to move beyond
traditional risk governance, helping ensure risk
management is not a stand-alone process but a change
driver for business.
​
​https://courses.dcroi.org/courses/alex-sidorenko
​

Automate your quantitative risk

analysis using Archer Insight and
support business decision making
​
​
Archer Insight is a suite of enterprise-wide risk
quantification capabilities for business leaders designed
to deliver a complete view of enterprise risks, improve
resilience, and ensure achievement of strategic goals.
​
This innovative solution provides business leaders with
more precision in an aggregated view of risks that allows
them to ensure compliance and better protect your
business from disruption.
​
Using Archer Insight, organizations can conduct risk
quantification analysis, monitor, and report on their risk
management programs and then provide business
leaders and decision-makers with quantitative,
transparent, and actionable information needed to make
strategic business decisions.
​
​https://www.archerirm.com/insight-risk-academy​
Useful videos on the topic

Risk appetite vs risk tolerance, what they are and how to

use them - How to use risk appetite and tolerance to balance
the risk and reward. When they are applicable and when not.
Practical application for non-financial companies.
​https://2022.riskawarenessweek.com/talks/bringing-
quantification-into-the-game-how-to-manage-risks-more-
efficiently/
​

Practical guide to measuring probability of achieving

objectives - Just as non-experts can illuminate light bulbs
with electricity generated by power engineers, Chancification
will allow everyday managers (even those suffering from
Post-Traumatic Statistics Disorder, or PTSD) to illuminate
uncertainty and fix the Flaw of Averages with stochastic
libraries created by statisticians and data scientists.
​ https://2022.riskawarenessweek.com/talks/chance-informed-
healthcare-resource-management-in-the-face-of-pandemic-
uncertainty/
Risk as a Scarce Resource - Boards and the Attraction of
Risk Capital - When boards discuss risk, the negative
framing that is often associated with the word 'risk' leads to
biased, suboptimal decision-making around strategy. If risk-
taking capacity, or risk capital, is rather considered as a
scarce resource that needs to be carefully allocated to
management teams and is an integral part of performance,
​ this bias goes away.
https://2021.riskawarenessweek.com/talks/risk-as-a-scarce-
resource-boards-and-the-attraction-of-risk-capital/
 Why People insure their Cellphone but not their Home -
The cat insurance puzzle refers to the low or missing demand
for high-severity-low-probability events, which is surprising
given the high demand for low-value insurance products such
as cell phone insurance policies. While the loss of a cellphone
is usually an event of no or low consequence, the loss of a
home to a family or a large property loss to a business owner
​ can potentially be fatal.
https://2020.riskawarenessweek.com/talks/dr-annette-
hofmann/
Recommended reading
Risk appetite refers to an individual or
organization’s willingness to take on risks in
pursuit of potential returns. It is an important
consideration for businesses, as it can determine
the types of investments and strategic decisions
they make. A high risk appetite may lead to a
focus on high-growth, speculative investments,
while a low risk appetite may result in a
preference for more conservative, steady returns.
It is important for businesses to carefully assess
and manage their risk appetite in order to make
informed decisions and achieve their financial
goals.

Download the full guide to read about

documenting risk appetite, reviewing risk appetite,
case studies and examples and addition video
resources: Guide to risk appetite 2023​

Attention all risk management professionals! We

are proud to announce the publication of our
comprehensive guide to compliance risk
management. This guide covers the latest
industry best practices and provides practical
advice for managing compliance risks in your
organization. Whether you are new to the field or
an experienced professional, this guide is
designed to help you effectively identify, assess,
and mitigate compliance risks.

Get your copy today and stay ahead of the game

in the ever-evolving world of compliance risk
management. https://riskacademy.blog/risk-
academys-guide-on-compliance-risk-in-non-
financial-companies-free-download/​
This guide is designed to assist non-financial
organisations in developing and using risk
registers to support important business decisions.
The premise of the guide is that risk registers
should be used less frequently than is considered
normal in the industry and the format of the risk
register should be very different to what is
believed to be best practice.
https://riskacademy.blog/risk-academys-guide-to-
risk-registers/​

In this guide, we will delve deep into the

multifaceted world of risk culture, providing you
with valuable insights and practical steps to foster
a robust risk culture within your organization.

We will share case studies from a diverse range

of industries, allowing you to learn from the
successes and challenges faced by other
organizations in their quest to develop a strong
risk culture. Simple, practical steps, trialed and
tested by the RISK-ACADEMY team.

https://riskacademy.blog/risk-academys-guide-to-
risk-culture/​
We are proud to announce the release of a
comprehensive guide for alternative risk
management in Public-Private Partnership (PPP)
projects. Developed in collaboration with Alex
Belkov, a globally recognized specialist in risk
analysis for large infrastructure projects, this
guide provides a step-by-step approach to
incorporating risk analysis into the planning
process of a PPP project.

https://riskacademy.blog/risk-academys-guide-on-
risk-management-in-government-projects/​

Our comprehensive guide provides an in-depth

understanding of the ISO31000:2018 standard,
including its key principles and requirements. It
also includes practical advice and best practices
for integrating risk management into an
organization’s decision-making processes and
culture.

https://riskacademy.blog/download/risk-
academys-guide-on-iso310002018/​
Introducing the RISK-ACADEMY’s Ultimate Guide
to Risk Management Implementation! Our
comprehensive guide covers everything from
integrating risk management into decision-making
processes to building a risk-aware culture within
your organization.

https://riskacademy.blog/download/risk-
academys-guide-to-risk-management-
implementation/​

RISK-ACADEMY‘s Auditing Risk

Management Guide, a comprehensive resource
designed to help organizations assess and
improve the effectiveness of their risk
management practices. In today’s complex and
uncertain business environment, effective risk
management is more important than ever. As
such, this guide aims to provide practical insights
and recommendations for evaluating and
enhancing your organization’s risk
management efforts.

https://riskacademy.blog/download/risk-
academys-auditing-risk-management-guide/​
Contact the author

ALEX SIDORENKO, CRMP.RR, CT31000,

CTA31000
‌
Alex Sidorenko is an expert with over 16 years of risk management
experience in private equity, sovereign funds, investment
authorities and venture capital firms across Australia, CIS, GCC.
​
Successfully implemented changes to quantitative risk analysis, risk-
based decision making and neuroscience as a CRO at EuroChem
(global fertilizer $10B) and RUSNANO (private equity fund $3B).

Book a free no
Saved more than $13 million per year in premiums on cargo,
obligations call liability and PD/BI insurance through industry leading quantitative risk
with Alex analysis without changing deductibles and while doubling the limits.

Successfully defending corporate risk profile at the Ministry of

finance and securing more than $1B in extra funding.

Author of the most popular free risk management book in the

world, more than 200K downloads in 3 languages.

Risk manager of the year, FERMA, 2021, Honourable mention

2021, RIMS, Risk manager of the year, RUSRISK, 2014, Best ERM
Implementation, RUSRISK, 2014, Best risk management training,
RUSRISK, 2013, 2014, 2015, finalist in risk management awards in
2018 and 2019.
‌
Since 2012 Alex runs RISK-ACADEMY, a highly successful
company, focused on providing risk management integration
services, risk modeling, training and auditing to private equity firms
(direct investment and funds) as well as sovereign wealth funds.
Alex’s specialization is risk management integration, risk-based
investment decision making, value creation and asset
management.

​
Legal disclaimer and copyright notice
The information contained in this guide is for general informational purposes only and is not intended as
legal or professional advice. The guide is provided by RISK-ACADEMY and while we endeavor to keep the
information up-to-date and correct, we make no representations or warranties of any kind, express or
implied, about the completeness, accuracy, reliability, suitability or availability with respect to the guide or
the information, products, services, or related graphics contained in the guide for any purpose. Any reliance
you place on such information is therefore strictly at your own risk.

In no event will we be liable for any loss or damage including without limitation, indirect or consequential
loss or damage, or any loss or damage whatsoever arising from loss of data or profits arising out of, or in
connection with, the use of this guide.

Through this guide, you may be able to access other websites and resources provided by third parties.
RISK-ACADEMY has no control over the content of these sites or resources and assumes no responsibility
for them or for any loss or damage that may arise from your use of them.

RISK-ACADEMY reserves the right to make changes to this guide at any time without prior notice.

The information, content and format contained in this guide is protected by copyright. Reproduction of any
part of this guide, in any form or by any means, without the express written permission of RISK-ACADEMY
is strictly prohibited. The guide is for personal use only and may not be used for commercial purposes or be
distributed for profit.

By accessing and using this guide, you acknowledge and agree to the above Legal Disclaimer and
Copyright Notice.