One of my favourite French sayings is ‘pourquoi faire simple quand on peu faire complique?’ Translated to English it means ‘why make things simple when one can make them complicated?’ In the world of risk management there is sometimes a tendency to overcomplicate things.

Whilst I do appreciate that determining the risk tolerance for a complex investment fund is a lot more taxing than determining the risk tolerance of say a manufacturing or a sales and distribution company, I can’t help thinking that an unnecessary level of complexity is often brought to bear by ‘academic gymnasts’ more comfortable operating in an environment of complexity, controversy, and uncertainty.

Let’s face it; no matter how you go about determining risk tolerance, the output remains a quantifiable amount, usually expressed in monetary terms, which reflects the amount of risk an enterprise is able to take. This output is an essential input to the entire risk management effort but its determination should not consume more time and effort than managing the risks themselves.

Risk appetite can only be considered after the risk tolerance has been determined. Risk appetite is simply the amount of risk an organisation is willing to take. It is based on qualitative and quantitative factors but is equally, and often decisively, based on the risk culture, the risk attitude, and the ‘gut feel’ of an organisation’s executives.

What is certain is that an enterprise should not take risk in excess of its ability to absorb that risk or combination of risks. Don’t let your appetite lead you to bite off more than you can digest!

A well governed enterprise that successfully practices Enterprise Risk Management ensures that its risk tolerance is effectively and transparently calculated and that the risk appetite, within which the executive team must manage the organisation, is formally set by the board.

The distinction is clear: risk tolerance reflects the amount of risk you are able to take and risk appetite the amount of risk you are willing to take.