Risk Appetite

[Gerard Chan]

Good day David

I'm confused with the terms risk appetite, risk limits, risk capacity and risk tolerance.
To clarify my confusion, I've drawn an illustration. Please refer to the file for my question.
Can you help confirm my understanding?
Thank you.

 

[David Harper CFA FRM]

Hi CJL, it's a good question, we are collecting our references to see if we can clarify exactly ... to be honest, I cannot off-hand locate "risk capacity" with respect to the others. Obviously, the IFC paper is meant to inform, and informs my question http://forum.bionicturtle.com/threads/p1-t1-301-enterprise-risk-management-erm.6665/ which articulates their (IFC) distinctions:

"Risk appetite and risk tolerance are newer terms in the risk management lexicon. In recent years, these terms have been used with increased frequency, particularly in the corporate governance and accounting community. The precise meaning and metrics of the two terms are still evolving and considerable inconsistency in their use remains. In contrast, the term risk aversion has the benefit of long use in the corporate finance community, with consensus on the concept, its measurement, and its implications for behavior. Fortunately, risk appetite and risk tolerance concepts appear to be rooted in the more robust concepts of risk aversion and risk policy. Recently, the Institute of Risk Management attempted to produce a clear definition of the terms “risk appetite” and “risk tolerance” as follows:

• Risk appetite: The amount of risk an organization is willing to seek or accept in pursuit of its long term objectives.
• Risk tolerance: The boundaries of risk taking outside of which the organization is not prepared to venture in the pursuit of long-term objectives. Risk tolerance can be stated in absolutes, for example: “We will not deal with a certain type of customer” or “We will not expose more that X percent of our capital to losses in a certain line of business.”
• Risk universe: The full range of risks that could impact either positively or negatively on the ability of the organization to achieve its long term objectives"

In this way, appetite < tolerance ... but frankly there has been some pushback (in this forum) and issues raised. "Risk Profile" (to my knowledge) has a loose, non quantitative (non ordinal) meaning: it's just a typography of a firm's risks. "Risk capacity," to me personally, is where i'm not clear if it even has a precise definition (EC context?); I can't yet agree to your ordinal ranking of it. "Risk limit" connotes intra-organization (i.e., position, portfolio, unit) tactical rule rather than strategic board-level perspective, to me. So, a firmwide risk appetite & tolerance would be consistent with (aligned with) multiple risk limits within the firm. I will add more later, hopefully organized, after we've collected what we've learned so far ... we, too, would like a diagram (maybe yours can be a start), since this clarification has come up several times since the IFC paper was added to the syllabus.

 

[David Harper CFA FRM]

cc: Christian C.

Hi CLJ, just wanted to share interim results of some excellent research by my colleague Christian. This is just draft curation: my intent is to provide this as an appendix to our annual feedback to GARP; this will support feedback on the IFC paper in particular, which in our opinion suffers some ambiguities (related discussion at http://forum.bionicturtle.com/threads/p1-t1-300-definition-of-risk.6658/)

Risk limits, best found reference at http://value-at-risk.net/risk-limit/

• "Risk limits are a device for authorizing specific forms of risk taking. A pension fund hires an outside investment manager to invest some of its assets in intermediate corporate bonds. The fund wants the manager to take risk on its behalf, but it has a specific form of risk in mind. It doesn’t want the manager investing in equities, precious metals, or cocoa futures. It communicates its intentions with contractually binding investment guidelines. These specify acceptable investments. They also specify risk limits, such as requirements that: the portfolio’s duration always be less than 7 years; all bonds have a credit rating of BBB or better.
  
  The first is an example of a market risk limit; the second of a credit risk limit. When an organization authorizes a risk limit for risk-taking activities, it must specify three things: a risk metric, a risk measure that supports the risk metric, and the limit—a value for the risk metric that is not to be breached."

Risk appetite, various (inconclusive)

• IFC (FRM 2103 assigned): "Risk appetite: The amount of risk an organization is willing to seek or accept in pursuit of its long term objectives."
• Nocco & Stulz (previously assigned in FRM): Essentially, it an articulated probability of maintaining a threshold credit rating; e.g., 98% probability of maintaining at least BBB. "The risk implied by achieving an OPTIMAL credit rating (status), including a minimum probability of maintaining the rating and a maximum probability of default ... "When credit ratings are used as the primary indicator of financial risk, the firm determines an optimal or target rating based on its risk appetite and the cost of reducing its probability of financial distress."
• PWC: "Risk appetite: the quantum of risk that the firm is willing to accept within its overall capacity ... "Defined well, risk appetite translates risk metrics and methods into business decisions, reporting and day-to-day business discussions. It sets the boundaries which form a dynamic link between strategy, target setting and risk management." (source: http://www.pwc.com/en_GX/gx/banking-capital-markets/pdf/risk_appetite.pdf, page 2)
• IRM: "there is very little by way of formal guidance on the definition of risk appetite ... Given the lack of conformity about the meaning of [risk appetite] ... Interestingly ISO31000, the international standard, is silent on the subject of risk appetite (focusing instead on ‘risk attitude’ and ‘risk criteria’), although Guide 73 (ISO, 2002) defines risk appetite as the “amount and type of risk that an organization is willing to pursue or retain." (source:http://www.theirm.org/publications/documents/IRM_Risk_Appetite_Consultation_Paper_Final_Web.pdf, page 14)
• IRM on ISO 31000 / Guide 73 BS31100: "Amount and type of risk that an organization is willing to pursue or retain." BS31100: Amount and type of risk that an is Is prepared to seek, accept or tolerate"

Risk tolerance

• IFC (FRM 2013 assigned): The boundaries of risk taking outside of which the organization is not prepared to venture in the pursuit of long-term objectives. Risk tolerance can be stated in absolutes, for example: “We will not deal with a certain type of customer” or “We will not expose more that X percent of our capital to losses in a certain line of business.”
• IRM: "It is worth noting that in the eyes of some commentators, risk tolerance is the more important concept. While risk appetite is about the pursuit of risk, risk tolerance is about what you can bear."

Risk capacity, my current view is that "capacity" is suggestive of an INDIVIDUAL rather a firm; e.g., it has meaning in CFP. Unclear if distinction between capacity vs. tolerance w.r.t. firm/institutional ERM

• PWC: Risk capacity: the maximum risk that the firm can bear which is linked to capital, liquid assets, borrowing capacity etc