Approach to Risk Management
Approach to risk management
The approach is how an organisation applies the MoR principles in its own context. It sets the risk appetite, tolerances and thresholds, defines scales and scoring, describes governance and escalation, and tailors the process. The exam tests whether you can design an approach that is proportionate and decision-useful, and whether you can distinguish appetite from tolerance and threshold.
Core distinctions
- Risk appetite: the amount and type of risk an organisation is willing to take in pursuit of objectives.
- Risk tolerance: the acceptable variation around a target or appetite; often expressed as a range.
- Risk threshold: a limit that triggers escalation or action when crossed.
- Risk capacity: the maximum risk the organisation could bear before objectives are threatened.
An approach also defines probability and impact scales with clear descriptors, a risk matrix or other evaluation method, aggregation rules, reporting lines and review frequency. It should be approved by the appropriate governance body and communicated to all who manage risk.
Worked example
A delivery programme states an appetite for moderate schedule risk but zero tolerance for safety breaches. It defines a five-point impact scale for safety where any score of 3 or more is a threshold requiring immediate escalation to the programme board. A supplier delay scored 2 on schedule and 4 on safety is therefore escalated, even though schedule risk alone would be within appetite. The reasoning is that thresholds and appetite are applied by risk category, not as a single global number.
Traps
- Using appetite and tolerance interchangeably.
- Publishing a risk matrix without scale descriptors, so scores are subjective.
- Setting thresholds that no one can monitor or escalate in practice.