Here Be Dragons: Risk Appetite When the Risks Cannot Be Known

There are many flavours of risk. Some we understand perfectly well. Leave the ice cream out of the freezer overnight and we know what we will find in the morning. We teach our children to look both ways when they cross the road, even on a one-way street (dangers of Lime bikes!) Banks employ specialists to manage the mismatch between assets and liabilities, because they know exactly what happens when they don’t.

But sometimes we simply do not know. The old cartographers had an honesty about how they dealt with this. Where their knowledge ran out, they wrote “Here Be Dragons”. Gradually knowledge pushed the dragons off the map, and we learnt that we could sail around the world without meeting one (unless we went to Komodo).

Organisations have their own uncharted edges. However many clever people you employ, the chance that between them they hold the knowledge needed to chart every one is remote. That matters, because most of the machinery of risk appetite assumes the opposite. We write appetite statements, set tolerances and build heat maps on the premise that we can name our risks in advance and decide how much of each we will carry. For the risks we know, that works tolerably well. For the dragons it cannot. You cannot set a limit for something you have not yet imagined.

Professor John Adams observed that, in the absence of knowledge, people respond to risk on the basis of their “ignorance, preconceptions and prejudices”. The same is true of organisations. When something genuinely new arrives, the appetite statement falls silent and behaviour takes over.

This is why I have come to believe that risk appetite is revealed in behaviour, not in documents. It is not what an organisation says it is willing to accept. It is what it routinely tolerates, rewards and ignores. Where risks are known, the gap between the two can stay hidden for years. Where they are not, the written appetite has nothing to say, and the lived appetite is all there is.

So the useful question for a board is not “What is our appetite for the risks we cannot foresee?” There is no good answer to that. The better question is “How do we behave when we are surprised?”

Unlike the unknowable risks themselves, that behaviour can be observed, and it can be shaped. Start with exceptions. Every organisation makes them, but does it notice when the exceptions start to become the rule, or does it quietly absorb them into tolerances? Then look at what gets rewarded. The manager who raises an awkward unknown early, before it can be quantified, should be thanked rather than asked for the numbers. If she is asked for the numbers, the organisation has told everyone what it really wants to hear. Finally, measure how long it takes for an unexplained signal to reach somebody with the authority to act on it. In the face of the unknowable, that interval is a better measure of appetite than any metric in the board pack.

None of this requires better models. It requires boards to spend less time admiring the statement and more time watching the conduct.

Ignorance carries heavy baggage in a world where a chatbot will answer any question you put to it. But ignorance is only the absence of knowledge. Approached honestly, it is the space for innovation, and for strategic risk management. No organisation can set an appetite for its dragons. It can decide what kind of organisation it wants to be when it meets one.