As individuals, we all have our own feelings about the risks we face every day. How should we invest our savings, how fast do we drive, do we love to jump out of aeroplanes or dive with sharks, or are we happier reading a book on the beach? Organisations face similar dilemmas, and for charities these can be especially challenging. Should we embark on a new and untested fundraising venture? Should we accept the public support of a celebrity who can bring in new supporters and attention, even if their reputation may not be as white as snow? Our individual attitudes may vary, but we need an organisational view that can guide Board and staff decisions.

Most of our organisations have processes to identify, assess, mitigate and report on the risks we face. However, these processes don’t, on their own, answer the questions about which risks we should embrace and which we should avoid at all costs. Risk is inevitable. Nothing is completely risk-free. Risk management isn’t about avoiding all risks at all costs – that would be a recipe for failure. Rather it is about deciding which risks are worth taking, or even necessary and desirable, and how to mitigate the risks we do decide to accept as far as reasonably possible. The process of defining our acceptance or otherwise of specific risks clarifies our “risk appetite”.

A clear and agreed statement of risk appetite can provide a framework to help us make decisions where balancing risk and reward is a consideration. Unfortunately, the risks are not always quantifiable, at least with any degree of accuracy, so we have to exercise judgement. That judgement can be informed and guided by a risk appetite statement.

There is no one-size-fits-all simple statement of risk appetite. Charities in particular tend to have a very broad range of activities, and some may be inherently risky, while in other areas we may not be able to tolerate even the smallest risk. If our charity is working with vulnerable service users, we don’t want to take any risks with their safety and security. However, if we are providing humanitarian aid in a war zone, some risk to safety is unavoidable (though we can take steps to minimise it to some extent). We may not feel comfortable taking risks that financial systems could be open to fraud, but we may feel that the potential for first-mover advantage makes investment in a new fundraising technique a risk we must embrace.

Nevertheless, it should be possible to summarise a broad organisational approach that takes account of these differences and variations. To give an example, we might say something like: “we aim to be flexible, innovative and fast moving, as is essential for success in our competitive environment, embracing risk where appropriate but always offset by the best possible assessment and mitigation measures”.

Of course, our attitude to risk will depend on a wide range of considerations. These should be thought through in the light of potential risks the organisation might consider and discussed, lest we rely instead on the preconceptions of individual Trustees or managers. For example:

• What level of reserves do we have and how far could we bear losses if the worst scenarios occur?
• What are the potential benefits to weigh against the risk of possible costs or harms?
• What mitigations could we put in place to reduce the worst-case damage?
• Where would benefits and harms fall – how might the most vulnerable service users be affected?
• How far can we test and research ideas before committing to risky endeavours?
• What is the time horizon through which we examine risks and rewards – can we afford short term costs for long term gains?
• How does our risk appetite relate to our ethics and values – what are the areas in which we can’t tolerate any avoidable risk?
• Most importantly, how does our risk appetite fit with our strategic plans and ambitions – can our growth strategy be achieved without embracing a certain level of risk?

And we need to bear in mind that risk appetite, like strategy and priorities, may change over time and in response to a changing external context, so we’ll need to review our risk appetite statement at regular intervals. Of course, this is not straightforward. I recall many discussions during tough economic times when some charities felt they had to take fewer risks in order to preserve their core activities and protect their reserves, while others felt that recessionary times were the occasion to take greater risks so they were best placed to seize opportunities when the economy recovered.

There are going to be different views among the staff and trustees which will need to be talked through to achieve a consensus if possible. Trustees my feel more risk averse as, under UK charity law, they may stand to bear personal liability if things go wrong. Legal advice may be needed to provide clarity and reassurance on this point.

Staff, and trustees, could benefit from training in risk assessment and management to be applied, in the context of their agreed risk appetite, to ensure that the agreed approach is implemented effectively.

It may be worth adding to any organisational risk matrix a risk appetite column indicating the degree to which that particular risk may be tolerated in return for potential benefits. This could be on the basis of a simple categorisation of appetite for each defined risk, (eg high, medium, low or zero appetite). Zero might apply for example where any risk is intolerable, eg regarding breaches of regulatory compliance or safeguarding concerns.

Each charity will need to consider a range of risks in broad terms as well as applying the chosen appetite in specific cases as they arise. These are key matters where Trustees need to be fully engaged and to define parameters for their staff to apply. The diversity of income streams and activities within and between charities can make this a complex endeavour and trustees may feel the need for consultant support to facilitate the gathering of views and the management of debate and dialogue, as well as the drafting of relevant statements and processes.