Understanding risk appetite : what is it, what pressures shape it and how is it institutionalized

Abstract

The purpose of this thesis is to understand the concept of risk appetite in terms of what it is, what institutional pressures influence it, and how it is institutionalized in an organization. We try to understand what risk appetite is by examining the most influential enterprise risk management frameworks, reports from practitioners, and scholarly research on the topic. Through a case study of a large and complex Norwegian organization, we seek to explain what influences and institutionalizes risk appetite. First, we find that there is a consensus in the literature that risk appetite is a top-down element of enterprise risk management, but that there is disagreement as to how quantitatively it is understood and practiced. Second, we find that one cannot decouple risk appetite from its organizational context, as both external and internal institutional pressures influence risk appetite in the organization. Third, we find that risk appetite is not a singular concept in the organization. Risk appetites varies across risk categories, and the institutionalization of risk appetite relies on cultural elements in the organization. Our thesis adds to the understanding of the risk appetite concept, and adds to the scholarly argument that the evolution of risk appetite should go in the direction of addressing human and social behavior. Further, we contribute with a model to analyze institutionalization of risk appetite in organizations.