It is nearly impossible to manage risk when you do not know what your risk appetite is. This is a simple, obvious fact -- but it is one that is ignored to a staggering degree by many organizations.Companies like Warren Buffett's Berkshire-Hathaway have had great success largely due to a well-known corporate culture that values long-term, conservative investing. On the other hand, many tech firms in Silicon Valley have made their investors rich by swinging for the fences. Either strategy can work, but it is important that everyone in the organization understands the overall attitude towards risk.
According to a recent Deloitte survey of risk professionals, however, only 23% of respondents noted that their institutions have an approved, written enterprise-level statement of risk appetite. The nearly 2,000 respondents identified the following as major barriers to creating a definition: creating a definition that is meaningful to the organization (20%), allocating the overall risk appetite to business units and divisions (16%), and measuring risks against the defined appetite (18%).
Until these hurdles are overcome and more companies can figure out exactly what their risk appetites are, expect to continue seeing a lull in widespread enterprise risk management implementation.