# How do you calculate acceptable risk on your project?

I am trying to find some information on the following: how do I determine the acceptable risk (risk appetite) for my project, what is the usual practice/approach? Is it percentage of profit, for example?

Let's say I have a project worth of 20K, leading to a 3K profit.

The definition of Risk appetite says that it is the level of risk before action is deemed necessary to reduce the risk. So does it mean that any risk that exceed e.g. 1K is unacceptable (as it decreases my profit by 33% which I found unacceptable)?

• Talk to your sponsor. Decide if risk acceptance can be delegated, and ask the sponsor what would cause them to lose interest in the project. And then actively listen for changes to this threshold.
– MCW
Commented Mar 7, 2022 at 17:18

I do not know if you're looking for a formula that applies to all organizations all the time but I do not think such a thing exists. There are two assessments an organization needs to make: 1) objective--risk capacity; 2) subjective--risk tolerance. Both of these are necessary in order for an organization to take on risk before risk avoidance.

Risk capacity is a calculated number on the degree of probabilistic loss an organization, or any of its sub-components, can assume whereby a dollar more loss than that calculated value challenges the viability for the organization as an ongoing concern. That capacity will be different for every organization and can be different within an organization year over year.

Risk tolerance is subjective and speaks to the desire to assume risk. An organization with a risk-averse culture will take on far less risk despite its capacity to take on more.

EDIT: Risk acceptance does not mean no treatment. This is the biggest travesty in the way risk is taught, i.e., we either mitigate OR accept OR transfer OR avoid. Acceptance refers to putting a hazard/uncertainty into play. It does not mean you don't mitigate the risk after putting it to play and it certainly does not mean 'do nothing' unless you are at your capacity for loss.

• Thanks. No, I am really just trying to understand what is the common (usual) way of determining the risk appetite on a project (i.e. the risk I am willing to take on the project, exceeding of which requires risk treatment). Some say it can be e.g. % of the contract volume, some say it could be % of revenue... So, having a million dollar project with an expected profit of 100K, can I say that my risk appetite is e.g. 10K (=I will not treat risks below that threshold)? Commented Mar 7, 2022 at 15:00
• I do not think the decision to treat a specific risk is the same thing as taking on risk consistent with risk capacity and risk appetite. These are two different concepts. The decision to treat a risk depends on the prioritization of known risks and their calculated loss and whether the treatment of risk costs less than the loss. None of those two things affects risk capacity or tolerance. Commented Mar 7, 2022 at 15:48
• I guess it depends on the framework/definitions. Following the ISO 31000, Risk appetite is the amount and type of risk an org. is willing to accept in pursuit of its business objectives. Risk capacity is the maximum possible risk that the org. is able to support/withstand. Risk appetite is a threshold - risks exceeding it require treatment. Commented Mar 7, 2022 at 15:55
• Sorry, I am confused. All the books I have read say that you can accept/retain the risk (do nothing) or mitigate/transfer/avoid, as you said. Following some of the articles, they state that if the risk does not exceed your risk appetite (i.e. the amount of risk you are willing to accept), you can therefore just leave it, accept it. Commented Mar 7, 2022 at 17:01
• I know. That's why I wrote it is a travesty. They also teach to multiply probability with impact to find exposure. It's ridiculous. Commented Mar 7, 2022 at 17:09

Risk acceptance criterion defines the overall risk level that is considered acceptable, with respect to a defined activity period. The criteria are a reference for the evaluation of the need for risk reducing measures, and therefore need to be defined prior to initiating the risk analysis. Additionally, the risk acceptance criteria must reflect the safety objectives and the distinctive characteristics of the activity.

The risk acceptance criteria may be defined in either qualitative or quantitative terms, depending on the expression for risk. The basis for their definition includes:

Governmental legislation applicable to the safety in the activity

Recognized industry standards for the activity

Knowledge of accidental events and their effects

Experience from now and past activities