How do you calculate acceptable risk on your project?

Question

I am trying to find some information on the following: how do I determine the acceptable risk (risk appetite) for my project, what is the usual practice/approach? Is it percentage of profit, for example?

Let's say I have a project worth of 20K, leading to a 3K profit.

The definition of Risk appetite says that it is the level of risk before action is deemed necessary to reduce the risk. So does it mean that any risk that exceed e.g. 1K is unacceptable (as it decreases my profit by 33% which I found unacceptable)?

Answer 1

I do not know if you're looking for a formula that applies to all organizations all the time but I do not think such a thing exists. There are two assessments an organization needs to make: 1) objective--risk capacity; 2) subjective--risk tolerance. Both of these are necessary in order for an organization to take on risk before risk avoidance.

Risk capacity is a calculated number on the degree of probabilistic loss an organization, or any of its sub-components, can assume whereby a dollar more loss than that calculated value challenges the viability for the organization as an ongoing concern. That capacity will be different for every organization and can be different within an organization year over year.

Risk tolerance is subjective and speaks to the desire to assume risk. An organization with a risk-averse culture will take on far less risk despite its capacity to take on more.

EDIT: Risk acceptance does not mean no treatment. This is the biggest travesty in the way risk is taught, i.e., we either mitigate OR accept OR transfer OR avoid. Acceptance refers to putting a hazard/uncertainty into play. It does not mean you don't mitigate the risk after putting it to play and it certainly does not mean 'do nothing' unless you are at your capacity for loss.

Answer 2

Risk acceptance criterion defines the overall risk level that is considered acceptable, with respect to a defined activity period. The criteria are a reference for the evaluation of the need for risk reducing measures, and therefore need to be defined prior to initiating the risk analysis. Additionally, the risk acceptance criteria must reflect the safety objectives and the distinctive characteristics of the activity.

The risk acceptance criteria may be defined in either qualitative or quantitative terms, depending on the expression for risk. The basis for their definition includes:

Governmental legislation applicable to the safety in the activity

Recognized industry standards for the activity

Knowledge of accidental events and their effects

Experience from now and past activities