Risk appetite: a decision no provider can make for you

Key takeaways

Risk appetite is how much risk a business is willing to take to reach its goals, set out in a few plain statements. In a small business, only the owners can set it, because it reflects their personal stake. Providers then work within it: an outsourced team knows which customers to accept, which payments to query and when to escalate.

• Write 5 to 8 risk appetite statements in plain English.
• Cover cash, customers, compliance, people, data and growth.
• Owners set it; providers and staff work within it.
• Turn each statement into a limit someone can follow.

Why can't a provider set your risk appetite?

Because a provider's appetite reflects its own risks, not yours. A provider may be cautious to protect its contract, or bold because it does not carry the loss. Owners know what they can afford to lose, what would keep them awake and what the business is for. Those judgements set the limits everyone else follows.

• Which business processes should you never outsource?
• Processes only the owner should run

What does a risk appetite statement look like?

Short, specific statements that someone can act on.

• Cash: we keep at least three months of fixed costs in reserve.
• Customers: no single customer above 20% of revenue.
• Compliance: zero tolerance for known breaches of law.
• Credit: new customers start on limits we set, not the sales team.
• Data: personal data never leaves approved systems.

• Customer credit limits: outsource the checks, keep the call
• An outsourcing risk register for each process

How does risk appetite guide outsourced teams?

It becomes their rules. Credit control knows when to stop supplying, customer service knows when to escalate, finance knows which payments to query. Without it, each team guesses, and different teams guess differently. Write the limits into the work instructions and the escalation path.

• Outsourcing red lines: write them down before you sign
• Escalation paths for outsourced teams: fast, not chaotic

How often should risk appetite be reviewed?

Once a year, and after any big change: new investment, a major client win or loss, a new regulation or a near miss. Appetite changes as the business grows, and limits that suited a start-up may be too tight or too loose later.

• Review what you keep in-house once a year

What does this look like in practice?

A pattern we see: an outsourced credit team extends terms to a large new customer because nobody said not to. A written statement on maximum exposure per customer turns that into a routine escalation instead of a surprise.

• See client work
• BPO Solutions for UK businesses

Risk appetite checklist

• Write 5 to 8 plain statements.
• Cover cash, customers, compliance, people, data and growth.
• Turn each into a limit.
• Put the limits into work instructions.
• Review yearly and after big changes.

• Board packs: outsource the preparation, keep the story
• Strategic partnerships: who should negotiate them?

Next step

Ask yourself: what is the most the business could lose this year without being in danger? The answer is the start of your risk appetite.