One of the most important concepts within risk management is risk tolerance. Without clearly defining risk tolerance it is virtually impossible to implement good risk management, since we do not know what to measure risk against.
Defining risk tolerance means to define how much risk the business can live with. Risk tolerance is vitally important in choice of strategy and in implementation of the chosen strategy. It may well be that the business is unable to take strategic opportunities because it does not have the ability to carry the risk inherit in the wanted strategy.
The risk carrying ability must therefore be mapped and preferably quantified in the beginning of the strategy process, and throughout the process possible strategic choices must be measured against the risk carrying ability of the business. For example, if the financing ability puts a stop to further expansion, it limits the strategic choices the business may make.
Risk tolerance must be measured against the key figures for which the business is the most vulnerable. To assess risk tolerance as a more or less random number (say, for instance, 1 million) makes it close to impossible to understand risk tolerance in an appropriate way. Hence, the business needs to have a good understanding of what drives its value creation, and also what sets limits on strategic choices. If the most vulnerable key figure for a business is its equity ratio, then risk tolerance needs to be measured against this ratio.
The fact that risk tolerance needs to be measured against something means that it is a great advantage for a business to have models that can estimate risk in a quantitative manner, showing clearly what variables and relationships that have the biggest impact on the key figures most at risk.
