We've talked in the previous sessions about assessing risk. Now, this session addresses the question of, what do we do with all this risk? I'll introduce the concept of risk tolerance and then a framework of risk management techniques that allow organizations to stay within their risk tolerance. Note that everything starts with an organization's culture and risk appetite. Risk appetite, remember, is the type and amount of risks that an organization is willing to accept in pursuit of its goals. This helps determine the risks that are identified, how those risks are assessed, and then ultimately prioritized. After that, the organization selects risk indicators. Important performance objectives that tell us if a risk is likely to impact the organization. How does an organization know how to respond? They establish a risk tolerance. Risk tolerance is like risk appetite, both relate to key organizational objectives except that risk tolerance is applied to a specific performance objective. It's the acceptable variance around a specific objective and is best measured in the same units as those used to measure the objective. While risk appetite is an objective, risk tolerance is the allowable deviation from that objective. Risk appetite will be expressed in qualitative terms, usually high, medium, low. Risk tolerance is usually quantified. Let's go through an example. Say a hospital has two key objectives, patient's safety and responding to all patient needs. First, risk appetite. A hospital is almost certain to have a low risk appetite related to patient safety, but probably a higher appetite for serving all patient needs. Next, risk tolerance. We have to set a tolerance that is aligned with these appetite for risk and can be represented by an indicator of the risk. Say the indicator for patient safety is the wait time for emergency room patients, say 60 minutes. We have a low risk appetite for patient safety, so the hospital isn't going to allow much deviation from this 60 minute target. A risk tolerance aligned with risk appetite might be treating all emergency room patients within 60 minutes. That is, zero percent of ER patients should wait for more than 60 minutes. On the objective of responding to all patient needs, we can acknowledge that not every patient is in a life-threatening situation. If the hospital has zero tolerance for critically ill patients waiting more than an hour, the higher risk appetite for serving all patients means that the hospital can accept longer wait times for patients who aren't in life-threatening situations. A tolerance aligned with this appetite could be treating all patients with non-threatening conditions within two hours. In reality, organizations don't usually work with absolutes like 100 percent except for high priority objectives like patient safety. It's hard to get 100 percent. A tolerance for serving all patients might more likely be 95 percent of patients and let non-life threatening situations being served within two hours. Yes, this does allow long waits of more than two hours, but only in rare situations, measured here as five percent of the time. In summary, risk appetite drives risk assessment, and then an organization chooses a response that allows it to operate within its risk tolerance. What are the risk responses? Most risk management frameworks classify all responses into four categories, accept, share, reduce, and avoid. Lots of things can influence the choice of response including regulations, stakeholder expectations, and the severity of the risk. Accept means to maintain the risk at its current level. It can also be referred to as risk retention or self-insuring. It doesn't exactly mean doing nothing because we'd monitor these types of risks. An acceptance strategy would usually apply to two sets of risks. Those that are assessed as low impact with low frequency and low magnitude, and those that are so catastrophic that any other risk response would be too costly. Sharing the risk means transferring it to another entity, one that is financially capable of withstanding the risk. The best example of risk-sharing is insurance. The essence of insurance is that you take a certain loss in the form of an insurance premium in exchange for protection from a larger, uncertain loss in the future. You may have heard the term reinsurance, which is insurance for insurance companies. That's the term for when an uncertain loss is larger than the insurance company can bear, so they transfer the risk or part of the risk to another party. Another common way to share a risk is to outsource certain business processes to another company. In the hospital example and in most other industries, outsourcing usually occurs for support activities. That is, activities that aren't central to the organization's primary products or services. That means outsourcing would most often occur for accounting and finance and other back-office types of services or things like laundry, custodial services, or dining. In risk management, most responses will fall under the umbrella of reducing the risk. Which means to implement controls to reduce the risk to an acceptable level. This is the realm of controls of policies and procedures. Policies are written guidelines for executing processes and procedures are the actual performance of those policies. In the hospital example, say a risk event that threatens the patient's safety and treating all patients objective's is a patient entering the emergency room but not being logged into the system. Hospitals can do a lot to reduce this risk. Posting signs directing patients to check in and probably having those signs in multiple languages to reflect the needs of the community the hospital serves. Electronic check-in systems are costly tools that also help reduce this risk as what a control on which ER personnel periodically check in with people who were waiting to make sure no one falls through the cracks. Risk reduction usually is the approach for risks that occupy the middle ground between very low impact risks and very high impact risks. Finally, the fourth category of risk responses is avoidance. This mean that the organization is effectively eliminating the risk by preventing any exposure to future risk events. Oftentimes, this category of responses is reserved for the most severe risks with potentially catastrophic consequences. Examples include divesting business operations that may be engaging in illegal activities or activities that would otherwise cause extreme reputational damage. One example from the hospital example is providing home health care, which could open the hospital to very high levels of liability. In conclusion, organizations should select risk indicators that relate to key business objectives. Then they set a risk tolerance that is the amount of deviation around that objective that an organization can allow. Finally, the organization selects risk responses that allow it to operate within their tolerance.