Risk Management Strategy: Set Appetite and Escalation Rules

Separate appetite, capacity and limits

Risk appetite describes the types and amount of risk an organisation is willing to take in pursuing its objectives. Risk capacity concerns what it can withstand. A business may be willing to try an uncertain service, yet lack the cash or specialist capability to absorb a major failure. Willingness does not create capacity.

Operational limits translate that direction into decisions people can make. They might specify an approved exposure, a condition requiring review or a prohibited practice. Define the terms locally and explain their relationship. A label such as “moderate appetite” tells a buyer very little without examples and authority boundaries.

Start with the decision, not a colour

Identify the objective, timeframe and people affected. For a supplier decision, ask which delivery promises depend on that supplier, what alternatives exist and what disruption the organisation could absorb. Include quality, safety, legal obligations and customer effects alongside cost.

The Orange Book provides useful public-sector risk principles. It is referenced here for concepts, not as UAE legislation or a mandatory private-sector template. The workflow below is the editorial team’s practical application. Sector requirements and contractual obligations need their own review.

Write an actionable escalation rule

1. Decision owner: name the role that can approve the ordinary purchase.
2. Boundary: describe the condition that changes that authority.
3. Evidence: state what information supports the assessment.
4. Escalation: identify the receiving role and the required response time.
5. Interim action: explain what can continue safely while a decision is pending.

Keep urgent incident response separate. An immediate safety concern may require stopping work and using an emergency procedure, rather than waiting for the next risk committee. “Escalate” must never mean continuing an unsafe or prohibited activity until someone answers an email.

Worked example: a delayed critical supplier

Consider a fictional service business that promises installation within 10 working days of accepting an order. A critical component normally arrives after 4 working days; checking and installation then require 3 further working days and cannot overlap with delivery. Component arrival forecasts and the customer deadline are measured from order acceptance, using the same working-day calendar. The original plan takes 4 + 3 = 7 working days, leaving a 3-day buffer. The supplier now forecasts delivery after 8 working days: 8 + 3 = 11, which is 1 working day beyond the promise. These are illustrative planning assumptions, not industry benchmarks or results from an ATMACSS project.

In this example, a forecast delivery later than working day 7 triggers escalation because the remaining 3 days are needed for checking and installation. The procurement owner alerts the authorised operations manager as soon as that forecast becomes known, rather than waiting for day 7 or for the promise to be missed. The local rule should set a response deadline early enough to keep viable alternatives open.

The procurement owner first checks actual stock, confirmed delivery dates and substitute specifications. The operations owner assesses the remaining installation capacity. If the promised date cannot be met without an unapproved substitution, the decision moves to the authorised manager before a new customer commitment is made. A similar appearance or a short product description is not enough to establish that a substitute is suitable.

The manager can approve a tested alternative, negotiate a revised customer date or decline a new order. An existing customer commitment requires an agreed, authorised change. The record states the chosen option, remaining exposure, customer communication and review date. Paying more for express shipping is not automatically a solution: the team must verify that it changes the critical delivery dependency.

Match the response to the exposure

Avoid

Stop or change the activity creating an unacceptable exposure.

Reduce

Change likelihood or consequences through a control that can be checked.

Share

Use contractual or insurance arrangements where appropriate, while examining exclusions and retained responsibilities.

Accept

Approve a defined remaining exposure, with an owner and a review trigger.

Accepting residual risk does not authorise a breach of applicable requirements or customer commitments. Record any permitted exception, its approver, expiry date and review conditions; an exception must remain within the approver’s authority.

Outsourcing a task does not automatically transfer accountability, customer commitments or every consequence. Similarly, an insurance policy does not prevent an incident. Check the real mechanism of each response before reducing the recorded assessment. Do not treat a planned action as an implemented control with proven effectiveness.

Test the rule when the decision owner is absent

Before approving the escalation route, run a short exercise using the supplier example. Assume the operations manager is unavailable and the supplier needs a reply by the end of the day. Ask the buyer to identify the authorised deputy, the evidence to send and what can proceed while waiting. This is an editorial team exercise, not a universal requirement imposed by the reference.

The delegation should state whether the deputy can approve a different purchase or only forward the request. If the response deadline passes, use the next approved escalation level. Silence is not approval. Naming a deputy does not establish their authority. Also check that they can access the necessary documents without sharing information beyond their permitted role.

Record the scenario, expected decision, actual response, gap and person responsible for correcting it. If participants interpret the boundary differently, rewrite it with a clear example and test again. Examine related orders together: individually acceptable purchases can create a substantial combined dependency on one supplier. Splitting a decision must not bypass its required approval level.

Review whether the boundaries still work

Review the strategy when the operating context changes: a new service, a major dependency, an incident or a material change in capacity. Scheduled reviews are useful, but important information should not wait for the calendar. Record who approved a revised boundary and when it takes effect, and inform the people whose decisions it changes.

Look at late escalations, repeated exceptions and decisions made without adequate evidence. A low number of reported risks can indicate silence rather than safety. Ask staff whether the rules are understood and whether they can raise an uncomfortable issue without being discouraged.

For your next step, choose one recurring decision and write its authority, boundary and escalation route on one page. Test it against a realistic scenario with the people who use it. Connect the result to your risk register and to the broader ISO 31000 approach. ATMACSS risk management support can help structure the responsibilities and review process.