How much risk can the business carry? Appetite, tolerance and capacity in practical terms

Owners often talk about being willing to take more risk to grow, try a new product or win a bigger customer. That willingness matters. A business that will not accept any risk will not grow, and may slowly decline as competitors move. But willingness does not change how much cash the business has, how long it could survive without its biggest customer, or how much damage its reputation could absorb. A business can be willing to take a risk and still be unable to survive the downside.

Larger organisations often write a “risk appetite statement” to deal with this. Many such statements say something like “we have a moderate appetite for risk”, are approved once and then never influence a decision. The same thing happens informally in small businesses: the owner has a sense of what feels too risky, but the sense is never written down, so it shifts with mood, pressure and the size of the opportunity in front of them.

This article separates four ideas that are often blurred together, appetite, capacity, tolerance and profile, and shows how a small business can turn them into a few practical limits that actually change decisions. It also explains why a promise of “zero” tolerance for some kind of failure is really a spending decision. It is general information; your accountant can help you work out your financial capacity, and specific legal duties, such as work health and safety, apply whatever your appetite.

Four ideas worth keeping apart

Capacity comes from the business’s real position: cash, borrowing room, the strength of key relationships, licences, insurance and the owner’s personal finances where they are tied up in the business. Approving a bolder appetite does not change it. Appetite is the choice about how much of that capacity to put at risk, and in which areas. Tolerances turn appetite into limits that people can actually use, such as “no customer above 40% of revenue”. The profile is what you are carrying now, which may be inside or outside your appetite.

Keeping them separate matters because two uncomfortable situations are easy to miss:

• Operating above appetite but inside capacity. The business is carrying more risk than the owner wants, but could survive if things went wrong. This is survivable for a while but should be a deliberate, temporary choice.
• An appetite close to capacity. The owner is willing to take risks that, if they went badly, would use up almost everything the business has. This needs stronger controls and earlier warnings, because there is little room to absorb a mistake.

Lower appetite is not more mature

It is tempting to think a cautious business is a well-run one. It is not necessarily so. A business facing a shrinking market may need to accept significant risk in new products, because standing still is also risky. The risk is also the opportunity you miss article covers this.

Good practice is not minimising risk. It is accepting the right risks deliberately, and differently in different areas. A single word such as “moderate” cannot do that. A more useful statement distinguishes, for example:

• high appetite for small, bounded product experiments;
• moderate appetite for entering nearby markets or customer types;
• low appetite for dependence on any single customer or supplier above a set level;
• very low appetite for safety, legal or ethical failures;
• controlled appetite for new technology, provided there is a workable fallback.

A good test: if two sensible people could read your statement and reach opposite conclusions about a major decision, it is too vague.

Capacity comes first

Before deciding how bold to be, work out what the business could actually absorb. Useful questions:

• Cash and borrowing: How many months of fixed costs could you cover with cash and unused facilities if revenue stopped or fell sharply?
• Concentration: What happens if your largest customer, supplier or key person disappeared next month?
• Unpaid work: What is the most money any one customer could owe you at once, including work done but not yet invoiced?
• Obligations: Which contracts, licences or loan conditions would be breached by a particular loss?
• Personal exposure: Have you given personal guarantees, or is your home tied to business borrowing?

Capacity changes over time. A profitable year, a new customer or a paid-down loan increases it; a large purchase, a lost contract or a new lease reduces it. Review it at least once a year and after any major change. The what a risk score cannot tell you article covers setting a survival line and keeping the risks that could cross it on their own list.

Tolerances turn appetite into decisions

A tolerance is a limit that tells people when to act or escalate. Good tolerances are measurable and tied to things that actually happen in the business:

• maximum share of revenue from one customer;
• maximum amount owed by any one customer at once;
• maximum value of work that can start before a contract is signed;
• maximum discount a salesperson can give without approval;
• maximum spend on an experiment before a review;
• minimum cash buffer, in weeks of fixed costs.

Tolerances that are too tight create constant false alarms and get ignored. Tolerances that are too wide let damage happen before anyone acts. And every tolerance should sit inside capacity. A limit that permits a loss the business could not survive is not a tolerance; it is a gap.

Look at the combined picture

Risks are usually approved one at a time, but they add up. Each new contract, supplier arrangement or product may be acceptable on its own, while together they push the business beyond its appetite or even its capacity. Several jobs may depend on the same customer, the same specialist or the same supplier. A downturn in one industry may hit several customers at once.

So test new commitments against the combined position, not just on their own merits. The question is not only “is this job acceptable?” but “does accepting it keep us inside our limits?”

Watch what is rewarded

People learn what the business really tolerates from what it rewards, not from what it writes. If a business says it values careful credit control but pays sales commission on every sale regardless of whether the customer pays, its real appetite for bad debts is higher than stated. Signs of the real appetite include:

• who gets praised: the person who won the risky deal or the person who walked away from it;
• how bad news is received;
• whether limits are relaxed whenever sales are under pressure;
• whether anyone can stop work without being penalised for it.

A “zero” promise is a spending decision

Some commitments are absolute: “no missed deliveries”, “zero harm”, “we never let a client down”. They sound like statements of values and are usually adopted without discussion, because nobody wants to argue for a tolerable rate of failure. But an absolute commitment changes the economics of risk immediately.

Risk responses fall into four broad families: avoid the risk by changing the plan, reduce its likelihood or impact, transfer the financial consequence, or accept it. An absolute promise removes acceptance completely, because accepting means agreeing in advance that some failures are tolerable. It also largely removes transfer, because insurance can pay money but cannot make the failure not have happened. That leaves avoidance and reduction, which are usually the most expensive families:

• Avoidance costs capital or scope: a different design, a different site, or saying no to some work.
• Reduction costs money every year: extra staff, backups, inspections, training, redundancy.
• Declined work rarely shows up anywhere: jobs turned down because they could not be done to the absolute standard are a real cost that no account records.

None of this means absolute commitments are wrong. Some are right. But they should be priced and approved as a spending decision, with the capital cost, the annual cost and an estimate of declined work in front of whoever makes the promise. Otherwise the commitment quietly drifts into a percentage target nobody chose, or into costs nobody can trace.

On safety specifically, Australian work health and safety laws generally require risks to be eliminated or, where that is not reasonably practicable, minimised so far as is reasonably practicable. A “zero harm” slogan does not change those legal duties. Your state or territory safety regulator and an adviser can explain what applies to you.

A worked example

This is an illustration. A steel fabrication business has annual revenue of about $2.4 million. Its largest customer, a builder, accounts for about 30%, or $720,000 a year. The builder offers three new contracts worth about $900,000 together over the next year. Each job looks profitable on its own.

The owner has set three simple limits: no customer above 40% of revenue; the most any single customer can owe at once must stay comfortably below the business’s cash and unused overdraft; and a minimum cash buffer of six weeks of fixed costs. The business has about $180,000 in cash and a $100,000 overdraft, so its practical capacity for a single customer default is roughly $280,000.

Testing the options:

Accepting all three would put almost half the business’s revenue with one customer, and a builder failure at the wrong moment could take nearly all of its cash and overdraft. That is close to capacity, well beyond the owner’s appetite. Accepting two still breaches the concentration limit.

The owner accepts one contract outright, asks to move to fortnightly progress claims, which would reduce the peak amount owed, and tells the builder the business would be glad to take on the other two once its other customers have grown. The owner also starts actively pursuing two other builders, so that the concentration limit allows more work from the first builder later.

The same business also promises clients “no missed site deliveries”. Pricing that promise, the owner finds it implies keeping a driver and truck on standby during peak periods and turning down some remote-site jobs where deliveries cannot be guaranteed. The owner decides the promise is worth keeping for existing major clients, prices the standby cost into those contracts, and rewords the general promise to a committed delivery window with notice if something changes.

How this applies to a small Australian business

• Work out your capacity first: cash, borrowing room, concentration, personal guarantees.
• Write a short appetite statement that distinguishes kinds of risk, not one word for everything.
• Turn it into three to six tolerances that people can check.
• Test each new commitment against the combined position.
• Check what your incentives reward.
• Price any absolute promise before making it.
• Review capacity and tolerances once a year and after any major change.
• Talk to your accountant about financial capacity, and to an adviser about legal duties that apply regardless of appetite.

Signals worth watching

• One customer, supplier or person carrying a growing share of the business.
• Limits relaxed whenever sales are slow.
• Opportunities assessed one at a time, never in combination.
• Absolute promises in marketing that nobody has costed.
• No one able to say how many weeks the business could survive without revenue.
• Rewards that contradict the stated appetite.

Common mistakes

• Treating willingness as ability.
• Using one word, such as “moderate”, for every kind of risk.
• Setting tolerances outside capacity.
• Assessing commitments only one at a time.
• Making absolute promises without pricing them.
• Believing a cautious business is automatically a well-run one.

Frequently asked questions

Does a small business really need a risk appetite statement? Not a formal document. But a few written limits, such as a maximum share for any one customer and a minimum cash buffer, are very useful, especially once other people make commitments on the business’s behalf.

How do we know our capacity? Start with cash, unused facilities and fixed costs, then ask what would happen if your largest customer or supplier disappeared. Your accountant can help model it.

What if we are already outside our limits? Decide whether to accept that temporarily, and set a plan and date for getting back inside, such as diversifying customers or reducing a dependency.

Should every limit be a hard rule? No. Some should require escalation rather than an automatic no. What matters is that exceeding them is a conscious decision by someone with authority.

Are zero-tolerance commitments ever right? Yes, for some matters. The point is to make them knowingly, with their cost visible and funded.

Questions to ask

• How much loss could the business absorb without threatening its survival?
• What kinds of risk are we willing to take, and which are we not?
• Which three to six limits would make our appetite usable?
• Does our latest opportunity keep us inside those limits when combined with everything else?
• What do our incentives reveal about our real appetite?
• What would our absolute promises cost if we priced them?

Bringing it together

Willingness to take risk and capacity to survive it are different things. Work out capacity from the business’s real position, choose an appetite that distinguishes between kinds of risk, and turn it into a handful of measurable tolerances that sit inside capacity. Test new commitments against the combined position, not one at a time, and check that what you reward matches what you say. Treat any absolute promise as a spending decision with a price. The aim is not to be cautious or bold, but to take the right risks on purpose, with enough room left to absorb the ones that go wrong.

---

Source: KEVOS notes, drawing on teaching material on portfolio risk management and risk response strategies, and on L. Rittenberg and F. Martens, Understanding and Communicating Risk Appetite, Committee of Sponsoring Organizations of the Treadway Commission (2012). Examples and figures in this article are illustrations. This article is general information, not financial, legal or safety advice.