I was listening to Times Radio yesterday when the conversation turned to the pay now on offer to tanker crews prepared to take ships through the Strait of Hormuz. The Financial Times has reported captains earning around $100,000 a month, against a normal rate of about $15,000, plus a $50,000 bonus for each passage, with ordinary crew earning at least four to six times their usual wages. Back in July, Sinokor, the largest owner of supertankers in the world, offered its seafarers an extra six months’ salary for a single round trip lasting about a month.
Those figures are eye-catching, but they are paid for a reason. The International Maritime Organization says at least 93 ships have been hit and 24 seafarers killed since the war began at the end of February, and on Wednesday night a tanker off the northern coast of Qatar was hit by multiple projectiles with casualties reported. Nothing in this post is meant to make light of that. But the way the shipping industry is handling Hormuz says a great deal about a subject I think most organisations struggle with, which is risk appetite.
A price on a one-in-twenty chance
Bloomberg reports that shipping executives currently estimate a one-in-twenty chance of a vessel being hit while crossing the strait. I’ve sat in a lot of risk workshops over the years, and I can’t think of many where a board was given a likelihood estimate that clear, let alone asked to put a price against it. In Hormuz, both have happened. The likelihood has been estimated, the consequences are all too obvious, and the market has settled on what it costs to persuade someone to accept them.
What makes it more interesting is that the measured figure is rather lower. Maritime analytics firm Windward puts the share of ships hit while transiting Hormuz in the third quarter at around 2%, closer to one in fifty than one in twenty. There are good reasons for some of that gap. Many of the smaller shuttle boats are running with transponders off and may not appear in anyone’s count, attacks have been rising since September, and executives are judging next week rather than last quarter. Even so, the pay, the freight rates and war-risk premiums of 6% to 10% of a ship’s hull value all appear to be set by the perceived risk rather than the recorded one.
That is no criticism of the people making those calls. When the consequence is a dead crew or a lost ship, adding a margin for uncertainty is entirely sensible. But it is a useful reminder that appetite decisions are always made against risk as people see it, and the two can drift a long way apart. Organisations do exactly the same thing, overpaying to guard against the risk that is in the headlines and under-investing in the dull one that happens every year.
The crews are treating the risk as well as accepting it. Transponders and lights are switched off, ships navigate by the coastline and lighthouses, and decks are barricaded with sandbags in case of drone or missile attack. The bonus is the price of carrying whatever risk is left once all of that has been done. That is risk appetite in its rawest form: a decision, made in advance, about how much of a known risk you are prepared to hold in pursuit of something you want.
Same strait, very different answers
What I find most instructive is that everyone involved is looking at the same hazard and coming to different conclusions. Shipowners are pursuing the risk because the returns are huge; the Wall Street Journal reports that a single round trip of ship-to-ship transfers is costing $30m to $40m, with owners and sailors making some of the best money the industry has seen in decades. Insurers are pricing it. The captain, who has the final say on navigation, is making his own judgement, and one master who spoke to Bloomberg deliberately took a shorter contract than usual because he knew the run was hard.
Further down the ship, a junior rating earning around $1,500 a month can ask to leave the vessel rather than sail into a danger zone, and plenty have done exactly that. The choice isn’t always as free as it sounds, though. The Forward Seamen’s Union of India says some owners lean on crews to sail rather than paying them more, and deduct repatriation costs from the wages of those who refuse. Some people will still not go at any price. That group matters, because it shows that tolerance has a hard edge which money cannot shift. Appetite is the risk you are willing to pursue or hold; tolerance is the limit beyond which you won’t go, whatever the reward. Most appetite statements I read blur the two together, and that is a large part of why they so rarely help anyone make a decision.
What ISO 22301 used to ask for
Risk appetite had a proper place in the first edition of ISO 22301. The 2012 standard defined it as the amount and type of risk that an organisation is willing to pursue or retain, and then put it to work. Clause 4.1 required organisations to identify and document their risk appetite and to set risk criteria taking it into account. Clause 8.2.3 required risk treatments to be identified in accordance with it, and clause 8.3.3 made the same point again when it came to choosing protection and mitigation measures.
When the standard was revised in 2019, the term went. I have some sympathy with the reasons. Too often what organisations produced was a single line in the BC policy declaring a low appetite for disruption, which gave an auditor nothing to test and the people writing the plans nothing to work with. Taking the words out of the standard didn’t remove the need, though. Every BIA still involves deciding what level of service is acceptable during a disruption, and every strategy decision is a choice about how much risk to carry and how much to spend reducing it. The concept is still there in all of that work. The standard simply stopped naming it.
Why so many appetite statements don’t help
Phrases like “low appetite for reputational risk” or “zero tolerance for data loss” read well in a board pack and fall apart the moment someone has to act on them. They are usually written by people who won’t bear the consequences, rarely tried against a real choice, and almost never expressed in terms anyone could measure. Compare that with Hormuz, where appetite shows up in the contracts people sign, the routes they choose and the point at which they say no.
A useful statement does a few fairly simple things. It is tied to the decisions it is meant to guide, such as how long you could run at a reduced level of service or how much you would spend to avoid a particular disruption. It is expressed in terms of impact the organisation recognises, which in business continuity usually means your MBCO and how long you can tolerate falling below it. It says where the hard line is, the point at which you stop regardless of cost. And it gets tested, by putting a realistic choice in front of the people who would have to make it during an exercise and seeing whether the statement actually helps them.
Your appetite may be borrowed
For most UK organisations, the more pressing lesson is a different one. Very few of us have direct exposure to the Gulf, but a great many of us depend on fuel, energy, plastics, freight and components whose price or availability is tied to it. Whether that oil moves this week depends, in part, on seafarers from India, the Philippines and China deciding that a bonus is worth a one-in-twenty risk. Your business continuity arrangements may rest on someone else’s appetite, and you have no say in it.
ISO 22301 asks organisations to identify dependencies in the BIA, including suppliers and outsource partners. What it doesn’t ask is how much risk those suppliers are prepared to carry on your behalf, or what happens when they stop. The oil producers have shown what that looks like in practice. According to Kpler data, around 40 per cent of the region’s oil exports are now leaving either through Saudi Arabia’s East-West pipeline to the Red Sea or on small shuttle boats running dark to tankers waiting beyond the strait. Those are continuity strategies, put in place because producers could no longer count on the appetite of the people who normally carry the risk for them.
So the questions worth asking at your next review are fairly simple. Which of your critical dependencies rely on someone else accepting a risk you couldn’t, or wouldn’t, accept yourself? What would you do if they changed their mind tomorrow? And does your own appetite statement say anything that would help you decide?
Learning from the clarity of it
The seafarers taking ships through Hormuz are making about the most personal risk decision there is, in full knowledge of what can happen, and I hope every one of them gets home safely. Most organisations will never face anything so stark, but there is a lot to learn from how clearly the choice is being made. If you’d like help turning your risk appetite into something your teams can actually use, or testing it in an exercise, do get in touch.
