Measuring an Organisation's Risk Appetite

One of the questions I need to answer in my dissertation is: What is UNDP's risk appetite?

Initial reading from Gambir Bhatta's "Don't do something, stand there! Revisiting the Issue of Risks in Innovation in the Public Sector":

Each organization’s appetite or tolerance for risks is unique and will vary according to any one (or combination) of several variables but may be conceived of as in: the extent of its legal mandate including any fuzzy boundaries around it; the intractability of the problem it is dealing with; the strategy(ies) it pursues to meet the mandate; its degree of access to relevant information; its organizational culture; the management style of its leaders although it could be argued that over time, this will tend to settle at a level that is determined by the organizational culture rather than the leaders’ styles); the responsible minister’s own risk appetite; and the organization’s age.

Notationally, this could be framed as:

Departmental Risk Appetite

{RAd = f(M1, M2, S, Ia, OC, MS, MRAt-1, OA, e}

where M1 is organizational mandate, M2 is degree of problem intractability, S is strategy, Ia is degree of access to relevant information, OC is organizational culture, MS is manager’s style, MRAt-1 is minister’s risk appetite (which itself is also a function of the collective risk appetite of government, and of the perception of severity of risk but lagged because it generally takes time to diffuse to departmental level), OA is age of organization, and e is the error term.

Link: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.174.4005&rep=rep1&type=pdf.