Risk Profiling Is Three Numbers, Not One

Ask someone their risk profile and you get one word: conservative, balanced, aggressive. That single word compresses three different quantities that frequently disagree, and most portfolio damage happens in the gap between them.

Risk tolerance is psychological: how much volatility you can watch without abandoning the plan. Risk capacity is financial: how much loss the balance sheet can absorb before goals fail. Required risk is mathematical: how much risk the plan needs you to take for the numbers to work at all.

The three numbers fail in characteristic ways. A retiree may tolerate risk happily while having no capacity for it: one bad sequence of returns early in drawdown and the income fails. A young saver may have enormous capacity and low tolerance, selling at every dip a forty-year horizon could have ignored. And a household that starts too late may find its required risk exceeds both, which is not an investment problem but a savings-rate problem wearing a costume.

Measuring each number separately

Tolerance is the only one of the three that is genuinely psychological, and it is measured badly by most questionnaires, which ask people to imagine a loss rather than showing them one. A better proxy is behavioural: how did this person actually react the last time their portfolio fell 15 percent. Did they rebalance, do nothing, or sell. Stated tolerance and revealed tolerance disagree constantly, and revealed tolerance wins every time markets get interesting.

Capacity is arithmetic, not opinion. It is a function of time horizon, the size of other resources, and how much of the goal is genuinely at risk if the portfolio falls and stays down. A twenty-five-year-old saving for a retirement forty years away has enormous capacity even if their tolerance is low, because forty years absorbs almost any drawdown history has produced. A retiree drawing income now has low capacity almost by definition, because there is no long runway left to recover before the withdrawals do permanent damage.

Required risk is the return needed to hit the funding target described in the goals-based framework, solved backward from the liability. If the goal needs 7.5 percent annualised and a genuinely conservative allocation only offers 4 percent, the household does not have a risk preference problem. It has a savings-rate problem, and no amount of clever allocation changes that arithmetic.

Six ways the numbers disagree

Tolerance below capacity and required risk describes an investor who could and should take more risk than they are comfortable with, the classic case for a smaller allocation held with more conviction rather than a large one abandoned in a panic. Capacity below tolerance and required risk describes false confidence, often seen in people who have not yet lived through a real drawdown. Required risk above both tolerance and capacity is the household with a savings problem no allocation can solve.

How correlated risk hides inside capacity

Questionnaire-based tolerance scoring deserves specific scepticism because of how it is usually built: a handful of hypothetical loss scenarios scored on a Likert scale, converted into a number, mapped onto a model portfolio. The method fails in a consistent direction. People systematically overstate their tolerance when a loss is abstract and understate it the moment a loss is real and visible in a statement. A more reliable signal is a documented history: did this person hold through the last genuine drawdown they lived through, or sell partway down. Past behaviour under real stress predicts future behaviour under real stress far better than a hypothetical scenario ever will.

Capacity calculations should also account for correlated risk outside the portfolio itself, principally employment income and property. A household whose income is tied to the same economic cycle as its equity holdings, common in finance, resources, and some parts of technology, effectively has lower risk capacity than the portfolio numbers alone suggest, because a downturn threatens both the asset base and the ability to keep contributing to it at the same time.

Each mismatch calls for a different fix, and a single-word risk profile cannot tell you which one you are looking at.

The adviser standards treat this separation as basic competence

The adviser standards treat this separation as basic competence, and they are right to. Any process that outputs one word where three numbers belong is not profiling risk. It is averaging away the exact tension the plan needed to surface.