How much risk is too much risk? Understanding risk appetite