Risk Appetite

Almost every risk appetite statement in circulation is unusable, and for the same reason: it describes a mood rather than a limit. “We have a low appetite for reputational risk” cannot be breached, so it never constrains a decision, so nobody consults it.

What is here is aimed at producing statements that bite. Definitions first, because appetite, tolerance and capacity are routinely used interchangeably and the distinction matters the moment you have to report a breach to a board. Then worked examples across sectors, ten real world templates, guidance on drafting a board ready statement, and a risk management policy template to house it in.

Appetite is only real if something measures it, so read this alongside key risk indicators, then see enterprise risk management for how appetite connects to the register and governance, risk and compliance for board reporting.

Receive the latest articles in your inbox