A risk appetite statement should help a board say yes or no. Too often it does neither: it is broad enough to approve and too vague to use. The result is a document that is reviewed annually and ignored in between.
Five design choices that make the difference
- Start from strategy. Express appetite in terms of the objectives the organisation is pursuing, not as a list of risks to avoid.
- Combine words and numbers. Qualitative statements set intent; metrics with clear thresholds make breaches visible.
- Cascade it. Translate group appetite into limits that business units and functions can apply to their own decisions.
- Monitor with key risk indicators. Link each metric to indicators that move before the limit is reached.
- Define what happens on breach. Who is told, how quickly, and what decision is expected.
A test for your statement
Take a recent strategic decision — an acquisition, a new market, a major outsourcing — and ask whether the risk appetite statement changed the conversation. If it would not have, it needs work.
