How to Write a Risk Appetite Statement People Will Actually Use

A risk appetite statement describes how much risk an organisation is willing to accept in pursuit of its goals. In theory, it is one of the most useful documents a board can produce: a clear signal to everyone about where to be bold and where to be careful.

In practice, many risk appetite statements are written in language so general that they cannot guide any real decision. "The organisation has a low appetite for risks that could damage its reputation" is true of almost every organisation, and tells a manager nothing about whether to approve a particular supplier, launch a new product or delay a system upgrade.

This guide sets out how to write a statement that people will actually use.

What a risk appetite statement is for

A good statement does three jobs:

1. It guides decisions. Managers can use it to judge whether a risk they are considering is within acceptable bounds.
2. It triggers escalation. It makes clear when a risk is large enough that it needs to go to someone more senior.
3. It allows oversight. The board and executives can see whether the organisation's actual risk profile matches what they intended.

If your statement does none of these, it is a policy document, not a management tool.

Appetite, tolerance and capacity

Three related terms are often confused:

• Risk capacity is the maximum risk the organisation could absorb before it failed or could no longer meet its obligations. It is a hard limit, set by finances, regulation and resilience.
• Risk appetite is the amount and type of risk the organisation is willing to take to achieve its objectives. It sits well inside capacity.
• Risk tolerance is the acceptable variation around appetite for a specific measure, often expressed as thresholds. It turns broad appetite into something measurable.

A useful statement covers appetite in words and tolerance in numbers or clear criteria.

A simple structure that works

1. Start with your objectives

Risk appetite only makes sense in relation to what you are trying to achieve. Begin with a short paragraph linking appetite to strategy: where the organisation wants to grow, innovate or change, and what it must protect.

2. Choose a handful of risk categories

Pick six to ten categories that reflect the risks your organisation actually faces. Common examples include:

• Strategic and growth
• Financial
• Operational and service delivery
• People and health and safety
• Technology and information security
• Legal, regulatory and compliance
• Reputation and stakeholder trust

Avoid copying a generic list. A charity, a software company and a manufacturer will need different categories.

3. Set an appetite level for each

Use a short, consistent scale. Three to five levels is plenty, for example:

• Averse: avoid this risk wherever possible, even at significant cost.
• Cautious: accept only low levels of this risk, with strong controls.
• Open: willing to accept this risk where it supports our objectives and is well managed.
• Seeking: actively pursue this kind of risk for the potential rewards.

Different categories should have different levels. If everything is "cautious", the statement is not making any real choices.

4. Explain each level in plain language

For each category, write two or three sentences explaining what the appetite means in practice. This is where most statements fall short. Compare:

Vague: We have a low appetite for technology risk.

Useful: We are cautious about technology risk to our core customer systems: we will not accept planned changes that could cause more than a short outage during business hours, and we prioritise security patches over new features. We are open to technology risk in internal tools, where we will try new products and accept occasional disruption to learn faster.

The second version tells a manager something they can act on, and shows that appetite can differ within a single category.

5. Add tolerances people can measure

For the most important categories, add a few measurable thresholds that show when risk is moving outside appetite. For example:

• Customer-facing system availability below an agreed level in any month.
• More than a set number of open high-severity security vulnerabilities older than 30 days.
• Any single supplier accounting for more than an agreed share of critical services.

These thresholds often double as key risk indicators, and they give the board a practical way to check whether the organisation is staying within appetite.

6. State what happens when appetite is exceeded

Be explicit: who must be informed, how quickly, and who can approve a decision to accept risk above appetite. Without this, the statement has no teeth.

How to make it stick

Writing the statement is the easy part. Using it is harder.

• Build it into decision templates. Business cases, project approvals and procurement decisions should ask which risk categories are affected and whether the proposal is within appetite.
• Report against it. Board and executive risk reports should show how actual risk compares with appetite, not just list the top risks.
• Review it annually, or when strategy changes significantly. Appetite that no longer matches the organisation's ambitions will be ignored.
• Explain it. Run short sessions with managers using real examples: "Here is a decision we made last year. Was it within appetite?"

Common mistakes

• Everything is low. A statement where every category is averse or cautious suggests the organisation wants to take no risk at all, which is impossible and discourages sensible innovation.
• Too abstract. If a manager cannot use it to make a decision, rewrite it.
• Too long. Aim for something that fits on two or three pages. Detail can live in supporting policies.
• No link to reporting. If nobody measures whether the organisation is within appetite, the statement is decorative.

Where risk appetite fits in your risk management

Risk appetite is one part of a wider risk management capability that includes identifying risks, assessing them consistently, treating them, monitoring them and building a culture where people raise concerns early. A clear appetite statement makes all of these easier, because it gives people a shared reference point.

If you want to see how your organisation's risk practices compare more broadly, the Risk Management assessment covers each of these areas, including how well risk appetite is defined and used in decisions. Established frameworks such as ISO 31000 also provide useful guidance on embedding risk management into governance.

Frequently asked questions

Who should own the risk appetite statement?

The board should approve it and own it, because it reflects the organisation's fundamental choices about risk. Executives usually draft it, with support from the risk function, and are responsible for applying it.

How often should we update it?

Review it at least once a year, and whenever the organisation's strategy, financial position or operating environment changes significantly.

Does a small organisation need a risk appetite statement?

A formal document may not be necessary, but the thinking is. Even a one-page note that says where the organisation is willing to take risks and where it is not helps leaders make consistent decisions.