Risk appetite: what it is and how to set one
How much risk to take, and of what kind: appetite, tolerance and capacity, why an approved appetite matters, and nine steps to a working risk appetite framework.
By 
Paul Taylor
8 min read
Effective organisations do not seek to eliminate all risk. Instead, they make deliberate decisions about the level and types of risk they are willing to accept in pursuit of their strategic objectives. This concept is known as risk appetite.
A well-defined risk appetite helps organisations balance opportunity and risk, support informed decision-making, and establish clear boundaries for management and staff. It is a foundational component of modern risk management frameworks and plays a critical role in governance, performance, resilience and accountability.
Risk appetite is the amount and type of risk an organisation is willing to accept in pursuit of its strategic objectives.
It provides a clear statement of the organisation's tolerance for uncertainty across material risks, and helps guide decisions about growth, investment, operations, innovation, customer service, regulatory compliance and other activities. Organisations with a higher appetite may pursue aggressive growth opportunities, while those with a lower appetite may prioritise stability, compliance and preservation of capital.
Risk appetite is typically approved by the Board and implemented by management through policies, procedures, controls and monitoring mechanisms.
While often used interchangeably, risk appetite and risk tolerance are distinct concepts.
Three related terms
- Risk appetite
The amount and type of risk an organisation is willing to accept.
- Risk tolerance
Quantifiable key risk indicators with limits or thresholds that define acceptable variations from the desired risk level.
- Risk capacity
The maximum level of risk an organisation can absorb before threatening its viability.
For example: liquidity risk at ABC Corporation
- Risk appetite
ABC Corporation has a very low appetite to fail to meet its liabilities as they fall due. Liquidity risk is to be actively managed at all times to ensure that ABC Corporation is able to meet funding requirements under normal and stressed conditions.
- Risk tolerance
Forecast net cashflow > 3 months.
- Risk capacity
Forecast net cashflow < 1 month would threaten the organisation's solvency.
Without a defined risk appetite, organisations often make inconsistent decisions about risk. Different business units may have varying interpretations of acceptable risk, resulting in conflicting behaviours, duplicated controls, excessive conservatism or excessive risk-taking.
Risk appetite provides a common decision-making framework across the organisation.
The benefits of an approved risk appetite
- Supports risk-based decision-making
Risk appetite provides a clear framework for determining whether a proposed action, investment, initiative or activity involves an acceptable level of risk relative to the organisation's objectives.
- Improves governance and accountability
It establishes clear boundaries for acceptable risk-taking, defines decision-making authority, and enables the Board and management to monitor, challenge and escalate risks consistently against approved thresholds.
- Resource allocation
It helps organisations prioritise investment, controls and management attention towards risks that are approaching or exceeding appetite, so resources are focused on the areas of greatest risk and strategic importance.
- Strengthens risk culture
It clearly communicates the organisation's expectations for risk-taking and decision-making, enabling employees to consistently make choices that align with strategic objectives, governance requirements and acceptable risk boundaries.
- Improves regulatory compliance
It helps the organisation proactively identify, manage and escalate potential breaches before they result in non-compliance or regulatory action.
- Increased organisational resilience
Early identification of risks approaching or exceeding appetite supports faster intervention.
Risk appetite is a central component of an organisation's risk management framework. The framework defines how risk is identified, assessed, managed, monitored and reported. Risk appetite provides the decision-making boundaries for these activities.
Risk appetite influences
- Risk assessment methodologies
By providing the benchmarks and thresholds against which risks are evaluated, prioritised and assessed to determine whether they are within, approaching or outside the organisation's acceptable level of risk.
- Risk acceptance decisions
By providing a benchmark against which identified risks are evaluated, helping management determine whether a risk is acceptable, requires treatment, or should be escalated because it exceeds the organisation's approved risk thresholds.
- Control design
By determining the level, strength and sophistication of controls required to keep risk exposures within the organisation's approved risk boundaries and tolerance levels.
- Incident management
By defining the severity thresholds, escalation triggers, response expectations and remediation actions required when incidents occur or when associated risks exceed acceptable levels.
- Key risk indicator (KRI) thresholds
By establishing the acceptable level of risk exposure, which is translated into measurable KRI limits and trigger points that indicate when risk is approaching or exceeding the organisation's approved appetite.
- Board reporting
By setting the boundaries against which current exposure, appetite breaches and treatment plans are reported to senior management and the Board.
- Assurance programs
By guiding the prioritisation, scope and frequency of assurance activities towards areas where risks are highest, controls are most critical, or exposures are closest to or exceed approved appetite thresholds.
Without a defined appetite, risk management activities often lack consistency and strategic alignment.
Developing risk appetite requires more than writing statements. It involves aligning strategic objectives, governance structures, risk assessments and performance measures.
- 1
Understand strategic objectives
Risk appetite should support strategic objectives rather than operate independently from them. The key question the organisation should ask is: “What material risks must we take to achieve our strategic objectives?”
To answer this question, review and understand the business plan, including business objectives and growth plans.
- 2
Confirm the risk taxonomy
Establish a comprehensive risk taxonomy covering all material risks. Examples include:
- Strategic
- Operational & Process
- People & Culture
- Legal, Regulatory & Compliance
- Integrity & Conduct
- Financial
- Technology, Cyber & Data
- AI & Model
- Third Party & Supply Chain
- Resilience & Business Continuity
- Sustainability, Climate & Environment
- Geopolitical & External
The taxonomy forms the structure for risk appetite statements.
- 3
Assess risk capacity
Determine the organisation's ability to absorb losses or disruption. This establishes the upper risk boundaries. Consider capital, liquidity, earnings, operational resilience, reputation and regulatory obligations.
- 4
Define appetite statements
Develop clear qualitative statements for each material risk. Consider developing statements for each level 2 risk in the taxonomy, as appetite can differ within a level 1 category. For example, within Financial risk (level 1), the organisation may have a very low appetite for liquidity risk, because of the consequences, but a medium appetite for interest rate risk.
Ensure that the rating scale is clearly defined to guide management, and that each statement is clear and practical.
- 5
Establish quantitative measures
Translate appetite into quantifiable key risk indicators. These indicators should combine detective, preventive, corrective and leading measures.
- 6
Define tolerance levels
Calibrate thresholds to determine when the KRIs are within, approaching or outside appetite.
- 7
Establish governance and escalation
Establish a corporate rhythm of escalating and reporting risk appetite to senior management and the Board, including breaches, treatment plans and accountability.
- 8
Integrate into business processes
Embed risk appetite into strategic planning, budgeting, policy development, control design, project approval, product development, procurement, outsourcing and change management. Risk appetite should influence business decisions across the organisation.
- 9
Monitor continuously
Regular reporting to senior management and the Board should include current exposure, appetite breaches, treatment plans, emerging risks, trend analysis and KRI performance.
The risk appetite framework should be reviewed annually, or when a significant strategic or regulatory change occurs.
The effective embedding of risk appetite requires
- Leadership commitment
The Board and senior management must continually reinforce risk appetite expectations.
- Policy alignment
Policies should cascade from risk appetite and reflect approved appetite positions.
- Decision-making integration
Business cases and investment proposals should explicitly consider risk appetite impacts.
- Training and communication
Employees should understand risk appetite expectations, including decision-making boundaries and escalation requirements.
Risk appetite is a cornerstone of effective risk governance. It defines the amount and type of risk an organisation is willing to accept in pursuit of its objectives, and provides the foundation for consistent decision-making across all levels of the business.
When aligned with the risk management framework and risk taxonomy, risk appetite enables organisations to balance opportunity and risk, strengthen governance, improve accountability and support long-term resilience. A well-designed and embedded risk appetite framework transforms risk management from a compliance activity into a strategic capability that supports informed decision-making and sustainable performance.
A selection of risk appetite examples that use qualitative statements and quantitative metrics to guide business decisions.
Operational & Process risk: business process
- Definition
The risk of financial loss or breach of a contractual obligation resulting from inadequate or failed internal processes.
- Statement of appetite
ABC Corporation prioritises stable, well-controlled and efficient processes that support reliable service delivery, regulatory compliance and operational resilience. ABC Corporation will tolerate only limited process weaknesses, and expects all critical and high-risk processes to operate within defined control standards. ABC Corporation has a low appetite for failure of business processes. Where incidents do occur, ABC Corporation expects early escalation and resolution.
- Measure
Control testing pass rate (%)
- Trigger
≤ 80%
- Limit
≤ 70%
Operational & Process risk: customer feedback
- Definition
The risk that failures in products, processes, systems, service delivery or staff conduct result in customer dissatisfaction, complaints or disputes, potentially leading to financial loss, regulatory action, remediation or reputational damage.
- Statement of appetite
ABC Corporation aims to deliver consistently fair customer outcomes, transparent products and reliable service. While a small number of complaints is expected in normal operations, ABC Corporation will not tolerate systemic issues, repeated failures, or complaints that indicate customer harm or regulatory non-compliance. ABC Corporation has a low appetite for customer feedback risk.
- Measure
Complaints resolved within SLAs (%)
- Trigger
≤ 90%
- Limit
≤ 80%