What Is Risk Appetite? A Board Limit, Not a Guide

I have sat in audit committee meetings where the paper on risk appetite ran to 22 pages, complete with coloured thresholds and the regulator's latest nudge clipped to the back. Then a director asked, "what is risk appetite?" Nobody answered. The CRO glanced at the chair. Two people shuffled paper. The meeting carried on pretending the phrase was settled. That told me more about the concept than the paper did.

My short answer is simple. It is supposed to describe the amount and type of uncertainty an organisation is willing to accept while pursuing its objectives. My longer answer, after years of watching boards wrestle with it, is less flattering. The phrase sounds exact, yet the real boundary only appears when somebody must choose, with consequences attached.

Risk appetite is a broad statement of the amount and type of uncertainty an organisation says it is willing to accept in pursuit of its objectives.

Why boards keep asking "what is risk appetite?"

I wrote about this in 2011 for RiskPost, when appetite statements were spreading through governance codes. Boards wanted something they could approve and regulators wanted something they could inspect. Advisers were happy to enlarge the exercise. The promise was tidy enough on paper: declare a boundary at the top and push it down into limits. After that, people could claim the organisation knew what was acceptable.

The institutional script still sounds respectable. The Financial Stability Board says appetite is the aggregate level and types of risk a firm is willing to assume to achieve its objectives. APRA says the board sets it and management turns it into practice. When a committee keeps asking "what is risk appetite?", it is usually not asking for a better sentence. It is asking where the real boundary sits and who will own the call when the facts turn. The statement may set a tone. It does not make the choice.

In my experience boards reach for the phrase when they want a clean answer to a dirty problem. They want something they can point to after the meeting, especially if the regulator later asks where the boundary was. I understand the urge. A signed statement looks better than an argument in the minutes. It still leaves the hard part untouched, because the hard part is deciding what this choice depends on and what would make it unacceptable.

Why the definitions keep sliding

In that 2011 piece I pointed out that even the official definitions would not sit still. COSO managed to offer one version based on "degree of risk" and another based on "amount of risk", as if the swap explained itself. The NIST glossary still carries shifting wordings from one source to the next. The wording moves because the concept moves. That wobble is useful if you sell governance machinery. Institutions get to keep the label, while consultants and framework people keep the billable clean-up, without ever proving the term helps a live decision.

The phrase sounds simple only until you ask what the word "risk" is doing in the sentence. Is it the bad event, or the possible damage? Once the core word slips, the appetite statement drifts away from the business it is meant to help decide. Committees then do what committees do best: they spend an hour on wording so nobody has to touch the live choice underneath.

The searcher who lands here is usually under pressure to draft a statement that sounds credible. I would be wary of that brief. Once the job becomes "make it sound credible", the incentives are already crooked. The text grows longer and the caveats multiply, while nobody asks whether the final sentence could change Tuesday's decision.

Numbers do not rescue it. Boards like ratios because ratios look stern. Yet the awkward decisions are often about safety or public trust, where one neat threshold is an invitation to fool yourself.

The paper also pretends the board's judgement is stable when it plainly is not. After a public embarrassment, appetite tightens. During a growth burst, it loosens. Directors far from the daily work tell themselves the document is fixed while their mood swings with the last headline.

I have watched committees argue over whether appetite should be "low" or "cautious" as if one adjective might save them from having to name the assumption underneath the call. That is the real dodge. Wording debates let everyone look industrious while the decision itself sits untouched in the middle of the table.

When a risk appetite statement becomes theatre

Once the statement fails to answer a live question, the usual response is more machinery. APRA says no single appetite statement can capture every dimension that matters, so the answer is another layer of metrics and oversight. That suits regulators and the growing CRO apparatus. Advisers rarely object. If a concept needs a second machine bolted onto it before anyone can use it, the concept was never doing the work.

The 2018 prudential inquiry into Commonwealth Bank is a clean example. APRA examined six major incidents and made 35 recommendations. It found that the bank's appetite statement did not materially influence the risk profile. Key metrics looked backward, and aggregate measures could hide serious issues. CBA later mobilised about 800 full-time equivalent roles for remediation. The apparatus grew. The decision quality did not.

The trouble is not that boards are wicked or stupid. It is that the apparatus lets responsibility blur. One group owns the wording and another owns the metrics. By the time a real decision arrives, ownership has been sliced so thin that nobody can say, plainly, what would make the call wrong.

I have seen the milder version of the same trick for years. The board signs off the statement and management turns it into thresholds. After that, the papers start commuting between committees. Then a difficult call arrives and the people in the room still have to ask what outcome they are protecting and which assumption could sink the decision. When management keeps asking "what is risk appetite?", I assume the real criteria were never written down.

At that point the statement resembles laminated reception art: expensive enough to notice, useless when the building catches fire.

That is why I treat many appetite statements as cousins of the risk register. They can move through committees without forcing anyone to face what the choice rests on.

That pattern runs through most of the governance machinery around risk: it advertises diligence while sparing judgement.

What to do after asking "what is risk appetite?"

When the working group prepared ISO 31000, we chose not to build the Standard around appetite and tolerance. We took the plainer route of risk criteria because those labels invited theatre and pulled attention away from the decision in front of people. Roger Estall and I made the same point in Deciding: broad governance language only becomes useful when it changes a live decision.

I do not say this because I dislike paperwork on aesthetic grounds. I say it because broad labels are happiest when nothing concrete is expected of them. The moment you connect them to a live choice, they either sharpen into criteria or collapse into decoration.

My replacement is not another glossary. It is the Universal Decision-Making Method. I start by telling people to Frame the decision. Then Develop options and Recognise assumptions. After that, ask whether there is Sufficient certainty to proceed and Design monitoring that will reopen the call if the facts shift. That keeps uncertainty attached to the choice, which is exactly what appetite slogans let people dodge. Slogans travel beautifully in board papers because nobody has to own an assumption.

Take a live board choice. If you are deciding whether to keep a troubled plant running for another quarter, "low appetite" tells you nothing. You need to know what exposure would make the decision indefensible and what signal would force the board back into the room. Then you test whether the repair assumption is strong enough to proceed. That is ugly work. It is also real work.

I have no interest here in rehearsing the risk versus uncertainty quarrel, except to say that decisions are upset by what we do not yet know, not by slogans about what we can supposedly tolerate.

If your board keeps asking "what is risk appetite?", stop polishing the slogan and write two things instead: the outcome that must be protected, and the trigger that stops or reopens the decision. Write the statement if they insist. Then write the actual tripwire that bites. A statement that never tests a live choice is not governance, it is wallpaper with board approval.

---

Grant Purdy is the co-author, with Roger Estall, of Deciding (2020), and the architect of the Universal Decision-Making Method.