Risk Appetite Statement: How the Board Sets It and Turns It into Decision Limits

What is risk appetite, and how does it differ from risk capacity and risk limits?

Every organisation takes risks to achieve its objectives; the question is how much, and of what kind. ISO Guide 73:2009, as quoted by the IRM, defines risk appetite as the amount and type of risk an organisation is willing to pursue or retain. ^[4] The Financial Stability Board (FSB), whose principles are written for financial institutions, adds an important constraint: appetite must stay within risk capacity, the maximum risk the organisation can take on with its current resources before breaching capital and liquidity requirements or its obligations to stakeholders. ^[5]

The UK Institute of Risk Management (IRM) distinguishes two ideas: appetite is about the risk an organisation sets out to pursue, tolerance is about what it can absorb, and in most cases appetite is narrower than tolerance. ^[3] Risk limits, in the FSB’s words, are quantitative measures based on forward-looking assumptions that allocate the aggregate appetite to business lines, legal entities, risk categories and concentrations. ^[5]

In COSO’s 2017 enterprise risk management framework, defining risk appetite is Principle 7 within the Strategy and Objective-Setting component, meaning appetite is set alongside strategy, not after it. ^[1] ISO 31000:2018 can be used by any organisation regardless of size, activity or sector. ^[2] In 2011 the IRM noted that the then-current edition of ISO 31000 did not address risk appetite directly, focusing instead on risk attitude and risk criteria. ^[4]

Why does the board own risk appetite?

Because it is a decision about how big a bet the organisation is prepared to make, and that is the core of governance. COSO makes board risk oversight the first principle of its framework and lists the strategy and risk appetite proposed by management among the matters the board may review, challenge and concur with. ^[1] The FSB principles require the board to approve the risk appetite framework and statement, developed with the CEO, chief risk officer and chief financial officer, to hold senior management accountable for the framework’s integrity, to monitor the risk profile against limits and to ensure breaches are acted on. ^[5]

In the Gulf, requirements vary by regulator and sector. In the UAE, for example, the Central Bank of the UAE’s Risk Management Regulation, issued by Circular No. 153/2018, requires a bank’s risk framework to include a board-approved risk appetite statement with limits for all relevant risk categories and concentrations, and places ultimate responsibility for the risk governance framework on the board. ^[6] Organisations in other countries and sectors should go directly to the requirements of their own regulator.

What should a risk appetite statement contain?

A risk appetite statement is a written document setting out the aggregate level and types of risk the organisation will accept or avoid, using qualitative and quantitative measures. ^[5] Under the FSB principles, the statement should: ^[5]

• Link to the strategic, capital and financial plans, and to remuneration.
• Set the maximum level of risk for each material risk and for the organisation overall.
• Include quantitative measures that can be translated into limits for business units.
• Include qualitative statements explaining why risks are taken or avoided, including reputational and conduct risk.
• Be forward-looking and subject to scenario and stress testing.

The IRM adds that appetite must be measurable so the wording does not become vague, and that it differs from one type of risk to another, so a single sentence for the whole organisation is not enough. ^[3] The table below is a drafting template (the values are illustrative):

How does the statement become decision limits?

This is where many organisations fail: the board approves a well-written statement, then nothing changes in day-to-day decisions. The FSB principles assign the translation clearly: the CEO ensures appetite is translated into limits for business lines and legal entities, the CFO builds it into business planning, new products, mergers and acquisitions and capital management, and business line leaders set and monitor limits within their units and escalate breaches promptly to the CRO and senior management. ^[5]

The IRM notes that tolerance tends to take the form of limits, either hard boundaries or early-warning tripwires that signal an impending breach, and recommends key risk indicators (KRIs) and key control indicators (KCIs) to measure tactical and operational risks and controls. ^[4] In practice, each indicator is linked to three zones:

• Safe zone: the manager acts within normal authority.
• Warning zone: the risk owner and risk function are informed and a corrective plan is put in place.
• Breach zone: the decision moves up to the next level of the delegation of authority matrix, or to the board risk committee.

The financial and administrative delegation matrix thus becomes the tool that carries appetite into decisions: any decision outside the limits is not the manager’s alone.

Hypothetical example: a logistics company sets its appetite

Hypothetical example: the board of a Gulf logistics services company approves a statement of “moderate appetite for growth risk and low appetite for customer credit risk”. Executive management turns the second phrase into an indicator: receivables overdue by more than 90 days as a share of total receivables.

• Below 5%: safe zone; the sales manager can accept contracts on credit terms within normal authority.
• 5% to 8%: warning zone; any new contract on credit terms needs CFO approval.
• Above 8%: breach zone; new contracts on credit terms stop and the matter goes to the risk committee.

With the indicator at 6%, a large contract on deferred payment terms comes in. The sales manager does not decide alone; the contract goes to the CFO, who accepts it on condition of a bank guarantee. That is what decision limits mean: appetite did not block growth, but it set who decides and on what terms.

What happens when a limit is breached?

A breach is not necessarily a failure, but hiding one is. Under the FSB principles, the chief risk officer reports regularly on the risk profile against appetite and escalates material breaches promptly to the board and CEO, and the CEO sets a policy for notifying the board and supervisor of serious breaches. ^[5] For UAE banks, the Central Bank regulation requires exceptions to be addressed immediately and the Central Bank to be notified immediately of any significant deviation from the board-approved risk appetite statement. ^[6]

The IRM recommends that the board exercise governance over appetite at four points (approval, measurement, monitoring and learning) and that breaches trigger a mid-cycle review where needed rather than waiting for the annual one. ^[3]

Common mistakes in risk appetite statements

• Vague, unmeasurable wording: such as “we take a prudent approach to risk”, with no measure or limit. ^[3]
• One appetite for every risk: appetite varies by risk type and organisational level and changes over time. ^{[3, 4]}
• Appetite above capacity: appetite must sit within risk capacity, not be set in isolation from it. ^[5]
• Appetite detached from remuneration: if incentives reward breaching limits, the statement will not survive. ^[5]
• Appetite without control: the IRM warns that appetite must be matched by the capacity to control risk, and that setting an appetite is worthwhile only if the organisation can actually manage risk to that level. ^[4]

Conclusion

Risk appetite is a governance decision owned by the board, but its value shows at the levels below: allocated limits, warning indicators and a delegation matrix that sets who decides as a limit approaches. Start with three or four material risk categories, give each a statement, a measure and a limit, and link them to decision rights before expanding the framework.