Risk Appetite

Risk appetite exists to answer one board-level question: how much risk are we prepared to take on purpose? Without a stated appetite, every manager applies a private one — the treasurer's caution, the sales director's optimism — and the organisation's actual risk-taking becomes an accident of personalities. Appetite gives management a boundary for decisions such as how much downtime, credit exposure or single-supplier dependence is acceptable. It is also the reference point against which residual risk is judged.

The board approves the appetite statement, usually annually, with the CRO drafting and monitoring it. It lives in a short board-approved document, then reappears as limits in policies and thresholds in reports. Good statements are measurable: "no single customer above 20% of revenue", "no critical service down for longer than 4 hours", "no more than 30% of critical components sourced from one country". Each metric has an owner and a reporting line that shows the actual position against the stated boundary.

The typical failure is an appetite declaration written as noble prose — "we take a balanced and prudent approach to risk" — that no decision can be tested against. A statement without numbers, and without a cascade into operational limits, changes nothing below board level. How appetite becomes working limits and connects to resilience is covered in module M2 "From enterprise risk management to business resilience" of the ERGP programme.