Risk Appetite: Definition, Statement Example and Framework
Maxim Atanassov •
Risk appetite is the amount and type of risk an organization is willing to take to achieve its objectives. The board sets it, management works within it, and a written risk appetite statement turns it into limits people can apply. Without one, every manager decides alone how much risk is too much.
The standard definitions
The main frameworks agree on the idea and differ only in wording.
| Source | Definition of risk appetite |
|---|---|
| ISO 31000 (definition in ISO 31073:2022) | "Amount and type of risk that an organization is willing to pursue or retain" |
| COSO, Enterprise Risk Management: Integrating with Strategy and Performance (2017) | "The types and amount of risk, on a broad level, an organization is willing to accept in pursuit of value" |
| Institute of Risk Management (IRM) | "The amount and type of risk that an organisation is willing to take in order to meet their strategic objectives" |
| Financial Stability Board, Principles for an Effective Risk Appetite Framework (2013) | "The aggregate level and types of risk a financial institution is willing to assume within its risk capacity" |
Two words matter in every version: amount and type. An organization can be hungry for one kind of risk and averse to another. A software company may take large bets on new products and accept no risk at all of a privacy breach.
Risk appetite vs. risk tolerance vs. risk capacity
The three terms describe different things.
| Term | Question it answers | Set by | Example |
|---|---|---|---|
| Risk capacity | How much risk can we survive? | The balance sheet, liquidity and regulation | We would breach our loan covenants after a loss of $20 million |
| Risk appetite | How much risk do we want to take? | The board | We accept losses of up to $5 million a year in pursuit of growth |
| Risk tolerance | How far can a result vary before we act? | Management, within the appetite | Gross margin may fall to 32% against a 35% target; below that we escalate |
Capacity is the ceiling. Appetite sits below it, by choice. Tolerance translates appetite into ranges around each objective. The Financial Stability Board defines risk capacity as "the maximum level of risk the financial institution can assume given its current level of resources"; an appetite set above capacity is a plan to fail.
For a full treatment of tolerance, see our guide to risk tolerance.
The five levels of risk appetite
Many organizations rate their appetite for each category of risk on a five-level scale:
| Level | Meaning | Typical use |
|---|---|---|
| Averse | Avoid the risk entirely | Safety, fraud, sanctions |
| Minimal | Accept only the lowest-risk options | Regulatory compliance, financial reporting |
| Cautious | Prefer safe options with limited reward | Liquidity, data privacy |
| Open | Accept risk for a fair reward | Operations, technology change |
| Hungry | Seek risk for a high reward | Innovation, market expansion |
The scale is a starting point. It becomes useful only when each level is tied to a measure, as in the example below.
What a risk appetite statement looks like
A risk appetite statement has two layers: a short narrative the board approves, and a table of measures and limits management monitors.
The statement below is illustrative, written for a fictional mid-sized Canadian manufacturer. Adapt the categories, measures and limits to your own organization.
Risk appetite statement (illustrative)
We take measured risk to grow. We will invest in new products and markets where the expected return justifies the risk, and we accept that some of these investments will fail. We will not compromise the safety of our people, the integrity of our financial reporting or our compliance with the law.
| Risk category | Appetite | Measure | Limit (escalate to the board) |
|---|---|---|---|
| Strategic: new products and markets | Hungry | Share of capital invested in initiatives under three years old | Up to 25% |
| Financial: liquidity | Cautious | Days of cash on hand | No fewer than 60 |
| Financial: leverage | Cautious | Net debt to EBITDA | No more than 2.5 times |
| Operational: supply chain | Open | Revenue dependent on a single supplier | No more than 15% |
| Technology: cyber security | Minimal | Critical vulnerabilities open more than 30 days | Zero |
| Health and safety | Averse | Lost-time injuries | Zero tolerance; every incident reported to the board |
| Compliance | Averse | Material regulatory breaches | Zero |
Each row names a category, a level, a measure and a limit. A statement that stops at the narrative cannot be monitored, and a statement nobody can monitor does not change a single decision.
How to set your risk appetite in six steps
1. Start from the strategy
List the strategic objectives for the next three to five years. Appetite exists to serve them; a growth strategy with an averse appetite is a contradiction the board must resolve.
2. Measure your capacity
Work out how much loss, volatility and disruption the organization can absorb: capital, liquidity, covenants, regulatory minimums and reputation.
3. Choose the categories
Use the categories in your risk register, usually strategic, financial, operational, technology, compliance and people. Keep the list short enough for the board to debate.
4. Set a level and a measure for each
Agree on a level from the five-level scale, then pick one or two measures per category with a limit. Use the key risk indicators (KRIs) management already reports wherever possible.
5. Have the board approve it
The board owns risk appetite. The Financial Stability Board's principles state that the board approves the risk appetite statement, and observe that boards which approve it understand the organization's appetite better than boards which only receive it.
6. Monitor, escalate and review
Report each measure against its limit at every board or risk committee meeting. Define in advance what happens on a breach: who is told, how fast, and who decides the response. Review the statement every year, and whenever the strategy changes.
Common mistakes
- Writing a statement nobody can measure. "We have a low appetite for reputational risk" is a sentiment. Name the measure.
- Setting appetite above capacity. The appetite must leave a margin below the point where the organization fails.
- One appetite for everything. A single level across all risks hides the trade-offs the board should make.
- No breach process. A limit without a consequence is a suggestion.
- Approving it and filing it. If the statement is not used in investment, budget and hiring decisions, it is not your risk appetite. Your decisions are.
Frequently asked questions
What does "risk appetite" mean?
It is the amount and type of risk an organization is willing to take to achieve its objectives.
What is an example of a risk appetite statement?
"We will not compromise the safety of our people, and we accept no material regulatory breaches. We accept measured risk in new products and markets, investing up to 25% of our capital in initiatives under three years old." A full statement adds a measure and a limit for each category of risk, as in the table above.
What are the five levels of risk appetite?
A common scale runs from averse, through minimal, cautious and open, to hungry.
Who approves the risk appetite statement?
The board of directors, usually on the recommendation of the risk or audit committee. Management proposes it and works within it.
What is a risk appetite framework?
The policies, processes, controls and systems through which the organization sets, communicates and monitors its risk appetite. The statement is the core document of the framework.
How often should risk appetite be reviewed?
At least once a year, and whenever the strategy, the capital position or the regulatory environment changes.
Further reading
- Mastering risk tolerance: a guide to making informed decisions
- Mastering the COSO enterprise risk framework
- Top strategies to prioritize risk for effective decision-making
- The best risk management and ERM books, including David Hillson and Ruth Murray-Webster's A Short Guide to Risk Appetite
- Financial Stability Board, Principles for an Effective Risk Appetite Framework (2013)
