Risk Appetite: What Are You Actually Prepared to Accept?
The misconception
“We have a moderate appetite for financial risk.”
We've all seen statements like this in risk appetite frameworks. They sound reasonable enough. But what does the statement actually mean? And, more importantly, what is it actually used for?
Does it inform decisions? Does it guide management when an exposure increases? Does it change the way the organisation responds to uncertainty?
Risk appetite is commonly understood as the amount and type of risk an organisation is willing to accept in pursuit of its objectives.
That sounds straightforward. But the real test is what it means for someone making a decision.
We often treat risk appetite as a framework exercise: define the appetite, establish thresholds and Key Risk Indicators (KRIs), and report performance against them. The framework is in place; the Board can see where the organisation sits against its appetite.
But does it actually help decision-makers?
Let's test that against a real decision.
An organisation is pursuing an ambitious growth strategy, while the Board also wants to protect its financial resilience. Its risk appetite states:
“We have a moderate appetite for financial risk.”
Now, imagine a business leader considering the next significant investment. What does that statement actually tell them?
How much financial uncertainty is the organisation prepared to accept? What would make the investment too risky? When should the decision be reconsidered or escalated?
The statement doesn't necessarily answer any of those questions. It describes an appetite, but doesn't yet help the organisation apply it.
We then create KRIs to tell us where we are against appetite. A KRI might tell us, “We are approaching the boundary.” But it doesn't necessarily tell the person making the decision what that means for the choice in front of them.
That missing step is the problem.
Measuring risk against appetite is not the same as operationalising appetite.
Perhaps the more useful question, then, is not “How do we measure risk against appetite?” but “What is risk appetite actually for?”
To answer that, let's start with the strategy.
Start with the strategy
Risk appetite exists because an organisation is trying to achieve something.
Strategy sets the direction, objectives give that direction something concrete to achieve, and pursuing those objectives inevitably involves uncertainty.
Yet risk appetite development can start with broad risk categories and ratings rather than with what the organisation is actually trying to achieve.
A common approach is to define the appetite, decide what to measure, establish thresholds and report where the organisation sits against them.
That can leave the risk function asking, “What should we measure?” rather than the business asking, “What uncertainty are we prepared to accept in pursuing this objective?”
Starting with strategy changes that question.
Consider Organisation X. It is pursuing rapid product development and market expansion. That strategy may require the organisation to accept more financial uncertainty than it would under a more conservative approach.
Rather than asking:
“What is our appetite for financial risk?”
we can ask:
“What level of financial risk are we prepared to accept in pursuit of this objective?”
The answer might be:
“We accept moderate financial risk to accelerate market penetration, provided the maximum net loss or unbudgeted financial impact does not exceed 5% of annual revenue in any single fiscal year.”
Now the appetite tells us something useful. The organisation is prepared to accept financial risk because of the potential strategic benefit, while establishing a point at which that willingness to accept risk is stretched.
Compare that with simply saying:
“We have a moderate appetite for financial risk.”
The latter describes a general position. The former connects the organisation's willingness to accept risk to what it is actually trying to achieve.
It also gives management something they can apply to decisions. Is a proposed investment, product development programme or market expansion initiative consistent with the level of financial uncertainty the organisation has said it is prepared to accept?
Risk appetite therefore starts with the organisation's strategy and objectives, not with the KRI used to measure it.
But strategy does not execute itself. It is translated into decisions across the organisation: investments, programmes, projects, operational processes and day-to-day choices.
Risk appetite needs to be capable of informing those decisions. That means understanding not only what risk the organisation is prepared to accept, but where that acceptance needs to influence behaviour and decision-making.
The KRI almost writes itself
Once we understand what Organisation X is trying to achieve and the level of uncertainty it is prepared to accept, the question of measurement becomes much easier.
Organisation X has said it is prepared to accept potential losses of up to 5% of annual revenue in support of its strategy.
So what do we need to know?
Quite simply: how much potential exposure do we currently have?
The KRI might therefore measure the organisation's total potential loss from the relevant investments and initiatives, expressed as a percentage of annual revenue.
The important point is that we didn't start by asking, “What KRI should we use?”
We started with the objective and the appetite. The measure follows from that.
Risk appetite → What uncertainty are we prepared to accept?
KRI → Where are we in relation to that acceptance?
That distinction matters.
The KRI gives the organisation evidence about what is happening. It tells us whether exposure has increased, whether we are approaching the level the organisation has said it is prepared to accept, or whether we have moved beyond it.
It tells us where we stand.
But it doesn't make the decision.
So what happens when the measure moves?
When Risk Appetite Meets Decision-Making
So what happens when the measure moves?
Organisation X is pursuing rapid product development and market expansion. It has said it is prepared to accept potential losses of up to 5% of annual revenue in pursuit of that strategy.
The KRI now gives management visibility over its current exposure.
Imagine the market expansion is likely to divert resources away from revenue-generating activity, with an estimated impact of 3% of annual revenue. The organisation remains within the level of exposure it has said it is prepared to accept.
Now imagine the exposure increases to 5%.
Organisation X has reached the level it has said it is prepared to accept. This should prompt management to look more closely at the circumstances and consider whether the current approach remains appropriate.
At 7%, the position is different again. The organisation is now carrying more potential exposure than it has said it is prepared to accept.
These different positions can be thought about as follows:
| KRI Position | What does it tell us? | What does risk appetite tell us? | What happens next? |
|---|---|---|---|
| 3% - Within appetite | The organisation remains within the agreed range. | The current level of uncertainty remains acceptable. | Continue to monitor. |
| 5% - At appetite | The level of uncertainty is increasing or performance is moving away from the objective. | We have reached the level of uncertainty we have agreed to accept. | Review circumstances and consider action. |
| 7% - Beyond appetite | The exposure has moved outside the agreed range. | The organisation is experiencing more uncertainty than it has said it is prepared to accept. | A management decision is required. |
The important point is that the KRI does not make the decision.
At 3%, 5% or 7%, the KRI is evidence. Risk appetite provides the context. Management makes the decision.
That decision might involve changing the implementation approach, adjusting scope or timing, providing additional resources, introducing mitigation, revisiting assumptions or expected benefits, reconsidering the investment, or explicitly accepting the increased exposure.
The appropriate response depends on the organisation's objectives, the nature of the uncertainty, the potential consequences and the choices available to management.
This is an important distinction because risk appetite is not simply a collection of statements, and KRIs are not a collection of limits.
A limit says:
“Don't go beyond this.”
Risk appetite is broader. It describes the degree and type of uncertainty an organisation is prepared to accept in pursuit of what it is trying to achieve.
If a strategic opportunity is sufficiently attractive, an organisation may consciously decide to accept more risk. The important thing is that the decision is understood, considered and aligned with the organisation's objectives and appetite.
A well-defined and approved appetite can help management move faster where decisions sit comfortably within agreed boundaries, while providing a basis for appropriate governance rigour as decisions approach or move beyond them (DNA Decision Landscape).
And this is where risk appetite begins to move beyond the risk function.
The investment decision may sit with a senior executive or management team, but it is only one example of the choices being made across an organisation. Strategy is translated through programmes, projects, processes and day-to-day operational decisions.
If risk appetite is genuinely influencing the organisation, its principles should be capable of informing those decisions too.
The question isn't simply whether the KRI has crossed a particular number.
It is:
“What does this information mean for the decision we are making?”
That is where risk appetite moves from being something the organisation reports to something it actually uses.
And that raises a more important test.
Where does this appetite change what people do?
What does good look like
There is a simple way to test whether risk appetite has really been operationalised.
Ask a business leader:
“What does our risk appetite mean for the decisions you make?”
If they can answer specifically, which decisions are affected, what they are expected to consider, when a decision needs to be escalated, and what information they use — you are probably getting somewhere.
But if the answer is:
“Well, we have these KRIs…”
You may have a measurement framework rather than a risk appetite that is genuinely operationalised.
That is the distinction. Risk appetite cannot simply belong to the risk function.
Establishing the appetite is only the beginning. It needs to connect to the decisions, information and actions that follow.
| Artifact | Purpose |
|---|---|
| Appetite | What uncertainty are we prepared to accept? |
| Tolerance / Boundary | When does that acceptance require action or escalation? |
| KRI | Where do we currently stand? |
| Decision | What do we do with the information? |
Back to Organisation X.
“We accept moderate financial risk to accelerate market penetration, provided the maximum net loss or unbudgeted financial impact does not exceed 5% of annual revenue in any single fiscal year.”
Now trace that appetite into the business:
- What decisions does this influence?
- Which business processes embody that expectation?
- Which decisions require escalation?
- What would a decision-maker do differently because of this appetite?
- What information tells them they are approaching a boundary?
- What happens when they cross it?
If the organisation cannot answer those questions, the problem is not necessarily that it needs another KRI.
It may need to rethink what its appetite is actually trying to achieve.
That is the difference between having a risk appetite statement and having an appetite that is genuinely embedded in the organisation.
It also tells us something about ownership.
Risk appetite is ultimately a statement about the choices an organisation is prepared to make in pursuit of its strategic objectives. That makes it a Board responsibility, not simply a risk-function responsibility.
But Board ownership does not end when the statement is approved. The real test is whether the Board's intent travels through the organisation, into management decisions, business processes and ultimately the choices people make.
Executives translate that intent into organisational expectations. Business leaders apply it to their decisions. Risk practitioners help make the connection explicit, while assurance can test whether the organisation is operating consistently with that intent.
Everyone has a role, but the appetite itself belongs to the organisation.
If risk appetite only lives in the risk function, it has not really become organisational risk appetite.
Conclusion
Risk appetite is most useful when it helps an organisation make better decisions about uncertainty.
A KRI should not tell you what your appetite is. Your appetite should tell you what you need to measure.
Once the organisation has established what it is trying to achieve, what uncertainty it is prepared to accept and where the boundaries lie, the measures become much easier to identify. The KRI follows from the appetite; it does not define it.
And that leaves the more important question.
When the measure tells us we are approaching or exceeding the boundary, what does the organisation actually do?
If the answer is clear, risk appetite is doing its job.
The measure of a risk appetite statement isn't whether it can be reported. It's whether it changes a decision.
Ken De Negri
BSc, MSc, FCCA
De Negri Advisory Pty Ltd
About the author
Ken De Negri is the founder of De Negri Advisory, providing governance, risk, internal audit and sustainability advisory services to organisations across Australia. If this perspective resonates with your organisation or you'd like to discuss how these principles could be applied in practice, feel free to get in touch.