Risk Appetite

Every organization takes risks to achieve its goals. A bank lends money knowing some loans will not be repaid. A software company releases new features knowing some will fail. A hospital adopts new treatments knowing they carry uncertainty. The question is not whether to take risk, but how much and of what kind. Risk appetite answers that question. It tells managers which risks the organization is eager to take, which it will accept within limits and which it wants to avoid, so that day-to-day decisions stay consistent with what the board intends. Without a stated appetite, each manager applies a personal view of acceptable risk.

Risk appetite is often confused with risk tolerance. The terms are related but different. Appetite is the broad statement of how much risk the organization seeks or accepts overall, while tolerance usually describes the acceptable range of variation around specific objectives or measures. In personal finance, risk tolerance has a separate meaning, describing how much investment volatility an individual can stomach. For risk, finance and strategy teams, a clear risk appetite turns risk management from a list of things to worry about into a guide for making decisions.

Definition of Risk Appetite

Risk appetite is the aggregate level and types of risk an organization is willing to assume, within its risk capacity, to achieve its strategic objectives and business plan. It is approved by the board and translated into limits and measures that guide management.

It is a central element of enterprise risk management, shapes the scales in a risk matrix and is monitored through key risk indicators.

Related Concepts

Risk capacity is the maximum amount of risk the organization could absorb before failing to meet obligations or survive, based on its capital, liquidity and other resources. Appetite should sit well within capacity. The gap between the two provides a buffer for unexpected events.

Risk tolerance describes acceptable variation around objectives or specific measures, such as accepting customer churn between 8% and 10% when the target is 8%.

Risk limits are specific, measurable thresholds, such as a maximum exposure to one counterparty, that put appetite into practice. Limits make appetite enforceable, since breaches can be measured and reported.

Risk profile is the organization's actual risk position at a point in time, which is compared with appetite to see whether it is within bounds. A profile outside appetite calls for action, either to reduce risk or to revisit the appetite.

What a Risk Appetite Statement Contains

A risk appetite statement usually opens with the organization's overall attitude to risk and how it relates to strategy.

It then sets out appetite by risk category, such as strategic, financial, operational, compliance, cyber and reputational risk, often using levels such as averse, minimal, cautious, open and seeking.

Qualitative statements explain the appetite in words, such as zero appetite for breaches of sanctions laws. Statements like this give staff a clear signal about what will never be acceptable.

Quantitative measures and limits make the appetite measurable, such as a maximum of four hours of unplanned downtime per quarter for customer-facing systems.

Importance of Risk Appetite in Risk and Compliance

Risk appetite aligns decisions. When managers know how much risk is acceptable, they can make choices consistent with the board's intent without escalating every decision.

It balances risk and reward. A clear appetite encourages taking risks where the organization wants to grow, as well as avoiding risks it cannot afford. An appetite that is too cautious can be as damaging as one that is too aggressive, since it leads to missed opportunities.

It also strengthens governance. Boards and regulators can compare the actual risk profile with the agreed appetite and act when the two diverge. Banking supervisors, following principles published by the Financial Stability Board in 2013, expect banks to maintain a formal risk appetite framework.

Risk Appetite and Financial Management

Financial measures of appetite, such as earnings volatility, capital ratios or maximum acceptable loss, connect risk directly to budgets and forecasts.

Appetite guides capital allocation by showing which investments fit within acceptable risk and which would push the organization beyond it.

Comparing the cost of risk mitigation with the amount by which a risk exceeds appetite helps prioritize spending.

Insurance and hedging decisions reflect how much financial volatility the organization is prepared to retain.

Common Challenges

Statements can be so general, such as low appetite for operational risk, that they do not guide any real decision. A useful test is whether a manager could use the statement to say yes or no to a specific proposal.

Appetite may be set once and never connected to limits, monitoring or reporting.

Different units may interpret the same appetite differently, leading to inconsistent decisions.