Risk appetite is one of those phrases that sounds advanced and usually means nothing. Ask most boards how much risk they are willing to accept and you get either a platitude, "we have no appetite for risk", which is impossible for any business that wants to grow, or a page of hedged prose that no one below the boardroom could ever act on. The test of a real risk appetite is brutally simple: can a front-line person use it, on their own, to make a decision the board would agree with? If not, you have a document, not an appetite.
What risk appetite is actually for
Risk appetite exists to let people decide without asking upstairs. It is the standing answer to "how far can I go?" so that a salesperson, a buyer or a manager can make a consistent call in the moment, without escalating everything or guessing. A good appetite pushes judgement down and out to where the decisions actually happen. A vague one pulls every decision up, because nobody below feels safe deciding, which is slow and, worse, inconsistent, since everyone guesses differently.
Why "we have no appetite for risk" is a lie
Every business that opens its doors takes risk. The firm that says it has no appetite for risk is either not growing or not being honest, and usually it means "no appetite for blame", which is different and corrosive. The useful move is to be specific about which risks you will take, in what amount, to get what, and which risks you will not take at any price. "No appetite" for bribery or safety shortcuts, yes, absolutely. "No appetite" for the ordinary commercial risk of selling something, no, that is just fear wearing a policy.
The solution, as a statement template
Write an appetite people can actually use
For each significant risk area, complete this sentence:
We will accept
up to
in pursuit of
but never
| Risk area | A usable appetite sentence |
|---|---|
| Credit | We will extend credit up to 30 days and X exposure per customer to win business, but never beyond that without sign-off. |
| Safety | We accept no shortcut that raises the chance of harm, whatever the deadline. This one has a hard zero. |
| Data | We will use customer data to improve the service, but never share or sell it, and never hold what we do not need. |
| New markets | We will enter a new market with a capped first investment we can afford to lose, but not bet the business on one. |
If a front-line person could read the sentence and make the call you would want, it works. If they would still have to ask, rewrite it.
The two kinds of limit
Notice that a good appetite has two shapes. Most risks get a boundary, a number or a condition up to which people can act freely. A few get a hard zero, a line that is never crossed for any commercial reason, safety, bribery, the deliberate breach of a core law. Confusing these is where organisations go wrong. Treating a hard-zero risk as a mere boundary invites disaster; treating an ordinary commercial risk as a hard zero paralyses the business. Naming which is which is half the value of the exercise.
Questions to test your risk appetite
- Could a front-line person use our appetite to make a decision, alone?
- Have we said which risks have a boundary and which have a hard zero?
- Does "no appetite for risk" actually mean "no appetite for blame"?
- Are we pushing decisions down, or pulling them all upstairs?
- For our biggest risk, can we write the appetite in one usable sentence?
Risk appetite is not a governance ornament. It is the mechanism that lets a business move fast and consistently, because people know how far they can go without asking. The organisations that cannot write it in a usable sentence end up with the worst of both worlds: every decision escalated, and every unescalated decision a guess. Do the unglamorous work of writing the sentence, mark the hard zeros clearly, and hand it to the people who make the calls. That sentence is worth more than any risk register, because it is the one people actually use.
Notes and sources
From the book
Key Compliance ModelsFifty-eight models of governance, risk and compliance, each explained in plain language and anchored to a real, sourced case.