Writing a risk appetite statement people can use

A risk appetite statement only works if it sets limits people can act on.

1 min read

Avoid general statements

A line such as "we have a low appetite for compliance risk" gives a manager little to work with. People need to know what is acceptable and what is not when they make a decision.

Set measurable limits

Break appetite down by risk category and attach measures to each one. Examples include a maximum number of serious safety incidents, a minimum level of liquidity or a limit on exposure to one supplier.

Say what happens at the limit

State who is told when a limit is close or breached, and what they must do next. Review the statement when the strategy changes, and at least once a year.

Keep reading

More guides

After the refineries: how South Africa’s fuel business makes money going into 2027South Africa now imports more than half its fuel, runs two refineries and loses its Mozambican gas supply after 2028. Who the players are and where margin and exposure sit.What South African fuel boards must have on the register before 2027The ten strategic risks for South African fuel businesses going into 2027: what each one is, why it is on the register now, the early warnings and who should own it.Days of cover, licences, gas: the controls that move the ratingFor each of the ten oil and gas risks in South Africa: the control that moves the rating, the gap most commonly observed and the evidence a board should ask for.What a risk assessment should tell your boardIt should show your biggest exposures, how well they are controlled and what to fix first.Why risk registers go staleA risk register goes stale when nobody owns the actions in it.ISO 31000 or COSO ERM?ISO 31000 sets out principles and a process. COSO ERM ties risk to strategy and performance. Many organisations draw on both.

Common questions

Before you book

What is the key point?

A risk appetite statement only works if it sets limits people can act on.

Avoid general statements: what does this mean?

A line such as "we have a low appetite for compliance risk" gives a manager little to work with. People need to know what is acceptable and what is not when they make a decision.

Set measurable limits: what does this mean?

Say what happens at the limit: what does this mean?

State who is told when a limit is close or breached, and what they must do next. Review the statement when the strategy changes, and at least once a year.

Start with a free assessment

Book with our team. A review of where your risk management stands today and a recommended next step.

Request a Free Assessment