Here is the only test of a risk appetite statement that matters: has it ever changed a decision? Not informed one, not been appended to one — changed one. A deal declined, a product launch delayed, a limit that made a desk say no, an initiative re-scoped because the exposure would have breached a stated tolerance. Most organizations, asked for an example, produce silence — because most appetite statements were written to satisfy a governance expectation, approved in a board meeting nobody remembers, and filed. They are shelfware with a signature.
This guide is about the other kind: appetite statements wired into how the organization actually decides. The anatomy that makes one work, the appetite-tolerance-limit ladder that turns philosophy into arithmetic, six realistic example statements across the major risk types, the board mechanics, and — because this is an internal audit site — how to audit whether your organization’s statement is alive or embalmed. It anchors the governance layer of our Risk Library and pairs with its sibling on running an RCSA that is not theater.
This guide was rewritten in September 2026 to add what the August version left out: the metrics cascade worked in full for two of the example statements, from the board’s sentence to the limit a system enforces; two further examples for organizations that are not banks, a food manufacturer and a public body; the risk acceptance process that keeps a statement honest when an exposure runs past tolerance and management wants to live with it; a one-page appetite report to the board; and the five audit tests written as procedures with hours. The ladder, the anatomy, the six original examples, the board mechanics and the failure modes are unchanged.
In this guide
- The ladder: capacity, appetite, tolerance, limits
- Anatomy of a statement that works
- The cascade: from board prose to desk-level decisions
- The cascade, worked: two statements traced from the board to the desk
- Six realistic examples, risk type by risk type
- Two more examples for organizations that are not banks
- Board mechanics: approval, breach, and review
- How internal audit tests an appetite framework
- Risk acceptance against appetite
- The one-page appetite report to the board
- The five audit tests as a work program
- The failure modes
- Where to go next
The ladder: capacity, appetite, tolerance, limits
Four words carry the whole framework, and organizations that blur them produce statements that cannot function. Capacity is the maximum risk the organization could absorb and survive — a fact about the balance sheet and franchise, not a choice. Appetite is the amount and type of risk the organization wants to take in pursuit of strategy — a choice, made by the board, expressed mostly in words and direction. Tolerance is the measurable band around the appetite — the quantified boundaries within which performance may vary before someone must act. Limits are the operational hard lines derived from tolerances and assigned to desks, units, and processes — the numbers a system can actually enforce. The ladder must be strictly nested: limits inside tolerances, tolerances inside appetite, appetite comfortably inside capacity. Where our Risk Library’s language-of-risk section introduces this ladder conceptually, this guide is about building and testing it — because nearly every dysfunction you will meet in practice is a rung problem: a poetic appetite with no tolerances (philosophy without arithmetic), limits with no traceable link to any tolerance (arithmetic without philosophy), or tolerances set wider than capacity (a promise the balance sheet cannot keep).
One vocabulary abuse deserves immediate execution: “we have zero appetite for…” applied to risks the organization takes daily by existing. Zero appetite for cyber risk while running email; zero appetite for compliance breaches while employing humans; zero appetite for credit losses while lending. These statements are aspiration cosplay — unachievable, unmeasurable, and corrosive, because the organization learns on day one that the appetite statement does not mean what it says. Reserve zero (or near-zero) appetite for the narrow set where it is real — knowing and willful violations, safety-of-life shortcuts — and phrase everything else as what it is: a low, priced, monitored tolerance.
Anatomy of a statement that works
A working risk-type statement has five parts, and you can check any organization’s statement against them in ten minutes:
- Strategy linkage — the sentence that says why this risk is being taken: “to grow mid-market lending,” “to enter two new markets.” Appetite is the risk half of the strategy; a statement with no strategic referent is a mood.
- Direction and bounds in words — the qualitative appetite: higher, moderate, low; the kinds of exposure welcomed and the kinds refused.
- A measurable tolerance — at least one metric with a number: a loss rate, a concentration percentage, a downtime bound, an incident-severity ceiling. No metric, no statement — just prose.
- An escalation trigger — what happens at the boundary: who is informed, at what threshold, with what required response and clock. The trigger is what converts a number into governance (and note the Global Internal Audit Standards give internal audit its own duty here — Standard 11.5 requires escalating risk acceptance beyond appetite to the board when management will not).
- An owner and a cadence — who monitors the metric, who reports it, when the board re-approves. Statements without owners are unattended machinery.
The cascade: from board prose to desk-level decisions
The cascade is where appetite frameworks live or die, because a board statement changes nothing until it is translated into instruments the organization already obeys: credit policy cutoffs, delegation-of-authority tables, product approval criteria, procurement rules, system-enforced limits. The translation has three layers — board statement (per risk type, the five-part anatomy above) → risk-type tolerances (the metric bands, owned by the second line and reported quarterly) → operational limits and decision rules (embedded in the policies and systems where decisions actually happen). The audit question at every layer is traceability: can this desk limit be traced to a tolerance, and that tolerance to an approved statement? When the answer is no — and it usually is somewhere — you have found either orphan limits (rules nobody can justify) or orphan appetite (board intent that never reached the field). Both are findings, and the second is the one boards care about, because it means the statement they approved is decorative.
The cascade, worked: two statements traced from the board to the desk
The three-layer cascade above is easy to agree with and hard to see, so here it is drawn for two of the example statements below, layer by layer, with the owner and the frequency at each rung. The test at every row is the traceability question: can the number in this row be derived from the row above it, and would a change in the row above force a change here? Where the answer is no, the rung is orphaned.
| Layer | Credit appetite, growth lender | Owner and frequency | Instrument |
|---|---|---|---|
| Board statement | Elevated credit risk accepted in senior secured mid-market lending; no unsecured exposure, no single name above 2.5 percent of capital, no covenant-lite below BB equivalent | Board, approved annually with strategy | The appetite statement, versioned |
| Risk-type tolerance | Through-cycle net charge-off at or below 1.2 percent of average loans; escalation at 0.9 percent; single-name concentration measured monthly against capital | Chief Credit Officer, reported quarterly to the Risk Committee | The tolerance schedule attached to the statement |
| Operational limits | Segment limit for mid-market secured at 35 percent of the book; single-name hold limit of 2.0 percent of capital, leaving headroom to the 2.5 percent boundary; minimum internal grade for covenant-lite equivalent to BB; unsecured mid-market product not available in the origination system | Credit policy committee, reviewed semi-annually | Credit policy sections; the delegation of authority table; the product catalog |
| Decision rules | Any deal taking a single name above 1.8 percent of capital requires Credit Committee approval and a concentration memo; covenant-lite structures require a grade check at origination that the system performs; segment utilization above 32 percent triggers a pipeline review | Origination system and Credit Committee, per deal | System-enforced grade and concentration checks; committee terms of reference |
| Monitoring and breach | Charge-off rate and concentration reported monthly; a touch of 0.9 percent triggers a Risk Committee paper within 30 days with a decision recorded: reduce, accept with expiry, or re-tolerance through the board | Second-line risk function, monthly; board, on escalation | The tolerance dashboard; the breach log |
Notice the headroom built into each rung: the hold limit sits at 2.0 percent so that the 2.5 percent boundary is never the first line anyone meets, the pipeline review fires at 32 percent of a 35 percent segment limit, and the Risk Committee hears about charge-offs at 0.9 percent, well inside the 1.2 percent tolerance. Limits that sit exactly on the tolerance make every ordinary fluctuation a breach and teach the organization that breaches are noise. The second example is operational, where the cascade runs into engineering rather than policy.
| Layer | Operational appetite, payments business | Owner and frequency | Instrument |
|---|---|---|---|
| Board statement | Rapid product launch accepted, processing integrity not negotiable: availability at or above 99.95 percent monthly, zero data-loss incidents, automation preferred to manual workaround as a design principle | Board, annually | The appetite statement |
| Risk-type tolerance | Availability 99.95 percent per month per tier-1 service; single operational loss above $500,000 or aggregate above $3 million in a year triggers Risk Committee review; manual workarounds in the payment path permitted for no more than 60 days with an owner | Chief Operating Officer, reported quarterly | The tolerance schedule |
| Operational limits | Error budget per service derived from 99.95 percent: about 22 minutes of downtime a month; change freeze when the budget is 75 percent consumed; a workaround register with 60-day expiry enforced by the change board; loss events recorded above $10,000 | Head of Engineering and the change board, monthly | Service-level objectives; change management policy; the operational loss database |
| Decision rules | A launch requiring a manual step in the payment path needs the COO’s approval and an expiry date; any release during a freeze needs the CTO’s approval and a rollback plan; a single loss above $100,000 goes to the operational risk committee within five days | Change board, per release; risk committee, per event | Release checklist; incident procedure |
| Monitoring and breach | Availability and error budget consumption published weekly; a month below 99.95 percent or a loss above $500,000 triggers the Risk Committee paper, with the control investment plan on the agenda | Second-line operational risk, monthly; board, on escalation | The reliability dashboard; the breach log |
The operational cascade shows what the board’s design principle becomes when it reaches the desk: a register of workarounds with expiry dates, enforced by the change board. That is the instrument the launch-date decision in the examples below was made by, and it is what an auditor tests when asked whether the statement is alive. The RCSA guide covers how the first line discovers which of its controls the tolerances depend on.
Six realistic examples, risk type by risk type
Fictionalized but structurally faithful — each carries the five-part anatomy, and after each: the decision it exists to change.
Credit (a growth lender): “To support our mid-market growth strategy, we accept elevated credit risk in senior secured lending to companies with $10–100M revenue, within a through-cycle net charge-off tolerance of 1.2% of average loans (escalation to the Risk Committee at 0.9%). We do not accept unsecured exposure to this segment, single-name concentrations above 2.5% of capital, or covenant-lite structures below BB equivalent. Owner: CCO; board re-approval annually with strategy.”
Decision it changes: the marginal deal at the pricing committee — the 2.7% concentration or the covenant-lite structure gets declined by reference, not by argument.
Liquidity: “We maintain sufficient liquidity to survive 90 days of severe combined stress without accessing wholesale markets or central bank facilities. Tolerance: stressed survival horizon ≥ 90 days (escalate below 105); unencumbered liquid assets ≥ 115% of 30-day stressed outflows. We accept the earnings drag of this buffer as a strategic cost. Owner: Treasurer; monitored daily, reported monthly to ALCO and quarterly to the board.”
Decision it changes: the balance-sheet growth plan that would have funded long assets with short wholesale money — re-shaped before proposal, because the horizon math would not clear.
Operational (a payments business): “We accept the operational complexity of rapid product launch, but not at the expense of processing integrity: payment-processing availability ≥ 99.95% monthly and zero data-loss incidents; single operational losses above $500K, or aggregate annual losses above $3M, trigger Risk Committee review of the control investment plan. We prioritize automation over manual workaround as a standing design principle.”
Decision it changes: the launch date — the feature ships a quarter later because the manual-workaround go-live would have breached the design principle the board actually signed.
Compliance (zero-tolerance done honestly): “We have no appetite for knowing or willful violations of law or regulation, and no tolerance for retaliation against those who raise concerns — both are treated as conduct events regardless of financial size. We recognize that isolated, inadvertent errors occur in a business of our scale; our tolerance is that such errors are self-identified (not regulator-identified) in at least 80% of cases, remediated within policy SLAs, and never repeated at the same root cause. Owner: CCO; conduct events reported to the board as they occur.”
Decision it changes: the response to the small self-found error — investigation and disclosure instead of quiet fix, because the metric rewards self-identification rather than silence. This is what “zero tolerance” looks like when written by adults.
Cyber and technology: “We accept measured technology risk in pursuit of digital speed, within bounds: no unsupported software in the payment path; critical vulnerabilities remediated within 14 days (tolerance breach at any single instance > 30 days); recovery objectives of 4 hours for tier-1 services, tested twice yearly — an untested recovery capability is treated as absent. We do not accept unencrypted customer data at rest or in transit, anywhere, including with third parties.”
Decision it changes: the vendor selection — the cheaper provider that cannot evidence encryption loses on a stated boundary, not a preference (and the third-party clause is exactly the kind of criteria the IIA’s Third-Party Topical Requirement expects assurance to reach).
Strategic and M&A: “We pursue acquisitions that add capability in our two core markets, sized so that no single transaction exceeds 15% of enterprise value or endangers our investment-grade profile; integration capacity limits us to one major integration at a time. We accept that this discipline will cost us deals. We do not accept transformational bets that would put the whole franchise at risk, however attractive the upside.”
Decision it changes: the second concurrent deal — deferred by rule while integration one completes, which is the sentence the CEO reads aloud when the banker calls.
Two more examples for organizations that are not banks
Five of the six examples above come from financial services, where appetite frameworks were born and where the metrics are easiest. The two below are for the organizations that ask most often whether the framework applies to them: a food manufacturer, whose worst risk is a product on a shelf, and a public body, whose worst risk is a service that fails the people who depend on it. Both carry the five-part anatomy, and both end with the decision they exist to change.
Product safety and quality (a food manufacturer): “To grow our co-packing and private-label business we accept the operational complexity of running customer-specified recipes across four plants, but we do not accept product on the market that could harm a consumer: no known critical food safety non-conformance is released, ever, and any release decision overriding a hold requires the Quality Director and a plant manager jointly, recorded. We recognize that quality deviations occur in a business of our volume; our tolerance is a customer complaint rate below 12 per million units, no more than two public recalls a year and none for the same root cause, and every recall executed to the trace-back standard within 24 hours. We accept the cost of holding stock for testing over the cost of speed to shelf. Owner: Quality Director; complaint and hold metrics monthly to the executive, recalls to the board as they occur, re-approval annually with the operating plan.”
Decision it changes: the Friday afternoon release of a held batch that a large customer is waiting for. The statement makes the release a two-signature decision with a record rather than a plant manager’s judgment under pressure, and the two-recall tolerance with the same-root-cause clause makes the second recall a board matter rather than a repeat of the first. The recall clause is also the criteria an audit of the recall procedure tests against, which is what an appetite statement is for.
Service delivery and public trust (a public body administering benefits): “We accept the risk of paying some claims that later prove ineligible in order to pay eligible claimants on time, because late payment does more harm to the people we serve than overpayment does to the public purse: our tolerance is that 95 percent of complete claims are paid within 10 working days, and that overpayment stays below 1.5 percent of payments by value with recovery pursued in every case above the de minimis. We do not accept any decision made without a recorded reason, any data shared outside the statutory gateway, or any service change that reduces access for claimants who cannot use digital channels. Owner: Director of Operations; timeliness and overpayment reported monthly to the executive and quarterly to the audit and risk committee; re-approval annually with the corporate plan.”
Decision it changes: the verification step that would push timeliness below 95 percent to shave overpayment from 1.4 to 1.1 percent. The statement has already ranked the two harms, so the operations director can decline the extra check by reference to the board’s own sentence, and the audit and risk committee can see, in the same quarterly report, that both metrics sit inside the bands it approved. Public bodies often believe appetite is a private-sector idea; the two-harms sentence is the most useful thing a public board can write down, because without it the organization drifts toward whichever harm was in the newspaper most recently.
Board mechanics: approval, breach, and review
Three mechanics keep the framework alive. Approval with teeth: the board approves the statement annually alongside strategy — not as a consent-agenda item — and the approval session includes the year’s tolerance performance: where the organization actually ran versus each band. Appetite is the board’s property; the ritual of re-approval is how it stays owned rather than inherited. Breach as process, not scandal: a tolerance breach is the framework working — it triggers the defined escalation, a decision (reduce exposure, accept temporarily with expiry, or change the tolerance deliberately), and a record. An organization whose statement has never been breached is running either miraculous risk management or unmonitored metrics; audit can tell the difference in an afternoon. Review against reality: the annual refresh asks whether the numbers still fit the strategy and the capacity — after the acquisition, after the rate cycle turned, after the new regulation landed — and versions the changes, because “the tolerance quietly moved from 1.2% to 1.8% sometime last year” is exactly the governance failure the framework exists to prevent.
How internal audit tests an appetite framework
Five tests, in escalating order of interest. (1) Existence and anatomy: statements exist per material risk type and carry the five parts — the ten-minute check. (2) Ladder integrity: trace tolerances to appetite and a sample of operational limits to tolerances; hunt orphan limits and orphan appetite. (3) Monitoring reality: the metrics are produced, reviewed, and accurate — reperform a quarter’s tolerance report from source data (the discipline of our model workpaper applies verbatim). (4) Breach behavior: pull every boundary touch in the period and test the escalation actually fired, a decision was recorded, and expiry dates on temporary acceptances were honored — then check the mirror image, per Standard 11.5: any risk acceptances beyond appetite that never reached the board. (5) The decision test itself: interview the deal committee, the product council, the CIO — ask for the last decision the appetite statement changed. Document the answers verbatim. A framework that fails test five while passing one through four is a beautifully monitored irrelevance, and that — written as a program-level finding on the 5 C’s chain — is a report the board will actually discuss. The annual audit risk assessment should consume the same tolerance data from the other side: entities running hot against appetite are arguing for audit attention.
Risk acceptance against appetite: the process that keeps the statement honest
Every appetite framework meets the same moment: an exposure has run past a tolerance, or an audit finding has shown that a control the tolerance depends on is not operating, and management would rather live with it than fix it. What happens next decides whether the statement means anything. The risk acceptance guide gives the full process; the table sets out who may accept what, against the ladder, and what the record has to show, with internal audit’s duty under Standard 11.5 at the bottom rung.
| Situation | Who can accept | Record required | Expiry and review | Internal audit’s role |
|---|---|---|---|---|
| Exposure inside tolerance, above an operational limit | The limit’s owner, within delegated authority | The limit exception log: amount, reason, mitigants, date | Next limit review; expires with the transaction or in 90 days | Test that exceptions are logged and within authority; report patterns |
| Exposure above tolerance, inside appetite | The executive risk committee, on the tolerance owner’s paper | The breach log: the decision (reduce, accept temporarily, re-tolerance), rationale, owner, date | A stated expiry of no more than two quarters; re-decision required at expiry | Test that every touch escalated and every acceptance carries an expiry that was honored |
| Exposure above appetite, or a tolerance to be widened | The board or its risk committee only | A board paper with the capacity check, the strategy linkage and the versioned change to the statement | Until the next annual re-approval, then re-affirmed or reversed | Verify the change is versioned; report silent recalibration as a finding |
| An audit finding rated High or above that management declines to remediate | Senior management, in writing, after discussion with the CAE | The risk acceptance record: the finding, the exposure against the tolerance it affects, the rationale, the accepting executive, the review date | Reviewed at each follow-up; re-accepted or remediated at the review date | Standard 11.5: if the CAE concludes management has accepted a risk beyond appetite, the CAE discusses it with senior management and, if unresolved, communicates it to the board |
| Anything accepted without a record | Nobody | — | — | Report as an acceptance that bypassed the framework, whatever the size |
The fourth row is where the appetite framework and the audit function meet, and it is worth reading against the severity matrix: the impact anchors that rate a finding are inherited from the same tolerances, so a High finding is, by construction, an exposure the board has already said it does not want. Management can still accept it, with a record, an expiry and a name; what management cannot do is accept it quietly, and the CAE’s escalation duty exists precisely so that the quiet path is closed. An accepted risk changes the response to the finding, never the finding’s rating, and the acceptance shows in the appetite report as a red cell with a decision attached rather than a red cell with nothing.
The one-page appetite report to the board
The annual re-approval and the quarterly review both run off the same page, and the page is the framework made visible: one row per statement, the tolerance, where the organization actually ran, the trend, the status against the band and the decision attached to any red cell. The rows below use the example statements on this page for one imagined quarter; the point is the columns, and in particular the last one, which is empty only when the status is green.
| Risk type | Tolerance | Actual, quarter end | Trend | Status | Decision and owner |
|---|---|---|---|---|---|
| Credit | Net charge-off at or below 1.2 percent; escalate at 0.9 percent; single name at or below 2.5 percent of capital | 0.7 percent; largest single name 2.3 percent | Charge-offs stable; concentration rising for two quarters | Green, watch on concentration | Pipeline review of the largest name; CCO, next quarter |
| Liquidity | Stressed survival at or above 90 days; escalate below 105; liquid assets at or above 115 percent of stressed outflows | 112 days; 121 percent | Horizon shortened from 124 days as the wholesale book grew | Green | None required; growth plan already re-shaped in Q1 |
| Operational | Availability at or above 99.95 percent; single loss below $500,000; aggregate below $3 million | 99.91 percent in one month; largest loss $140,000; aggregate $1.1 million | One breach month after a release during a freeze | Amber, breach logged | Risk Committee paper delivered; release governance strengthened; COO, closed |
| Compliance | Self-identified errors at or above 80 percent; no repeat root cause; zero willful violations | 86 percent self-identified; one repeat root cause in complaints handling | Improving on self-identification | Amber on repeat cause | Root cause remediation accepted with 60-day expiry; CCO |
| Cyber and technology | Critical vulnerabilities within 14 days; none beyond 30; recovery tested twice yearly | Median 9 days; two instances beyond 30 days at a third party | Third-party remediation slower than internal | Red, breach logged | Exposure accepted for one quarter with compensating monitoring, expiry recorded; CIO; board informed |
| Strategic and M&A | No transaction above 15 percent of enterprise value; one major integration at a time | One integration in progress; second target deferred | Deferral held despite pressure | Green | None; deferral recorded as the decision the statement changed |
Two features make the page work. Every red or amber cell has a decision and a name beside it, which is the breach-as-process mechanic from the board section rendered as a column; a page where red cells sit alone is the breach-amnesia failure mode in printable form. And the trend column reports direction, not just position, because a green cell moving toward its boundary for three quarters is the conversation the board should be having before the cell turns amber. The audit committee presentation guide shows where this page sits in the committee pack.
The five audit tests as a work program
The five tests above, written as procedures with populations, criteria, evidence and hours, in the format the work program guide prescribes. Budget for a framework covering six to eight risk types in a mid-sized organization: about 120 field hours, most of them in tests 2 and 3.
| # | Procedure | Criteria | Evidence | Hrs |
|---|---|---|---|---|
| 1 | Obtain the current approved appetite statement and the board minute approving it; for each material risk type in the risk register, inspect the statement for the five parts of the anatomy and record which are present | A statement per material risk type; strategy linkage, direction, a measurable tolerance, an escalation trigger, an owner and cadence | Anatomy grid, one row per risk type, with the missing parts named | 8 |
| 2 | For every tolerance, trace it to the appetite statement it implements; select 25 operational limits from credit policy, the delegation of authority table, product criteria and system configurations, and trace each to a tolerance; list every limit with no parent and every tolerance with no limit beneath it | Strict nesting: limits inside tolerances, tolerances inside appetite, appetite inside capacity, with headroom | Traceability matrix; the orphan lists | 30 |
| 3 | Select one quarter’s tolerance report; re-perform each metric from source data (loan system, incident database, vulnerability scanner, complaints system); compare to the reported figure and explain every difference | Reported figures reproduce from source within a stated tolerance; the report is reviewed by someone who did not prepare it | Re-performance workpaper per metric, with the source extracts reconciled | 36 |
| 4 | From the full period’s metric history, identify every touch of an escalation threshold; for each, inspect the breach log for the escalation, the decision, the record and the expiry; inspect every temporary acceptance for re-decision at expiry; separately, obtain the risk acceptance register and audit issue log and identify any acceptance beyond appetite that did not reach the board | Every touch escalated within the stated clock; every acceptance recorded with an expiry that was honored; nothing beyond appetite accepted below board level | Breach test schedule; acceptance test schedule; the Standard 11.5 list, if any | 24 |
| 5 | Interview the chairs of the credit, product and investment committees and the CIO; ask each for the last decision the appetite statement changed; corroborate each example to committee minutes; record the answers verbatim | At least one corroborated example per committee within the period | Interview notes with minute references; the list of committees with no example | 16 |
| 6 | Consolidate exceptions, draft findings in five-C form at program level, hold the closing meeting with the CRO, and prepare the board summary | — | Report; issue log entries | 10 |
Procedure 5 is the one functions skip because it feels soft, and it is the one that produces the finding boards remember. Write it up on the five C’s chain at program level: the condition is the number of committees that could not name a decision, the criteria is the board’s own purpose statement for the framework, the cause is usually the untranslated statement from the failure-mode table, the consequence is that the board’s risk choices are not reaching the decisions that take risk, and the corrective action is the cascade, with owners and dates. The same tolerance data belongs in the audit risk assessment, where the entities running hot against their bands become the engagements on next year’s plan.
The failure modes
| Failure mode | What it looks like | The tell |
|---|---|---|
| Aspirational wallpaper | Eloquent values prose, no metrics, no owners | Nobody can name a decision it changed |
| Zero-appetite inflation | “Zero appetite” for six unavoidable risks | Daily operations breach the statement by existing |
| Orphan limits | Desk limits with no traceable tolerance parent | “That limit has always been 10” — no one knows why |
| The untranslated statement | Board prose never cascaded into policy or systems | First-line managers have never seen it |
| Breach amnesia | Tolerances exceeded; nothing escalated, nothing recorded | Metrics deck shows red cells with no minutes attached |
| Silent recalibration | Tolerances widened to fit performance, unversioned | This year’s band would not have contained last year’s approved one |
| Set-and-forget | Statement unchanged through acquisition, rate cycle, and reorg | Document metadata: last substantive edit three strategies ago |
Final Thoughts
A risk appetite statement is a promise about which risks the organization will hunt and which it will refuse, and like any promise, it only exists in the keeping. Build the ladder so limits trace to tolerances and tolerances to approved appetite, with headroom at every rung; write metrics an auditor could re-perform; treat breaches as the system operating and acceptances as decisions with names and expiry dates; put the whole thing on one page the board reads every quarter; and retire the zero-appetite theater. Then apply the only test that matters, regularly and on the record: name the last decision this document changed. For the operating machinery underneath, how the organization discovers what its risks actually are before deciding its appetite for them, continue to the sibling guide on running an RCSA that is not theater, and for the full risk landscape, the Risk Library is the map.
Where to go next
The appetite framework touches the audit function at three points. The risk acceptance guide is the process for the moment an exposure runs past tolerance and management wants to keep it; the severity matrix is where the tolerances become the impact anchors that rate findings; and the audit risk assessment is where the same metrics decide what gets audited. For the risk types themselves, the Risk Management & ERM, Liquidity Risk, Operational Risk and Audit Committee & Board categories hold the rest.
Related guides
- Risk Acceptance by Management — the right process for letting an issue go, with the Standard 11.5 escalation.
- Finding Severity Ratings: The Calibrated Matrix — the anchors inherit their calibration from these tolerances.
- Running an RCSA That Is Not Theater — how the first line finds the controls the tolerances depend on.
- The Risk Register — the register the statements should map to, risk type by risk type.
- The Internal Audit Risk Assessment — consuming tolerance data to build the plan.
- The Audit Committee Presentation Template — where the one-page appetite report sits in the pack.
- COSO’s 17 Principles — risk appetite in the framework’s risk assessment component.
- The Global Internal Audit Standards Reference Map — Standard 11.5 and the board’s responsibilities.
- Internal Audit Work Program: Template and Worked Example — the procedure format the five tests use.
- The Annotated Model Workpaper — the re-performance discipline test 3 applies.
- The 5 C’s of Audit Findings — the program-level finding test 5 produces.
- The IIA’s Third-Party Topical Requirement — the third-party clauses an appetite statement should reach.
- Internal Audit’s Role in Risk Governance and ERM — the wider governance picture.
- How to Run a Fraud Risk Assessment — appetite for fraud risk, done honestly.
- Risk Taxonomy: How to Build One, With a Three-Level Example — building the categories every other risk tool uses.
- Risk Appetite vs Tolerance vs Capacity vs Limits, Explained — the four layers defined and cascaded, with a testable appetite statement
- Designing a KRI Program: Selection, Thresholds, Escalation — turning a metric wishlist into an early warning system with thresholds that trigger action
Leave a Reply