Contents
Three concepts not to confuse
- Risk appetite: the types and amount of risk the organisation is prepared to accept in pursuit of its objectives. It is a broad orientation.
- Risk tolerance: the acceptable variation in performance around a specific objective. For example, a delivery-time target of 48 hours, with a tolerance of up to 72 hours.
- Risk capacity: the maximum amount of risk the organisation can absorb without jeopardising its survival.
Risk appetite should sit well below risk capacity.
What risk appetite is not
Talking about an appetite for compliance risk does not mean accepting known breaches of the law. It means recognising that the likelihood of a breach can never be reduced to zero, and deciding where to focus prevention and control efforts.
The three inputs
According to COSO's May 2020 publication on risk appetite, three elements inform how it is defined:
- the views of the board and management;
- an understanding of the current risk profile;
- the organisation's culture.
The 7-step method
- Restate the strategic objectives of the organisation for the next two or three years.
- Establish the current risk profile: which major risks, at what level.
- Choose the risk categories to cover: strategic, financial, operational, compliance, reputational, cyber, data.
- Draft a statement for each category, combining qualitative wording with quantified thresholds.
- Set key risk indicators and alert thresholds to monitor each statement.
- Have the statement approved by executive management and the board.
- Cascade and monitor: translate the appetite into operational limits, report on it regularly and review it at least once a year.
Sample statements
| Category | Sample statement | Monitoring indicator |
|---|---|---|
| Integrity | Zero tolerance for corruption in any form | Number of reports received and handled within deadlines |
| Customer concentration | No single customer should account for more than 20% of revenue | Share of revenue from the largest customer |
| Personal data | No processing of customer data without prior formalities with the CNDP (Morocco's data protection authority) | Share of processing operations notified or authorised |
| Continuity | Disruption of critical services limited to 4 hours | Duration of incidents affecting critical services |
| Innovation | Moderate appetite for testing new digital services, within a limited scope | Budget and number of customers involved in pilots |
These examples are illustrative: each organisation sets its own thresholds according to its strategy and capacity.
Common mistakes
- A statement so general that it guides no decision.
- Thresholds set with no link to the company's actual risk capacity.
- A statement approved once, then never reviewed.
- An appetite defined by the risk function alone, without executive management.
Further reading
- 4 min read
- 3 min read
- 4 min read
Frequently asked questions
What is the difference between risk appetite and risk tolerance?
Risk appetite expresses the types and amount of risk the organisation is willing to accept, in broad terms, in pursuit of value. Risk tolerance sets the acceptable variation in performance around a specific objective.
Who should approve the risk appetite?
Executive management and the board of directors, or its risk committee. The risk function prepares the statement, but it cannot set it on its own.
Does an SME need a risk appetite statement?
A simple version is enough: a few sentences for each major risk category, with two or three quantified thresholds. What matters is that the leadership explicitly agrees on what it accepts and what it rejects.
General information, not legal advice.
Report an errorReferences (1)
- COSO (2017). Enterprise Risk Management — Integrating with Strategy and Performance.