Risk appetite statement: 15 examples and a template
Most risk appetite statements say the organisation has “a low appetite for compliance risk” and stop there. That sentence cannot be measured, so it never changes a decision. Here is how to write one that does — with 15 worked examples you can adapt.
A risk appetite statement sets out how much risk, and of what kind, an organisation is willing to take to achieve its objectives. A useful one gives each risk category a stance (from averse to eager), a metric, an appetite threshold, a tolerance limit and an owner — so anyone can check whether a risk is inside appetite, inside tolerance, or outside it.
What a risk appetite statement is for
A risk register tells you what could go wrong. A risk appetite statement tells you how much of it you are prepared to live with. Without it, every score on the risk matrix is just a colour: nobody knows whether a “significant” cyber risk is acceptable for a business that runs on online sales, or whether a “moderate” compliance risk is already too much for a regulated firm.
The statement does three practical jobs:
- Prioritisation. Risks outside appetite get treatment plans first, whatever their raw score.
- Delegation. Managers can take decisions within appetite without escalating every one.
- Accountability. The board agrees in advance what “too much risk” means, so it is not argued case by case after something goes wrong.
Appetite is not the same in every area. Most organisations are happy to take product or market risk to grow, and want close to zero risk in health and safety or regulatory compliance. A single overall line (“we have a moderate appetite for risk”) hides exactly the differences that matter.
Appetite vs tolerance vs capacity
These three terms are often used interchangeably. They are not the same, and keeping them apart is what makes the statement usable.
| Term | Meaning | Example: customer concentration |
|---|---|---|
| Risk appetite | The level of risk you are comfortable taking in normal conditions | No single customer above 15% of revenue |
| Risk tolerance | The acceptable deviation from appetite: the outer limit that triggers escalation and action | Up to 25% for no more than two quarters, with a diversification plan |
| Risk capacity | The maximum loss or exposure the organisation could absorb before it fails or breaches its obligations | Losing a customer worth more than 40% of revenue would breach banking covenants |
Read together they give a risk three states: within appetite (carry on), within tolerance (watch, owner acts), outside tolerance (escalate now). Appetite should always sit comfortably below capacity — the gap is your safety margin.
The anatomy of a good statement
Each line of a usable statement has five parts:
- Category — the type of risk, matching the categories in your risk register.
- Stance — a qualitative level of appetite and one sentence explaining why.
- Metric — something you already measure, or can start measuring cheaply.
- Threshold — the appetite level and the tolerance limit for that metric.
- Owner — the executive who reports against it and acts when it is breached.
For the stance, a five-level scale works well. It is used widely in the UK public sector and is easy to explain to a board:
| Level | What it means in practice |
|---|---|
| Averse | Avoid the risk. Safety and certainty come first, even at a cost to opportunity. |
| Minimal | Accept only very low residual risk, with strong controls and little potential for reward. |
| Cautious | Prefer safe options; accept some risk where the benefit is clear and the downside limited. |
| Open | Willing to consider all options and accept risk for a reasonable reward, with controls in place. |
| Eager | Actively seek the risk for higher reward; innovation and speed matter more than certainty. |
The stance on its own is not enough. “Cautious” means different things to a finance director and a product lead. The metric and threshold are what turn it into something you can check every month.
15 risk appetite statement examples
The examples below are written for a fictional UK services and e-commerce business with around £25m revenue. They are illustrations, not recommendations: your thresholds should come from your own strategy, finances and history. Tolerance limits are shown after the slash.
| Category | Level | Statement | Metric: appetite / tolerance |
|---|---|---|---|
| 1. Strategic | Open | We will take considered risks to enter new markets and launch new services where the expected return justifies the investment and failure would not threaten the core business. | Capital committed to unproven ventures: ≤ 10% of annual profit / ≤ 15% |
| 2. Financial | Cautious | We accept normal trading volatility but will not take positions that put our ability to meet commitments at risk. | Net debt to EBITDA: ≤ 1.5× / ≤ 2.0× |
| 3. Credit and liquidity | Minimal | We maintain enough cash to operate through a severe downturn and extend credit only to customers we have assessed. | Months of fixed costs held in cash: ≥ 4 / ≥ 3. Debt over 90 days: ≤ 3% of receivables / ≤ 5% |
| 4. Operational | Cautious | We accept occasional minor disruption but not outages that stop customers from ordering or receiving service. | Unplanned downtime of customer-facing systems: ≤ 4 hours a quarter / ≤ 8 hours; no single outage over 2 hours |
| 5. Cyber security | Minimal | We do not accept known, unmitigated vulnerabilities in systems that hold customer or payment data. | Critical patches applied: within 14 days / within 30 days. Staff phishing-test click rate: ≤ 5% / ≤ 10% |
| 6. Data protection | Averse | We will not knowingly process personal data unlawfully and treat any reportable breach as unacceptable. | Breaches reportable to the ICO: 0 / 0 (any breach is escalated to the board within 24 hours). Subject access requests answered within one month: 100% / ≥ 95% |
| 7. Health and safety | Averse | We will not compromise the safety of staff, contractors or visitors to save cost or time. | RIDDOR-reportable incidents: 0 / 0. Lost-time injury frequency rate: ≤ 0.5 / ≤ 1.0 per 200,000 hours |
| 8. Compliance and regulatory | Minimal | We comply with laws and regulations that apply to us and correct any shortfall promptly when found. | Open high-rated audit findings past due date: 0 / ≤ 2. Regulatory fines: £0 / £0 |
| 9. Reputation | Cautious | We accept that some customers will be unhappy but will not take actions likely to cause sustained negative coverage. | Trustpilot or equivalent rating: ≥ 4.3 / ≥ 4.0. Complaints per 1,000 orders: ≤ 5 / ≤ 8 |
| 10. People | Open | We will invest in new skills and roles, but will not allow key capabilities to depend on a single person. | Voluntary staff turnover: ≤ 15% a year / ≤ 20%. Key roles without a trained deputy: ≤ 2 / ≤ 4 |
| 11. Suppliers and third parties | Cautious | We use specialist suppliers where they add value, but only with a tested exit or fallback for those we cannot operate without. | Critical suppliers without a documented alternative: 0 / ≤ 1. Spend with the largest supplier: ≤ 30% of cost of sales / ≤ 40% |
| 12. Projects and change | Open | We take on ambitious change programmes and accept some overrun, provided benefits remain clear. | Budget overrun on major projects: ≤ 10% / ≤ 20%. Delay: ≤ 1 month / ≤ 3 months |
| 13. Environmental, social and governance (ESG) | Cautious | We will meet our published commitments and will not work with suppliers who breach our code of conduct. | Progress against annual emissions target: on track / within 10%. Tier-1 suppliers signed up to our code of conduct: 100% / ≥ 95% |
| 14. Fraud | Averse | We have zero tolerance for fraud by staff and accept only a low, managed level of external payment fraud as a cost of trading online. | Internal fraud cases: 0 / 0. Card chargebacks: ≤ 0.3% of transactions / ≤ 0.6% |
| 15. Product and service quality | Minimal | We do not release products or changes that we know put customers at risk or fail our quality standards. | Returns due to defects: ≤ 1.5% of units / ≤ 2.5%. Severity-1 bugs in production: 0 open beyond 48 hours / 0 beyond 5 days |
Notice the pattern. The categories where the business earns its return — strategy, people, projects — have an open stance. The ones where a single failure could cause lasting harm — safety, data, fraud — are averse, with a tolerance of zero. The ones in between are cautious or minimal, with a gap between appetite and tolerance that gives managers room to act before the board needs to.
Risk appetite statement template
Copy this structure. Keep the overall statement to a paragraph and give each category one row.
1. Purpose and scope. This statement sets out the types and levels of risk [Organisation] is willing to take in pursuit of its strategy for [period]. It applies to [all entities / divisions] and was approved by the [board / risk committee] on [date].
2. Overall statement. [Organisation] will take [open / cautious] risks to [main strategic objective], while protecting [what must not be compromised: e.g. safety, customer data, regulatory standing and liquidity]. We will not accept risks that could [threaten our licence / cause harm to people / reduce cash below X months of costs].
3. Appetite by category. For each category:
Category: [ ] · Level: [averse / minimal / cautious / open / eager] · Statement: [one sentence] · Metric: [ ] · Appetite: [ ] · Tolerance: [ ] · Owner: [role] · Reported: [monthly / quarterly]
4. Breaches and escalation. Within appetite: managed by the risk owner. Within tolerance: owner reports to [executive committee] with an action plan within [X] days. Outside tolerance: escalated to the [board / risk committee] within [X] days.
5. Review. Reviewed at least annually and after any major change in strategy, structure or regulation.
Our free risk register template has a category column you can match to these rows, so every risk in the register can be compared with its category’s appetite.
How to set your risk appetite
- Start from strategy, not from risks. List the three to five objectives for the next few years. Ask where you must take risk to achieve them and where a failure would make them impossible.
- Work out capacity first. How much loss, downtime or customer attrition could you survive? Finance usually has the numbers: cash reserves, covenants, insurance limits. Appetite must sit well below them.
- Draft stances in a workshop. Put the categories on a wall and ask executives to place each one on the averse-to-eager scale independently, then discuss the disagreements. The disagreements are the useful part.
- Choose metrics you already have. Finance, IT, HR and customer service already report dozens of numbers. Pick one or two per category that move when the risk changes. A perfect metric you cannot collect is worse than a decent one you can.
- Set thresholds from history. Look at the last two or three years. Appetite is usually a little better than your typical performance; tolerance sits near the worst level you have lived through without real damage.
- Get board approval. The statement only has authority if the board owns it. Present it with the data behind the thresholds, not just the wording.
- Report against it. Every risk report should show each metric against its appetite and tolerance. If nobody looks at the numbers, the statement is decoration.
Cascading appetite through the organisation
A group-level statement is too broad for a warehouse manager or a project lead. Cascade it:
- Divisions and functions translate the group metrics into their own: group “unplanned downtime” becomes IT’s “availability of the order platform” and logistics’ “days of warehouse closure”.
- Limits and delegations turn appetite into everyday rules: approval limits, credit limits, supplier onboarding checks, change freeze windows.
- Projects inherit the stance for their category and set their own thresholds for budget, delay and quality.
- Individual risks in the register are compared with the appetite for their category. A residual score above appetite needs a treatment plan; one above tolerance needs escalation.
Lower levels can be stricter than the group, never looser. If a division wants more appetite than the group allows, that is a conversation for the board, not a local decision.
A note for Australian regulated entities
APRA-regulated institutions already have a formal requirement here: CPS 220 expects a board-approved risk appetite statement as part of the risk management framework. Since CPS 230 took effect on 1 July 2025, boards must also approve tolerance levels for critical operations — such as maximum outage time and data loss — which work much like the tolerance limits in the examples above. Our CPS 230 guide explains how they fit together.
Common mistakes
- Words without numbers. “Low appetite for reputational risk” cannot be breached, so it never triggers anything. Add a metric even if it is imperfect.
- One appetite for everything. A single overall level hides the trade-offs. Appetite should differ by category.
- Zero everywhere. If every category is averse, the statement is not credible and managers will ignore it. Reserve zero tolerance for safety, fraud, data breaches and the like.
- Appetite equals capacity. Setting the appetite at the point of failure leaves no room to react. Keep a margin.
- No tolerance band. Without one, the only states are “fine” and “breach”, and every small deviation goes to the board.
- Written once, never reviewed. Strategy, size and regulation change. Review at least annually and after major events.
- Not linked to the register. If risks in the register are not compared with appetite for their category, the two documents live separate lives.
Frequently asked questions
What is a risk appetite statement?
A board-approved document setting out how much risk, and of which kinds, the organisation is willing to take to achieve its objectives — ideally with measurable metrics and thresholds for each risk category.
What is the difference between risk appetite and risk tolerance?
Appetite is the level of risk you are comfortable with. Tolerance is the acceptable deviation from it — the outer limit that triggers escalation. Capacity is the most you could absorb before failing.
What are the levels of risk appetite?
A common five-level scale is averse, minimal, cautious, open and eager, from avoiding the risk entirely to actively seeking it for higher reward.
Who approves the risk appetite statement?
The board, usually on the recommendation of the risk or audit committee. Executives propose it; the board owns it.
How long should it be?
Two to four pages is enough for most mid-size organisations: a short overall statement and one row per category.
Appetite and tolerance, tracked for every risk
Risk Samurai keeps appetite and tolerance separately, so each risk shows one of three states — within appetite, within tolerance or outside tolerance — and the ones that need escalation surface on their own. AI drafts your first register in minutes.
Get early access