Risk Appetite Statement

A risk appetite statement is the governing document that defines how much risk the organisation is willing to take. It is distinct from a risk policy (which describes the process for managing risk) and a risk tolerance (which sets operational thresholds for specific risk categories). A well-crafted risk appetite statement addresses different risk types separately: an organisation might have low appetite for safety risk, medium appetite for programme risk, and higher appetite for commercial risk on innovation projects. These qualitative positions are then translated into quantitative decision rules — confidence levels for funding submissions, escalation thresholds for individual risks, approval authorities for contingency drawdown.

The appetite statement provides the authorising environment for project-level risk decisions. When a project team is deciding whether to fund to P50 or P80, they should be guided by the organisation's stated risk appetite for cost overrun, not by the project manager's personal preference or the finance director's instinct. Without a documented appetite statement, these decisions are made ad hoc, inconsistently, and often under commercial pressure that biases them toward insufficient contingency. The appetite statement makes the decision framework explicit and gives project teams a defensible basis for their recommendations.

A risk appetite statement is only useful if it is current and actively used. Statements that were drafted for a governance audit and never revisited are decorative documents. The statement should be reviewed at least annually, and updated whenever the organisation's strategic context changes significantly — a new contract model, a new funding environment, a change in leadership. More importantly, it should be tested against real decisions: when the board approved a P65 funding level last quarter despite a P80 recommendation, does that decision reflect the stated appetite or challenge it? Post-decision reviews against the appetite statement are what turn it from a governance document into a live management tool.