Risk appetite is the amount and type of risk an organisation is willing to take on to achieve its objectives. It is approved by senior management or the board, it is expressed by risk category and it works as a yardstick: every residual risk is compared with it to decide whether it is accepted or needs treatment.
It nearly always comes with two other concepts that people mix up with it. Tolerance is the margin allowed above appetite for a period of time and with a justification. Capacity is the most the organisation can bear without putting its survival at risk.
Appetite, tolerance and capacity with an example
Think of a bolt factory with a machine that is a few years old. At 100 bolts an hour the machine runs comfortably, rarely breaks down and output covers demand. That is the risk appetite: the level the company is comfortable with.
If demand rises, the company can push the machine to 150 bolts an hour. The likelihood of a breakdown rises considerably, but it is accepted for a specific peak season and under close watch. It is above appetite and within tolerance. At 200 bolts an hour the machine runs at its limit and a breakdown could stop the plant for weeks: that is reaching capacity, and most companies would turn those orders down rather than take the chance.
Dropping to 60 bolts an hour is not a good idea either. The risk of a breakdown almost disappears, but the company can no longer fill its orders. An appetite that is too low has a cost too, which is why the goal is not to bring every risk down to zero.
ISO's risk management vocabulary, ISO Guide 73:2009, defines risk appetite as the amount and type of risk that an organisation is willing to pursue or retain. The 2017 COSO ERM framework puts it in similar terms: the types and amount of risk, on a broad level, that an entity is willing to accept in pursuit of value.
Tolerance is where it gets muddier. COSO defines it as the boundaries of acceptable variation in performance against an objective, while ISO Guide 73 talks about the readiness to bear the risk after treatment. In our view, which one you choose matters less than your methodology stating which one it uses and every area applying it the same way. A risk committee that mixes the two ends up arguing about words instead of risks.
How to write a risk appetite statement
Risk appetite is documented in a statement approved by the governing body. The most useful format sets, for each risk category, a level (very low, low, moderate, high) and at least one metric with a limit. The level gives direction and the metric lets you decide.
| Category | Appetite | How it is measured |
|---|---|---|
| Regulatory compliance | Very low | No final sanctions. No non-compliance left open for more than 90 days after it is detected. |
| Cybersecurity | Low | No residual risk above 12 on a 5 × 5 matrix. Critical vulnerabilities fixed in under 30 days. |
| Business continuity | Low | No critical process down for longer than its approved recovery time. |
| Credit | Moderate | Bad debt losses below 1.5% of annual revenue. |
| New products | High | Up to 10% of annual investment in projects that may not succeed. |
The figures in the table are an example; each organisation's come from its strategy, its regulation and its financial position. What does repeat across all of them is the format. A statement that only says “we have a low appetite for risk” does not help anyone decide anything, because nobody can check whether a given risk is inside or outside it.
It also makes sense for appetite to differ by category. A company may accept almost no compliance risk and, at the same time, accept a fair amount of uncertainty in innovation. A single appetite for everything usually ends up too strict for some areas and too loose for others.
From risk appetite to the risk matrix
For appetite to be used day to day, it has to be translated into the scale used to score risks. On a likelihood by impact matrix you draw an appetite line (below it is the acceptable level of risk) and a tolerance line. The residual risk of each risk falls into one of the three zones, and that decides what is done with it.
- Within appetite. It is accepted and monitored. No treatment plan is needed.
- Between appetite and tolerance. It needs a treatment plan with an owner and a date, or an acceptance signed by the risk owner explaining why it is being taken on.
- Above tolerance. It is always treated. If for some reason that is not possible, acceptance is decided by the management committee, not by the business area.
The lines do not have to be straight or the same for every category. Many organisations are stricter with very high impact risks even when their likelihood is low, and reflect that by lowering the line in the impact 5 column.
What to consider when setting it
- Financial position. How much the organisation can lose without compromising its results, its solvency or its liquidity. This is almost always where capacity comes from.
- Strategy. A growing business line can take more risk than a mature one. The expectations of shareholders, customers and regulators count too.
- Resources. The people, systems and time available to manage the risk being taken on. Accepting risk without the means to monitor it is not appetite, it is carelessness.
- Regulation. In some areas the appetite is already set for you: there are legal obligations that leave no room for manoeuvre.
Mistakes that make risk appetite useless
- Writing it and filing it away. If nobody compares risks with the appetite when scoring them, the statement is just another document. It has to be built into the risk assessment methodology and the committee reports.
- Not reviewing it. Appetite changes when the strategy changes, a new regulator comes in or the company grows. A sensible approach is to review it at least once a year, alongside the strategic plan.
- Setting it without senior management. If the risk team writes it on its own, management does not feel it owns it and does not apply it when making business decisions.
- Not linking it to indicators. Without metrics that give warning, the organisation finds out it has exceeded its appetite after the fact.
How it is monitored
Risk appetite is monitored with key risk indicators (KRIs). Each indicator has thresholds aligned with what you have already defined: amber triggers as you approach appetite and red when you reach tolerance. That way the committee sees the trend before the risk materialises. You will find example indicators in the four types of KRI for your risk map.
In the GlobalSuite® Risk Management module the acceptable level is part of the methodology: risks above it show up in red on the heat map without anyone having to look for them, and KRIs have alert thresholds that warn you before you get there. If you want to see it with your own appetite statement, request a demo.
Sources: ISO Guide 73:2009, Risk management. Vocabulary and COSO, Enterprise Risk Management: Integrating with Strategy and Performance (2017). The example and the figures in the table are illustrative. Published in April 2020, content reviewed in October 2026.
