Risk Appetite: The Statement Everyone Writes and No One Uses

RISK MANAGEMENT

Written by: Devensa Advisory

Most organizations have a written risk appetite statement. Few connect it to the decisions it is meant to guide. Source: NC State University ERM Initiative and AICPA, 2025 State of Risk Oversight Report

A risk appetite statement defines how much risk an organization is willing to accept in pursuit of its strategy. Nearly every organization above a certain size has one. Almost none of them use it when an actual decision is on the table. NC State University’s ERM Initiative and the AICPA, in the 16th edition of their annual State of Risk Oversight Report, found that only 30 percent of organizations integrate risk exposure into capital allocation decisions¹, the exact moment a risk appetite statement is supposed to matter.

A Statement, Framed and Filed

The reason is not that organizations write bad risk appetite statements. It is that a risk appetite statement is treated as a governance artifact rather than a decision-making tool. It gets drafted for the board, approved once a year, and then filed alongside the other policies nobody opens between audits. It answers a question, how much risk are we willing to take, in language too abstract to apply to the specific decision sitting in front of a business unit leader on a Tuesday afternoon.

Risk management itself is often reduced to a single artifact this way, whether that is a risk register, a heat map, or the appetite statement. None of those things is risk management. They are outputs of a risk management function that, done properly, sits close enough to strategic decisions to actually shape them, and that requires more than a document, it requires a person with standing in the room.

What the Research Actually Shows

The 2025 State of Risk Oversight Report surveyed 273 U.S. executives and found that 61 percent report rising risk complexity, yet only 32 percent rate their organization’s risk oversight as mature or robust². Just 11 percent believe their risk management process provides a genuine strategic advantage. The gap between complexity and readiness is not closing on its own.

Gartner’s enterprise risk management research reached a similar conclusion from a different angle: despite real investment in developing risk appetite statements, executives consistently struggle to apply them to actual decisions³. The barrier is not ambition, it is translation, moving from a board-level statement of tolerance to a threshold a business unit leader can act on without escalating every borderline call.

MetricStream’s 2025 research adds the cultural dimension: fewer than half of organizations, 49 percent, say risk awareness genuinely permeates the enterprise⁴, meaning even a well-written appetite statement is landing on an organization where most people below the executive level are not thinking in risk terms day to day.

Only 30% of organizations integrate risk exposure into capital allocation decisions, the exact moment a risk appetite statement is supposed to matter. Source: NC State University ERM Initiative and AICPA, 2025 State of Risk Oversight Report, 16th edition

The Accountability Question a Board Cannot Delegate Away

Boards delegate risk oversight, usually to the audit committee or, in financial services, a dedicated risk committee. That delegation does not remove the board’s own responsibility to confirm that the organization’s risk-taking actually reflects the appetite it approved. A risk appetite statement that sits disconnected from real decisions leaves a board exposed in a specific way: it can point to a document showing it set a boundary, while having no evidence the organization ever operated inside it.

A vCRO closes that exact gap. As a fractional executive on an hours-pooled retainer, the vCRO translates the board-approved appetite statement into thresholds business units can actually apply, builds the escalation path for decisions near the boundary, and reports back to the board on whether the organization’s actual risk-taking tracked the appetite it approved, not just whether the document exists.

Grounding the Statement: Three Lines of Defense and COSO ERM

Three Lines of Defense

The Three Lines model assigns risk ownership clearly: the first line (business operations) owns the risk it creates day to day, the second line (risk and compliance functions) sets standards and monitors, and the third line (internal audit) provides independent assurance. Risk appetite statements usually fail at the handoff between the first and second lines, where a board-level tolerance has to become an operational threshold the first line can apply without calling the second line every time.

COSO ERM

COSO’s Enterprise Risk Management framework explicitly positions risk appetite as integral to strategy setting, not a separate compliance exercise. COSO’s own guidance is direct on this point: risk appetite is not a stand-alone activity, and an organization’s choice of strategy requires an understanding of the appetite for risk that supports it, not the reverse. A statement drafted after the strategy is set, rather than as part of setting it, is already disconnected from the decisions it is meant to guide.

The TruMaturity™ Assessment scores Risk Management as one of six governance domains against the CMMI maturity scale, from Initial through Optimized. An organization with a polished, board-approved appetite statement that no business unit actually references in decision-making typically scores in the middle of that scale at best, because the assessment measures whether the appetite is operational, not whether the document exists.

What Makes a Risk Appetite Statement Usable

• Quantified thresholds by risk category, not general language about being risk-aware or risk-averse.
• A defined escalation path for decisions that approach or cross a threshold.
• Explicit linkage to capital allocation and major strategic decisions, not just to the risk register.
• Ownership by a named function, not the board alone, for translating appetite into operational limits.
• A review cycle tied to strategy refreshes, so the appetite statement changes when the strategy does.

Making the Statement Do Its Job

1. Rewrite vague appetite language into quantified thresholds for the organization’s three or four most material risk categories.
2. Build the escalation path first. A threshold with no defined next step is a line nobody knows how to act on.
3. Attach the appetite statement to the capital allocation and major decision process directly, so it is consulted at the decision, not reviewed afterward.
4. Assign a named owner, distinct from the board, responsible for keeping the statement operational between annual reviews.
5. Test it against a real recent decision. If the appetite statement would not have changed how that decision was made, it is not yet usable.

Frequently Asked Questions

What is the difference between risk appetite and risk tolerance?

Risk appetite is the broad amount and type of risk an organization is willing to accept in pursuit of its objectives. Risk tolerance is the acceptable variation around a specific objective or metric, a narrower and more operational concept. A usable risk appetite statement typically translates into several specific tolerance thresholds.

Why do most risk appetite statements fail to influence decisions?

They are usually written in language calibrated for board approval rather than operational use, and they are rarely connected to a defined escalation process. Gartner’s research on enterprise risk management found this translation gap, not a lack of executive commitment, is the primary barrier to executives actually applying appetite statements.

Does every organization need a formal risk appetite statement?

Any organization making material strategic decisions benefits from one, but the format should match the organization’s size. A mid-market company does not need a financial-services-style multi-page document, it needs quantified thresholds for its handful of most material risks and a clear owner for keeping them current.

How often should a risk appetite statement be updated?

At minimum whenever the organization’s strategy is refreshed, since COSO’s framework treats appetite as integral to strategy setting rather than a separate annual exercise. An appetite statement that has not changed in several strategy cycles is a signal it was never operational to begin with.

Who should own translating risk appetite into operational limits?

A dedicated risk management function, often led by a vCRO in organizations without an internal Chief Risk Officer, should own this translation, working with business unit leaders to set thresholds they can actually apply. When was the last time your organization’s risk appetite statement changed an actual decision?

Sources

1. NC State University ERM Initiative and AICPA, 2025 State of Risk Oversight Report, 16th edition — https://erm.ncsu.edu/?p=19095

2. NC State University ERM Initiative and AICPA, 2025 State of Risk Oversight Report, key findings — https://erm.ncsu.edu/?p=19095

3. Gartner, How ERM Can Improve Executives’ Use of Risk Appetite — https://www.gartner.com/en/documents/6392943

4. MetricStream, 2025 research on enterprise risk awareness — https://www.metricstream.com/learn/risk-appetite-statement.html

This article is provided for informational purposes only and does not constitute legal or compliance advice. Consult qualified counsel before making governance decisions.