How to Design a Board Risk Appetite Statement That Actually Works

Most risk appetite statements fail one of two audiences. Either they read like a compliance artefact that NEDs quietly ignore, or they contain aspirations so soft that the PRA sends the board back to rework them. The document has to do a harder job: bind executive behaviour, give NEDs a usable challenge tool, and demonstrate to supervisors that the board understands what could break the firm.

Key Executive Takeaways

• A credible risk appetite statement links quantitative limits to strategy and recovery indicators, not to generic risk categories borrowed from a taxonomy.
• The PRA judges the statement by whether it constrains real decisions; NEDs judge it by whether it helps them ask sharper questions in the room.
• Most rework is caused by qualitative statements that cannot be breached, and by metrics with no defined escalation path when amber turns red.

Start with the decisions the statement must govern

Before drafting anything, list the actual decisions the appetite should shape over the next twelve to eighteen months. New product approvals. Concentration in a specific sector. Outsourcing decisions. Capital distribution. If a proposed metric would not change the answer to any live decision, it does not belong in the statement.

This is where most firms go wrong. They start from a risk taxonomy and populate each category with a metric, producing a document that is comprehensive but inert. The PRA has become adept at spotting this. Supervisors will ask the Chair or SMF4 to describe a recent decision the appetite constrained. If the answer is vague, the statement is treated as ornamental.

Calibrate the metrics against recovery, not just plan

Each quantitative limit should sit on a defined scale between business as usual, early warning, appetite breach, and recovery trigger. The PRA expects to see the arithmetic linking appetite thresholds to ICAAP or ILAAP stress outputs and to recovery plan indicators. If your capital appetite is set at a CET1 ratio that sits comfortably above the recovery trigger with no intermediate action point, the statement is not doing work.

Good practice: for every headline metric, define what happens at amber (management action, notification to CRO), at red (board notification, remediation plan with timeline), and how it connects to the recovery indicator suite. Bad practice: three-colour dashboards with no defined consequence.

Write qualitative statements that can actually be breached

"We have zero appetite for conduct failings" is not a risk appetite statement. It is a slogan. NEDs cannot use it to challenge, and executives cannot be held to it because no threshold defines breach.

Rewrite each qualitative statement so that a breach is observable. "We have no appetite for systemic customer harm, defined as any issue affecting more than X customers or requiring redress above £Y, and any single incident meeting this threshold triggers a board notification within 48 hours." That version does work in the room.

Design for NED usability

NEDs typically see the statement quarterly and need to form a view in minutes, not hours. Two things help: a single-page dashboard showing position against appetite for the top eight to ten metrics with trend, and a short commentary from the CRO explaining any amber or red position and management response. Avoid burying the position inside a forty-page risk report.

Ask your NEDs what would help them challenge better. Most will say they want to know which metrics are moving, why, and what management is doing about it. They rarely ask for more metrics.

Anticipate the PRA's specific tests

Supervisors will probe: How does the appetite connect to strategy and business plan assumptions? When was it last recalibrated, and what changed? Can you show a decision that was declined or reshaped because of appetite? How does the board challenge the CRO on the calibration itself, not just on breaches?

Have the evidence ready in board minutes. If the minutes show the statement was tabled and approved without substantive debate, that becomes the finding.

The next decision

Before your next board risk committee, pull the current statement and mark every metric with the last real decision it influenced. If more than a third have no answer, the statement needs rebuilding, not refreshing. That is the conversation to have with the Chair now, not after the next supervisory letter.

Frequently Asked Questions

How often should the risk appetite statement be recalibrated?

At least annually, aligned to the strategic planning cycle, with interim recalibration triggered by material changes in business mix, capital position, or the external environment. The PRA expects to see evidence of active recalibration, not rolling forward.

Should risk appetite sit at group or entity level?

Both, but the entity-level statement must be genuinely calibrated to the entity's risk profile and capital position, not a proportional slice of group. Supervisors challenge cascaded statements that show no local calibration judgement.

How many metrics is the right number?

Eight to twelve headline metrics for board-level appetite works for most mid-sized firms. Below that risks omission of material risks. Above that dilutes focus and NEDs stop engaging with individual thresholds.

What is the biggest drafting error?

Conflating limits with appetite. A limit is a control set by management. Appetite is the board's expression of tolerance that sits above the limit framework. If the statement reads like a limit schedule, the board has not done its job.