How to Design a Board Risk Appetite Statement That Holds Up

Most risk appetite statements fail the same test: they describe risk in language the board does not use, with metrics the business does not manage to, and tolerances that have never been breached because they were set wide enough to guarantee silence. Regulators see this immediately. So do experienced NEDs. A credible statement is one that has visibly shaped at least one difficult decision in the last twelve months.

Start from strategy, not from the risk taxonomy

The common error is to build the statement bottom-up from the risk register: credit, market, operational, conduct, each with a paragraph and a number. The result reads like a compliance artefact because it is one. Start instead with the board's strategic plan. What is the firm trying to achieve over three years? What risks must it take to get there, and which risks would destroy the plan if they crystallised? The appetite statement is the bridge between those two questions.

This matters because supervisors read the statement alongside the ICAAP, ORSA, recovery plan, and strategy pack. Inconsistencies between them are the fastest route to challenge. If the strategy assumes aggressive growth in SME lending but the credit appetite is framed defensively, someone will ask why.

Calibrate tolerances that actually bite

For each material risk, you need a qualitative statement, a quantitative metric, and a tolerance. The tolerance is where most statements lose credibility. Set it by reference to three things: the capital or liquidity headroom you are willing to consume, the historical volatility of the metric, and the point at which management action genuinely changes.

A useful discipline: for every metric, write down what the board will do if the tolerance is breached. If the answer is "note it and ask for a paper," the tolerance is wrong. If the answer is "halt new lending in segment X until root cause is understood," you have a live limit. Supervisors increasingly ask to see the breach log and the minuted response. An empty log alongside a growing book is a red flag.

Separate appetite, tolerance, and capacity

NEDs who have sat on multiple boards will test whether you understand the distinction. Capacity is what the balance sheet and licences permit. Appetite is what the board wants to take. Tolerance is the operating buffer below appetite that triggers management action before the board-level limit is hit. Blurring these produces a statement that either constrains the business artificially or gives management no early warning.

Make the qualitative statements specific

"We have zero appetite for conduct failings" is not a statement, it is a slogan. No firm has zero appetite for conduct risk; every firm accepts some probability of error in exchange for operating at scale. A credible qualitative statement names the behaviours, outcomes, or populations the board will not accept, and connects to measurable indicators: complaint root causes, vulnerable customer outcomes, breach rates in specific processes.

Build the reporting that proves it is live

The statement is only as credible as the monthly or quarterly pack that tracks against it. The pack should show current position, trend, tolerance, and, where relevant, forward-looking indicators. Breaches should be named, not buried. Near-misses should be reported. Where the board has chosen to operate close to a limit, that should be an explicit decision recorded in the minutes, not a drift.

What good looks like

A well-designed statement is short, usually under fifteen pages, written in language a new NED could follow, and linked clearly to the business plan. It has been revised at least once in response to a strategic change or a breach. The CRO can point to specific decisions, a product launch delayed, a counterparty limit reduced, a hiring plan paused, that were shaped by it.

Next step

Before the next board cycle, take your current statement and test it against one question: in the last four quarters, what did we decide differently because of this document? If you cannot answer concretely, the recalibration work starts there.

Frequently Asked Questions

How often should the statement be reviewed?

Annually as a minimum, and whenever strategy, risk profile, or operating environment shifts materially. A statement that has not changed in three years while the business has grown or pivoted invites challenge.

Who should draft it?

The CRO owns the drafting, but the content must be shaped by the CEO, CFO, and business heads, and tested with the Chair and Risk Committee Chair before it reaches the full board. A statement drafted in isolation by the risk function rarely survives contact with the business.

How detailed should quantitative metrics be?

Detailed enough to be measurable and monitorable, but not so granular that the board is reviewing operational KPIs. A good rule: if the metric would normally sit in a management dashboard rather than a board pack, it belongs in the risk framework beneath the appetite statement, not in the statement itself.

What do supervisors most often challenge?

Three things: tolerances that have never been breached, qualitative statements that are not measurable, and inconsistency between the appetite statement and the capital, liquidity, or recovery planning documents. Address these before the next supervisory engagement.

How does this interact with SMCR accountability?

Senior Managers with risk-related prescribed responsibilities should be able to explain how the appetite statement shapes decisions in their area. If the CRO or business SMF cannot articulate this in an interview, the framework is not embedded.