01
Why most statements fail to influence behaviour
Three failure patterns recur. The statement is written in language too general to be breached — 'we have low appetite for operational risk' cannot be tested. It is expressed only at the enterprise level, so no business leader can tell whether a specific decision is inside or outside it. Or it is monitored on a reporting cycle so slow that a breach is reported long after the decision that caused it.
The remedy is not longer prose. It is a shorter statement supported by a small set of measurable, cascaded thresholds that people actually encounter in their work.
02
Structure: qualitative anchors, quantitative teeth
- A concise set of qualitative statements per risk category, expressing what the institution will and will not do
- Two to four quantitative metrics per category, each with a target, a tolerance range and a hard limit
- Zero-tolerance categories stated explicitly, with the conduct expectations that follow
- Explicit linkage to strategy: which objectives require which risk to be taken
03
Cascade the appetite into mandates people hold
Enterprise thresholds must be translated into business-line, portfolio and product-level limits, and then into the delegated authorities under which decisions are actually made. When credit, operational, technology and conduct limits appear in the same delegation matrix that governs approvals, appetite becomes a control rather than a commentary.
This cascade is also where inconsistency becomes visible. If the sum of business-line limits materially exceeds the enterprise limit, the framework is not calibrated — it is aspirational.
04
Instrument it: triggers before limits
Well-designed frameworks escalate before a limit is breached. Early-warning triggers set inside the tolerance range give management time to act while options remain inexpensive. Each trigger should name the recipient, the required response and the timeframe.
- Defined green, amber and red bands for every quantitative metric
- Named escalation owner and response window for each band
- Pre-agreed approval authority for temporary tolerance, with expiry
- Breach register with root cause, action and closure evidence
05
Reporting the board can challenge
Effective appetite reporting is short, comparative and forward-looking: current position against tolerance, direction of travel, breaches and near-misses, actions in flight, and the decisions management is asking the board to sanction. Dashboards that report only current status invite acceptance rather than challenge.
06
Use it in the moments that matter
- New product and material change approvals tested explicitly against appetite
- Strategic initiatives and acquisitions assessed for appetite consumption, not only return
- Budget and capital allocation informed by where appetite is already fully used
- Incentive and performance frameworks aligned so adherence is rewarded
What good looks like
- A statement short enough to be read and specific enough to be breached
- Metrics with targets, tolerances and limits cascaded to business mandates
- Triggers that escalate before limits, with named owners and timeframes
- A breach register with root cause and closure evidence reported to the board
- Annual recalibration aligned to strategy, capital and resilience planning
- Documented evidence that appetite shaped at least some material decisions
This article reflects common governance practice for Canadian regulated institutions. Specific expectations vary by regulator, charter and risk profile — confirm with counsel and your principal regulator.
Frequently asked questions
What is the difference between risk appetite, tolerance and limits?
+
Appetite is the board's expressed willingness to take risk in pursuit of strategy. Tolerance is the acceptable variation around that appetite before action is required. Limits are the specific, measurable thresholds cascaded into business lines and monitored operationally. A statement without cascaded limits cannot influence decisions.
Who owns the risk appetite statement?
+
The board approves it, typically on the recommendation of the risk committee. The Chief Risk Officer owns its development, calibration and monitoring, and business leaders own adherence within their mandates. Internal audit provides independent assurance over the framework and its operation.
How often should risk appetite be reviewed?
+
At least annually, aligned to the strategy and planning cycle, with out-of-cycle review after a material change in strategy, risk profile, regulatory expectation or operating environment.
How should breaches be handled?
+
Define escalation paths and timeframes in advance: who is notified, who can approve temporary tolerance, what remediation is required, and how the board is informed. Breaches handled ad hoc erode the credibility of the whole framework.
How does risk appetite connect to capital and resilience planning?
+
Appetite should be consistent with capital and liquidity planning (including ICAAP or ORSA where applicable) and with disruption tolerances set under operational resilience work. Inconsistent thresholds across those frameworks are a common supervisory finding.