Plain definition
Risk appetite is the amount and type of risk an organisation is prepared to accept in pursuit of its objectives. It is a strategic choice, not a claim that every risk is desirable. It should reflect purpose, financial capacity, obligations, stakeholders, and the consequences of failure, then guide choices about growth, investment, compliance, safety, and resilience.
A useful appetite is specific enough to influence decisions. Saying “we have low risk appetite” without naming the objective or risk type does not help a manager choose between a faster launch, a higher return, and a greater service or compliance exposure.
Illustrative example
Suppose a retailer considers entering a new market through an untested online marketplace. The board is willing to accept commercial experimentation and a limited marketing loss, but it has little appetite for misuse of customer payment data or breaches of consumer rules. Management approves a small pilot only after the platform passes security and legal checks, sets a spend cap, and defines conditions for stopping the trial.
The appetite does not decide that the project must proceed. It tells management what form of experiment is acceptable and which risks cannot be traded for sales growth. The board can later assess the pilot against the boundaries it set.
Appetite belongs at the level of governance and strategy; managers use it to shape decisions, while tolerance gives more operational thresholds.
Why it matters
It prevents teams from making major trade-offs based only on short-term opportunity or personal comfort with risk.
It gives the board a basis to challenge whether management’s plan fits the organisation’s purpose and capacity.
Practical consequence
Describe appetite by objective and risk type, using language that a decision maker can apply to a real proposal.
Connect it to investment criteria, escalation rules, and board reporting, then review it after material changes in strategy, financial strength, or obligations.