Risk Appetite Statement

It covers every material risk type, not only compliance. A typical statement opens with a few principles, then sets appetite for each category, such as credit, market, operational, conduct, cyber and compliance. Each category has qualitative wording like “low appetite” or “no appetite”, plus metrics with thresholds, often with early-warning triggers. It links to the strategy and business plan, and cascades into risk limits for business units. The board reviews it at least yearly or when strategy shifts, and management reports against it at each risk committee. Supervisors in banking and insurance expect one. Weak statements are vague slogans (“we are prudent”) that cannot be tested; good ones let a manager tell whether a decision is inside or outside. Supervisors reviewing governance usually ask for this document first and then check whether the reported figures follow it.

A mid-sized insurer's statement gives it a low appetite for catastrophe losses and no appetite for breaches of sanctions law. For the first, it says a one-in-200-year event may cost no more than 10% of capital. Each quarter the risk function reports the current figure, 8.5%, and warns that planned coastal growth would take it past the limit.