Risk Appetite Statement: How to Write One, with Examples

What is a risk appetite statement?

A risk appetite statement is a short, board-approved document that says how much risk the organisation is prepared to take, by type of risk. A widely used definition comes from ISO Guide 73:2009, which described risk appetite as the amount and type of risk that an organisation is willing to pursue or retain. That guide was withdrawn in 2023 and replaced by ISO 31073:2022, but the definition remains in common use.¹

AS ISO 31000:2018 does not use the term. It asks organisations to define risk criteria, and to specify the amount and type of risk they may or may not take relative to their objectives.² A risk appetite statement is the usual way of doing that.

What is the difference between risk appetite and risk tolerance?

The two terms are often used loosely. In practice they do different jobs.

Who needs a risk appetite statement in Australia?

• APRA-regulated institutions. Prudential Standard CPS 220 makes the board responsible for setting risk appetite and requires it to approve a risk appetite statement, which must set out the appetite, a tolerance for each material risk, and how these are set, monitored and reviewed.³ CPS 230 separately requires tolerance levels for disruption to each critical operation.⁴
• Commonwealth entities. The Commonwealth Risk Management Policy requires a risk management framework, says it should include a risk appetite statement supported by tolerance statements, and makes the accountable authority responsible for determining appetite and tolerance.⁵ Under the PSPF, the accountable authority also determines the entity’s tolerance for security risks and records it in the security plan.⁶
• Everyone else. There is no general legal requirement, but any organisation that assesses risk needs a stated basis for deciding which risks to accept. SA HB 167:2025 includes guidance on developing risk appetite and risk tolerance criteria for security risks.⁷

How do you write a risk appetite statement for security and resilience?

1. Start from objectives. List what the organisation must protect and deliver: people, services, information, assets, legal obligations and reputation.
2. Set the appetite for each category. Use a simple scale, such as averse, cautious and open, and say in a sentence what each means.
3. Add tolerances that can be measured. For example, the longest acceptable outage of a critical service, or the highest residual risk rating that a manager may accept without escalation.
4. Link it to the risk matrix. State which ratings are within appetite, which need treatment, and who can accept each level. The guide to the risk matrix explains how the bands are set.
5. Have it approved and reviewed. The board or accountable authority approves it. Review it at least yearly, and after a serious incident or a major change.

What does a risk appetite statement look like?

A risk appetite does not need to be a long document. A simple way to show it is a set of scales, one for each type of risk, with a marker for where the organisation sits. It lets a board see the whole picture on one page, and it makes the conversation easier for people who are new to the subject.

Each marker is then backed by a short statement. The examples below are illustrations only. Each organisation should write its own.

• Safety of people. The organisation has no appetite for risks that could foreseeably cause serious harm to staff, clients or the public. Risks rated high or above must be treated or escalated to the executive.
• Protective security. The organisation has a low appetite for unauthorised access to its sites and sensitive information. Residual risks rated medium may be accepted by the chief security officer. Higher ratings need executive approval.
• Continuity of critical services. The organisation has a low appetite for disruption. No critical service is to be unavailable for longer than its agreed tolerance.
• Improvement and change. The organisation is open to moderate risk in adopting new security technology, provided it is trialled and reviewed before wider use.

How does risk appetite help security get funded?

Security proposals often stall because they are argued in security terms. A risk appetite statement gives the board its own yardstick. A proposal can then show that a risk sits outside the appetite the board has already approved, what it would cost to bring it back within tolerance, and what remains if the board decides to accept it.

• State the risk in consequence terms, not technical ones.
• Offer staged, costed options, so the board can see what the first step buys.
• Show the residual rating after each option, using the same treatment plan format each time.
• Record the decision, including a decision to accept the risk.

Where the risk involves the safety of workers or others, work health and safety law applies its own test. Under the model Work Health and Safety Act, what is reasonably practicable is decided by weighing the likelihood of the risk, the degree of harm, what is known about it, the ways available to reduce it, and the cost, including whether the cost is grossly disproportionate to the risk.⁸ Appetite cannot be set below that duty.

Common mistakes

• Statements so general that they could not settle any real decision.
• Appetite set for financial risk only, with security and safety left out.
• No measurable tolerances, so nobody can tell when a limit has been passed.
• A statement that is approved once and never used in papers or reports.
• An appetite for safety risk that conflicts with legal duties.

How Agilient helps

Agilient helps boards and executives set risk criteria, appetite and tolerances for security and resilience, as part of security risk assessments and wider reviews. The work is independent of any product, and recommendations are costed so that decisions can be made against the appetite the board has set. The security risk management framework guide explains how appetite fits the wider process, and the free security risk maturity check is a quick way to see where an organisation stands.