Boards rarely struggle to say they support growth. The harder task is stating, in plain terms, how much uncertainty the organisation is prepared to accept while pursuing it. That is where risk appetite statement examples become useful. They show how to translate broad ambition into boundaries that management can apply, monitor and defend.
A risk appetite statement should not read like a generic policy paragraph. It needs to give decision-makers enough direction to act consistently across strategy, operations, compliance and incident response. If the wording is too vague, teams interpret it differently. If it is too rigid, management loses room to respond to changing conditions. The practical standard sits somewhere in between.
What strong risk appetite statement examples have in common
The best statements are specific about intent, but not cluttered with unnecessary technical language. They normally define the organisation’s position on a risk area, set a tolerance or threshold where possible, and make clear who owns monitoring and escalation.
For senior leaders, the real value is governance discipline. A credible statement helps management challenge proposals, assess change programmes, approve investments and escalate breaches before they become incidents. It also gives internal audit, compliance and risk functions a clearer reference point when testing whether behaviour matches policy.
This is why one enterprise-wide statement is rarely enough on its own. Most organisations need an overarching risk appetite, supported by category-level statements for financial, operational, cyber, people, regulatory and reputational risk. The wording should reflect the business model and operating environment. A bank, manufacturer and regional healthcare group should not sound the same.
9 risk appetite statement examples
The examples below are deliberately concise. In practice, each would usually sit within a wider framework covering metrics, reporting triggers, review cycles and governance ownership.
1. Strategic growth risk
We accept a moderate level of risk in pursuing strategic growth, including entry into new markets, products and partnerships, provided proposals are supported by due diligence, clear accountability, defined investment limits and contingency arrangements.
This works when an organisation wants to show that risk-taking is permitted, but not speculative. The phrase moderate level of risk gives direction, while the conditions around due diligence and contingency planning stop the statement becoming a licence for unmanaged expansion.
2. Financial risk
We maintain a low appetite for risks that could materially weaken liquidity, covenant compliance or capital stability. Material exposures must remain within approved thresholds and be subject to regular stress testing and board oversight.
This type of statement is useful for organisations with debt obligations, investor scrutiny or tight cash flow dependencies. It links appetite to measurable financial resilience rather than abstract caution.
3. Operational disruption risk
We have a low appetite for operational disruption affecting critical services, customer commitments or supply continuity. Essential processes must be supported by resilience controls, recovery arrangements and tested response plans proportionate to business impact.
For resilience-focused organisations, this is often a core statement. It recognises that some disruption is unavoidable, but sustained or uncontrolled interruption is not acceptable. The wording also creates a direct bridge to business continuity and crisis management.
4. Cyber and information security risk
We have a very low appetite for cyber risks that could compromise sensitive information, interrupt critical systems or cause significant regulatory, financial or reputational harm. Exceptions to mandated security controls require formal approval and compensating measures.
Here, the language is intentionally firmer. Most organisations now treat severe cyber exposure as largely unacceptable, especially where customer data, industrial systems or regulated operations are involved. The reference to exceptions is important because control environments are rarely perfect.
5. Regulatory and compliance risk
We have no appetite for deliberate breaches of law, regulation or mandatory internal policy. We recognise that inadvertent non-compliance may occur, but it must be identified quickly, reported transparently and remediated within approved timeframes.
This is a stronger and more realistic version of the familiar no appetite formula. It avoids pretending that every breach can be eliminated, while making clear that intentional non-compliance is unacceptable and accidental failures require disciplined remediation.
6. Health and safety risk
We have no appetite for actions or conditions that could foreseeably result in serious injury, loss of life or failure to meet statutory safety obligations. Operational activity must be designed and supervised to reduce risk so far as reasonably practicable.
For high-risk operational sectors, this statement should be central. It reflects legal duties as well as moral responsibility. It also avoids the weakness of saying simply no appetite for health and safety risk, which is not credible in environments where physical activity cannot be risk free.
7. Third-party risk
We accept a limited level of third-party risk where outsourcing or supplier dependency supports efficiency or capability, provided critical suppliers are subject to due diligence, contractual protections, continuity requirements and ongoing performance monitoring.
This wording is useful where supply chain and outsourced services are essential to operating models. It recognises dependency as a business reality, but requires control over concentration, resilience and oversight.
8. Reputational risk
We have a low appetite for actions, decisions or associations likely to cause sustained damage to stakeholder trust, market standing or public confidence. Matters with potential reputational impact beyond agreed thresholds must be escalated for executive review.
Reputational statements are often weak because they rely on subjective language. This example is stronger because it links reputation to stakeholder trust and requires escalation. Even so, boards should define what beyond agreed thresholds means in practice.
9. People and conduct risk
We have a low appetite for behaviours, incentives or management practices that undermine ethical standards, leadership accountability, employee wellbeing or speak-up culture. Material conduct concerns must be investigated independently and addressed promptly.
This type of statement matters more than many frameworks admit. Conduct failures often sit behind operational, regulatory and reputational events. If leadership behaviour is outside appetite, governance needs a mechanism to detect and challenge it.
How to make these examples usable
Risk appetite statements fail when they remain theoretical. A board may approve elegant wording, but if management cannot apply it to decisions, investment cases or incidents, the framework adds little value.
The first discipline is calibration. Terms such as low, moderate and very low need a shared meaning. In some categories, qualitative guidance is enough. In others, especially financial, operational availability or cyber control compliance, quantitative thresholds are far more effective. For example, a low appetite for service disruption could be tied to maximum downtime for critical services, recovery time objectives or tolerable levels of customer impact.
The second discipline is alignment with governance. Each statement should connect to a named executive owner, a reporting rhythm and an escalation path. Without ownership, appetite becomes an abstract board preference rather than a management tool. This is particularly relevant in regional organisations where business units operate with different levels of maturity.
The third is consistency with strategy. A business cannot claim a low appetite for operational change while pursuing aggressive transformation across multiple jurisdictions. Equally, it cannot maintain a very low appetite for third-party dependency while shifting essential processes to outsourced providers. Appetite should reflect the organisation’s chosen model, not an idealised version of safety.
Common drafting mistakes
One common error is writing statements that sound absolute but are not operationally credible. Saying no appetite for operational failure, cyber incidents or reputational damage may appear strong, but it does not help managers weigh trade-offs. Most organisations need language that distinguishes acceptable exposure from unacceptable impact.
Another mistake is copying sector language without adapting it to actual business conditions. Risk appetite statement examples are useful reference points, not text to lift without scrutiny. A statement should match the organisation’s regulatory obligations, service model, stakeholder expectations and incident history.
A third problem is separating appetite from resilience capability. If a business sets a low appetite for disruption, it must invest in continuity arrangements, crisis leadership, recovery testing and decision rights. Otherwise, the statement expresses intent without protection. This is where integrated resilience architecture matters. Firms such as JABA often see this gap first-hand: governance language is approved, but operational safeguards are not built to support it.
A simple test for board-ready wording
A practical test is whether the statement answers three questions. What level of exposure is acceptable? What level is not acceptable? What must management do when conditions move outside tolerance?
If the wording cannot answer those questions, it probably needs revision. Good statements are not long. They are disciplined, specific and connected to action. They help leadership choose where to take risk deliberately, where to constrain it firmly and where to escalate without delay.
For most boards, the objective is not to produce perfect wording on the first attempt. It is to establish statements that can guide real decisions, then refine them as strategy, regulation and operating conditions change. The strongest risk appetite framework is one that management actually uses when pressure rises.