Board Risk Appetite: Setting It Deliberately, Not by Accident

Board Risk Appetite: Setting It Deliberately, Not by Accident Every board has a risk appetite already. Few have decided what it is Most association boards have a risk appetite. Very few have decided what it is. It exists by default, formed from whichever director happens to speak loudest on a given proposal, rather than deliberately set as a governance decision the whole board owns.

01 What Risk Appetite Actually Means 02 Who Actually Owns This Decision 03 Building A Genuine Risk Appetite Statement Use this resource as a board pre-read, discussion guide or governance review prompt.

What Risk Appetite Actually Means Stewardship & Risk · 5 May 2026 The AICD's Not-for-Profit Governance Principles put the underlying tension precisely: boards must be careful that they are not so concerned with negative risk that opportunities are missed, but they can also not have such a disregard for risk as to expose the organisation to serious harm, and striking an effective balance between the two is the hallmark of a sound risk appetite. This framing matters because it corrects a common misconception. Risk appetite is not a synonym for risk aversion. An organisation with a low risk appetite for financial solvency might simultaneously carry a high risk appetite for advocacy positions that could upset a funder. Appetite is not a single dial. It varies by category, and a board that has never articulated which categories it treats differently is making that distinction inconsistently, decision by decision, without anyone noticing the pattern.

Who Actually Owns This Decision The ASX Corporate Governance Council's benchmark, while written for listed companies, states the underlying principle cleanly: the board is ultimately responsible for deciding the nature and extent of the risks it is prepared to take to meet its objectives, while management is responsible for designing and implementing the framework that operates within that board-set appetite. This is precisely the governance and management boundary discussed earlier in this series, applied specifically to risk. Setting appetite is a governance decision the board cannot delegate away. Building the systems that keep the organisation operating within that appetite is an implementation task management should own. A board that has never written down its risk appetite has not avoided the decision. It has simply let the decision be made informally, inconsistently, and without anyone accountable for the pattern it actually produces.

Building A Genuine Risk Appetite Statement A risk appetite statement does not need to be a lengthy document. It needs to be specific enough to actually guide a decision when one arrives. Sector guidance points to a small number of useful components: which categories of risk the organisation treats differently, financial, reputational, regulatory, safety, mission-related, and so on, the board's tolerance in each category stated in terms specific enough to be applied rather than merely aspirational, and a connection back to the organisation's actual purpose and strategy, since a risk appetite detached from what the organisation is trying to achieve is just a list of anxieties rather than a governance tool. •

Set risk appetite by category rather than as a single organisation-wide setting, since financial caution and advocacy boldness, for instance, can legitimately coexist in the same organisation.

•

Connect appetite explicitly to purpose and strategy, so it functions as a decision-making tool rather than a static compliance document nobody actually consults.

•

Assign an owner and review cycle for the risk appetite statement, whether that sits with the Finance, Audit and Risk committee discussed earlier in this quarter or a dedicated risk function, with the full board retaining final ownership of the appetite itself.

•

Test contested decisions against the stated appetite explicitly in board papers, so directors can see when a proposal sits comfortably within it and when it is asking the board to extend beyond what it has previously agreed to tolerate.

The purpose of setting risk appetite deliberately is not to make a board more cautious. It is to make the board's actual tolerance for risk consistent, visible, and owned, rather than reinvented informally every time a difficult proposal reaches the table. This is one of the practical governance topics built into our Board Director course — alongside the papers, tools and frameworks that turn the principle into your board's actual practice. Explore the course → — Annie Gibbins

General education — not legal, financial, tax, clinical or governance advice. Confirm specifics at the relevant primary source or with your own qualified adviser. Nexus Leadership is operated by Lipstick Consulting Pty Ltd · ABN 15 619 120 482.

CONTINUE YOUR LEARNING

Turn governance principles into practical board action. Self-paced learning, editable resources and strategic support for association leaders.

NEXUS LEADERSHIP Association Management Specialists nexusleadership.com.au

BOARDROOM

ACTION WORKSHEET Turn the article into evidence, a decision and an accountable next step.

Board Risk Appetite: Setting It Deliberately, Not by Accident Editable boardroom action record 1. What is the issue or decision? State the governance question in one clear sentence.

2. What evidence do we already have? Record the facts, source documents and stakeholder evidence available now.

3. What evidence is still needed? Identify the legal, regulatory, financial, member or operational information still required.

4. What is the agreed next action? Capture the owner, timeframe and how the matter will return to the board.

ACTION REVIEW OWNER DATE Name / DD / role MM / YYYY

BOARD DECISIO N Decision / resolutio n